(1) Existing law generally regulates artificial intelligence, including by requiring, on or before January 1, 2026, and before each time thereafter, that a generative artificial intelligence system or service, or a substantial modification to a generative artificial intelligence system or service, released on or after January 1, 2022, is made publicly available to Californians for use, the developer of the system or service to post on the developer's internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service, as prescribed. This bill would enact the Transparency in Frontier Artificial Intelligence Act (TFAIA) that would, among other things related to ensuring the safety of a foundation model, as defined, developed by a frontier developer, require a large frontier developer to write, implement, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer's frontier models and describes how the large frontier developer approaches, among other things, incorporating national standards, international standards, and industry-consensus best practices into its frontier AI framework. The TFAIA would also require a large frontier developer to transmit to the Office of Emergency Services a summary of any assessment of catastrophic risk, as defined, resulting from internal use of its frontier models, as specified. The TFAIA would require the Office of Emergency Services to establish a mechanism to be used by a frontier developer or a member of the public to report, as prescribed, a critical safety incident, as defined, and would also require the Office of Emergency Services to establish a mechanism to be used by a large frontier developer to confidentially submit summaries of any assessments of the potential for catastrophic risk resulting from internal use of its frontier models, as prescribed. The TFAIA would exempt from the California Public Records Act a report of a critical safety incident submitted to the Office of Emergency Services, a report of assessments of catastrophic risk from internet use, and a covered employee report made pursuant to the whistleblower protections described below. The TFAIA would impose a civil penalty for noncompliance with the TFAIA to be enforced by the Attorney General, as prescribed. (2) Existing law establishes the Department of Technology within the Government Operations Agency. Existing law requires the department to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. This bill would establish within the Government Operations Agency a consortium required to develop a framework for the creation of a public cloud computing cluster to be known as "CalCompute" that advances the development and deployment of artificial intelligence that is safe, ethical, equitable, and sustainable by, among other things, fostering research and innovation that benefits the public, as prescribed. The bill would require the Government Operations Agency to, on or before January 1, 2027, submit a report from the consortium to the Legislature with that framework and would dissolve the consortium upon submission of that report. The bill would make those provisions operative only upon an appropriation in a budget act, or other measure, for its purposes. (3) Existing law prohibits employers and their agents from making, adopting, or enforcing a rule, regulation, or policy preventing an employee from disclosing information to certain entities or from providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry if the employee has reasonable cause to believe that the information discloses a violation of a law, as specified, and prohibits retaliation against an employee for, among other things, exercising these rights. This bill would, among other things related to protecting whistleblowers working with foundation models, prohibit a frontier developer from making, adopting, enforcing, or entering into a rule, regulation, policy, or contract that prevents a covered employee, as defined, from disclosing, or retaliates against a covered employee for disclosing, information to the Attorney General, a federal authority, a person with authority over the covered employee, or another covered employee who has authority to investigate, discover, or correct the reported issue, if the covered employee has reasonable cause to believe that the information discloses that the frontier developer's activities pose a specific and substantial danger to the public health or safety resulting from a catastrophic risk or that the frontier developer has violated the TFAIA. This bill would require a large frontier developer to provide a certain internal process through which a covered employee may anonymously disclose information to the large frontier developer if the covered employee believes in good faith that the information indicates that the large frontier developer's activities present a specific and substantial danger to the public health or safety resulting from a catastrophic risk or that the large frontier developer violated the TFAIA. The bill would specify provisions particular to the enforcement of those whistleblower protections and would authorize attorney's fees to a plaintiff who brings a successful action for a violation. This bill would preempt any rule, regulation, code, ordinance, or other law adopted by a city, county, city and county, municipality, or local agency on or after January 1, 2025, specifically related to the regulation of frontier developers with respect to their management of catastrophic risk. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specifies the damages and costs authorized to be recovered. This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide that these provisions do not alter applicable law regarding use by a law enforcement agency, as defined, of personal information generated by an electronic monitoring device. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes. This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program. Existing law, the Confidentiality of Medical Information Act (CMIA) , generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state's laws that interfere with a person's rights to choose or obtain an abortion or a foreign penal civil action. This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state's laws that interfere with a person's rights to choose or obtain an abortion or a foreign penal civil action. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
(1) Existing law prohibits, except as required by state or federal law or as required to administer a state or federally supported educational program, school officials and employees of a school district, county office of education, or charter school from collecting information or documents regarding citizenship or immigration status of pupils or their family members. Existing law requires the superintendent of a school district, the superintendent of a county office of education, and the principal of a charter school, as applicable, to report to the respective governing board or body of the local educational agency in a timely manner any requests for information or access to a schoolsite by an officer or employee of a law enforcement agency for the purpose of enforcing the immigration laws in a manner that ensures the confidentiality and privacy of any potentially identifying information. This bill would prohibit school officials and employees of a local educational agency from allowing an officer or employee of an agency conducting immigration enforcement to enter a nonpublic area of a schoolsite, as defined, for any purpose without being presented with a valid judicial warrant, judicial subpoena, or a court order. The bill would require school officials and employees of a local educational agency, to the extent practicable, to request valid identification of any officer or employee of an agency conducting immigration enforcement seeking to enter a nonpublic area of a schoolsite. The bill would also prohibit a local educational agency and its personnel from disclosing or providing, in writing, verbally, or in any other manner, the education records of or any information about a pupil or a pupil's family and household without the pupil's parents' or guardians' written consent, a school employee, or a teacher to an officer or employee of an agency conducting immigration enforcement without a valid judicial warrant or judicial subpoena, or court order directing the local educational agency or its personnel to do so. By imposing additional duties on local educational agencies, the bill would impose a state-mandated local program. (2) Existing law requires the Attorney General, by April 1, 2018, in consultation with the appropriate stakeholders, to publish model policies limiting assistance with immigration enforcement at public schools, to the fullest extent possible consistent with federal and state law, and ensuring that public schools remain safe and accessible to all California residents, regardless of immigration status, as provided. Existing law requires local educational agencies, by July 1, 2018, to adopt those model policies developed by the Attorney General or equivalent policies. This bill would require the Attorney General, by December 1, 2025, to update those model policies to ensure that the policies align with the above-described prohibitions on school officials and employees of local educational agencies allowing an officer or employee of an agency conducting immigration enforcement to enter a nonpublic area of a schoolsite without a valid judicial warrant or judicial subpoena, or a court order and from disclosing or providing certain information to those officers or employees, as provided. The bill also would require a local educational agency to update its model policy by March 1, 2026, and to make the policy available to the State Department of Education upon request. By imposing additional duties on local educational agencies, the bill would impose a state-mandated local program. (3) This bill would make these provisions severable. (4) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. (5) This bill would declare that it is to take effect immediately as an urgency statute.
Existing law establishes the Attorney General as the head of the Department of Justice, with charge of all legal matters in which the state is interested, except as specified. Existing law imposes various responsibilities on the Attorney General related to consumer protection, including, among others, the supervision of charitable trusts and the enforcement of antitrust laws. Existing law, commonly known as the Cartwright Act, identifies certain acts that are unlawful restraints of trade and unlawful trusts and prescribes provisions for its enforcement through civil actions. This bill would enact the California Preventing Algorithmic Collusion Act of 2025, to prohibit a person, as described, from distributing or making recommendations based on the use of a pricing algorithm to 2 or more competitors, as defined, under specified circumstances, if the person knows or should know that the pricing algorithm processes competitor data, as defined. This bill would also prohibit a person from using the recommendation of a pricing algorithm that processes competitor data, as specified, if the person knows or should know that the pricing algorithm uses or incorporates competitor data. The bill would establish an affirmative defense to liability under this prohibition for a person who demonstrates by a preponderance of evidence that they exercised reasonable due diligence before using the recommendations of a pricing algorithm, as specified. The bill would specify when the use, recommendation, or distribution of a pricing algorithm constitutes separate violations. The bill would declare that these provisions do not apply if all of the competitor data processed by the pricing algorithm was collected more than one year before the use, recommendation, or distribution of the pricing algorithm. The bill would declare that a contract that violates these provisions is to that extent void. This bill would authorize the Attorney General, a district attorney, a county counsel, or a city attorney to bring a civil action for violation of the above-described provisions to seek restitution, punitive damages, a civil penalty of up to $25,000 per violation, and other appropriate relief, as provided. The bill would declare that its provisions shall not impair or limit the applicability of antitrust laws, as defined. The bill would exempt from its provisions the development, distribution, output, or use of a credit score or other computational tool either subject to specified law or provided by a commercial credit reporting agency, as specified.
Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information, as specified. Existing law, the California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce those provisions. Existing law requires a retail grocery store or grocery department within a general retail merchandise store that uses a point-of-sale system to have a clearly readable price indicated on 85% of the total number of packaged consumer commodities offered for sale, subject to specified exemptions. This bill would, subject to certain exceptions, prohibit a grocery establishment, as defined, from engaging in surveillance pricing. The bill would define "surveillance pricing" to mean offering or setting a customized price increase for a good or service for a specific consumer or group of consumers, based, in whole or in part, on personally identifiable information collected through electronic surveillance technology, as specified. The bill would provide that only a public prosecutor, as specified, may bring an action against a violator of these provisions to recover specified civil penalties, injunctive relief, and reasonable attorney's fees and costs, and would authorize a consumer to bring an action for injunctive relief and reasonable attorney's fees and costs. The bill would declare that any waiver of these provisions is against public policy and is void and unenforceable. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law authorizes the operation of an autonomous vehicle on public roads for testing purposes by a driver who possesses the proper class of license for the type of vehicle operated if specified requirements are satisfied. Existing law prohibits the operation of an autonomous vehicle on public roads until the manufacturer submits an application to the Department of Motor Vehicles, as specified, and that application is approved. A violation of the Vehicle Code or a local ordinance adopted pursuant to that code is an infraction. This bill would prohibit the delivery of commercial goods, as defined, directly to a residence or to a business for its use or retail sale through the operation of an autonomous vehicle without a human safety operator on any highway within the State of California. The bill would make a first violation of this provision subject to a $10,000 administrative fine and a $25,000 administrative fine for subsequent violations. The bill would authorize the department to suspend or revoke the permit of an autonomous vehicle manufacturer for repeated violations of this provision. The bill would require the department to submit a report to the Legislature evaluating the performance of autonomous vehicle technology and its impact on public safety and employment, as specified. This bill would require all relevant state agencies, including, among others, the Department of Transportation and the State Air Resources Board, to provide information to the department to research this report. The bill would prohibit the department from issuing a deployment permit for the use of an autonomous vehicle to deliver commercial goods without a human safety operator until a later enacted statute authorizes the issuance of a permit for that purpose. The bill would also make certain findings and declarations related to these provisions.
Existing law generally regulates artificial intelligence, including by requiring the Office of Emergency Services to, as appropriate, perform a risk analysis of potential threats posed by the use of generative artificial intelligence to California's critical infrastructure, including those that could lead to mass casualty events. This bill would require the Attorney General to establish and maintain a specified program to build internal expertise in artificial intelligence, including its applications, risks, regulatory implications, and civil rights impacts. The bill would require, on or before July 1, 2027, and annually thereafter, the Attorney General to submit a public report to the Legislature describing the program, key developments in artificial intelligence law and policy, and recommendations for additional state oversight or safeguards.
Existing law governs various business practices in this state, including certain laws relating to the use of technology. Existing law, commonly known as the Cartwright Act, identifies certain acts that are unlawful restraints of trade and unlawful trusts and prescribes provisions for its enforcement through civil actions. This bill, the Preventing Algorithmic Price Fixing Act, would prohibit a person from selling, licensing, providing, or using a price-setting algorithm, as defined, with the intent or reasonable expectation that it be used by 2 or more competitors, as defined, in the same market if the person knows or should know that the algorithm processes nonpublic data, as defined, to set either: (1) a price or supply level of a good or service or (2) a rent or occupancy level of rental property. The bill would provide a user of a price-setting algorithm an affirmative defense to liability if the user exercised reasonable due diligence, as specified. The bill would authorize the Attorney General or a district attorney, city attorney, or county counsel to file a civil action for violations of these provisions, as specified, including for a civil penalty of up to $1,000 per violation, as specified. This bill would declare that a contract that violates these provisions is to that extent void and that its provisions do not limit the applicability of antitrust laws.
Existing law makes it unlawful for any person to use a bot to communicate or interact with another person in this state online with the intent to mislead the other person about its artificial identity for the purposes of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election, unless the person using the bot discloses that it is a bot. Existing law defines a "bot" as an automated online account where all or substantially all of the actions or posts of that account are not the result of a person. This bill would require a person who uses a bot to autonomously communicate with another to ensure that the bot discloses to any person with whom the bot communicates when the bot first communicates with the person that the bot is a bot and not a human being, answers truthfully any query from a person regarding its identity as a bot or a human, and refrains from attempting to mislead a person regarding its identity as a bot. The bill would redefine "bot" to mean an automated online account or application that a reasonable person could believe is a human being and with respect to which substantially all of the actions or posts of that account or application are the outputs of generative artificial intelligence, as defined. The bill would exempt from its provisions a person who uses a bot that is required to comply with a more prescriptive disclosure scheme. This bill would authorize the Attorney General, a district attorney, a county counsel, a city attorney, or a city prosecutor to bring a civil action to punish noncompliance, as prescribed.
Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. Existing law requires specified state entities to implement the policies and procedures issued by the office. Existing law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing law requires every state agency, as specified, to certify, by February 1 annually, to the office that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified. This bill would require every state agency, as specified, and subject to specified exceptions, to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the office's chief to develop or revise uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislature's intent that the bill's provisions be implemented in a manner consistent with the state's timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.
