(1) Existing law prohibits the false impersonation of another person in either their personal or official capacity with the intent to steal or defraud, as specified. This bill would define various terms related to artificial intelligence and digital replication, and would clarify that false impersonation includes the use of a digital replica with the intent to impersonate another for purposes of these and other criminal provisions. (2) Existing law creates a civil cause of action against any person who knowingly uses the name, voice, signature, photograph, or likeness of another person, without their consent, for specified purposes. When a photograph or likeness of an employee of the person using the photograph or likeness appearing in an advertisement or other publication is incidental and not essential to the purpose of the publication, existing law establishes a rebuttable presumption affecting the burden of producing evidence that failure to obtain the consent of an employee was not a knowing use of an employee's photograph or likeness. This bill would clarify that, for purposes of this cause of action, a voice or likeness includes a digital replica, as defined. The bill would also remove the provisions establishing the rebuttable presumption when an employee's likeness or photograph appears in an advertisement or other publication. (3) Existing law governs the admissibility of evidence in court proceedings. Existing law prescribes procedures for the authentication of photographs and audio and video recordings. This bill would require the Judicial Council, by no later than January 1, 2027, to review the impact of artificial intelligence on the admissibility of proffered evidence in court proceedings and develop any necessary rules of court to assist courts in assessing claims that proffered evidence has been generated by or manipulated by artificial intelligence and determining whether such evidence is admissible. (4) Existing law, the Unfair Competition Law, establishes a statutory cause of action for unfair competition, including any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or misleading advertising, and establishes remedies and penalties in that regard, including civil penalties. This bill would require, by December 1, 2026, and except as provided, any person or entity that makes available to consumers any artificial intelligence technology that enables a user to create a digital replica, as defined, to provide a consumer warning that unlawful use of the technology to depict another person without prior consent may result in civil or criminal liability for the user. The bill would require the warning to be hyperlinked on any page or screen where the consumer may input a prompt to the technology and included in the terms and conditions for use of the technology. The bill would also impose a civil penalty for violations of the requirement. This bill would incorporate additional changes to Section 3344 of the Civil Code proposed by SB 683 to be operative only if this bill and SB 683 are enacted and this bill is enacted last.
Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems (ADS) that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law establishes the Labor and Workforce Development Agency, which is composed of various departments responsible for protecting and promoting the rights and interests of workers in California, including the Division of Labor Standards Enforcement, led by the Labor Commissioner, within the Department of Industrial Relations. This bill would require an employer to provide a written notice that an ADS, for the purpose of making employment-related decisions, not including hiring, is in use at the workplace to all workers that will foreseeably be directly affected by the ADS, as specified. The bill would require the employer to maintain an updated list of all ADS currently in use. The bill would require an employer to notify, as provided, a job applicant that the employer utilizes an ADS when making hiring decisions, if the employer will use the ADS in making decisions for that position. The bill would prohibit an employer from using an ADS that does certain functions and would limit the purposes and manner in which an ADS may be used to make decisions. The bill would authorize a worker to request, and require an employer to provide, a copy of the most recent 12 months of the worker's own data primarily used by an ADS to make a discipline, termination, or deactivation decision, as specified. The bill would require an employer that primarily relied on an ADS to make a discipline, termination, or deactivation decision to provide the affected worker with a written notice, as specified. This bill would prohibit an employer from discharging, threatening to discharge, demoting, suspending, or in any manner discriminating or retaliating against any worker for taking certain actions asserting their rights under the bill. The bill would require the Labor Commissioner to enforce the bill's provisions, as specified, and would authorize a public prosecutor to bring a civil action. The bill would set forth specified types of relief that a plaintiff may seek and specified penalties that an employer that violates these provisions is subject to, including a $500 civil penalty. The bill would also provide that an employer who complies with the requirements related to notice in this bill is not required to comply with any substantially similar provisions under any other state law, except as specified. The bill would not apply to parties covered by a valid collective bargaining agreement if the agreement contains specified information, including an explicit waiver of the bill's provisions. The bill would declare that its provisions do not prohibit any employer from complying with regulatory or contractual requirements in the provision of products or services to the federal government, as defined. This bill would declare that its provisions are severable.
Existing law establishes the Medi-Cal program, which is administered by the State Department of Health Care Services, under which qualified low-income individuals receive health care services. The Medi-Cal program is, in part, governed and funded by federal Medicaid program provisions. Under existing law, in-person, face-to-face contact is not required under the Medi-Cal program when covered health care services are provided by video synchronous interaction, asynchronous store and forward, audio-only synchronous interaction, remote patient monitoring, or other permissible virtual communication modalities, when those services and settings meet certain criteria. Existing law required the department, on or before January 1, 2023, to develop a research and evaluation plan that, among other things, proposes strategies to analyze the relationship between telehealth and access to care, quality of care, and Medi-Cal program costs, utilization, and program integrity. The department created that plan in December of 2022 and published the Biennial Telehealth Utilization Report in April of 2024. This bill, the Telehealth for All Act of 2025, would require the department, commencing in 2028 and every 2 years thereafter, to use Medi-Cal data and other data sources available to the department to produce analyses in a publicly available Medi-Cal telehealth utilization report. The bill would authorize the department to include those analyses in each of the department's Biennial Telehealth Utilization Reports, as specified. The bill would require the analyses to address telehealth access and utilization data, including various metrics on telehealth visits and claims, disaggregated by geographic, demographic, and social determinants of health categories to identify disparities. The bill would require the department to identify additional data elements for inclusion in future reports to help to identify and address access-to-care issues or provide greater insight into utilization of telehealth modalities.
Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order. Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure. This bill would authorize a survivor, as defined, or a designated representative of a survivor, to submit a device protection request to an account manager, as defined, seeking to terminate a perpetrator's access to a connected device or associated user account. The bill would define "survivor" for these purposes to mean an individual who has had specified criminal acts committed or allegedly committed against them or who cares for another individual against whom those criminal acts have been committed or allegedly committed, as provided. The bill would require an account manager, within 2 business days of receiving a complete device protection request, to terminate or disable the perpetrator's access to the connected device or user account, or to inform the survivor, in a clear and conspicuous manner, of any methods to reset the device to factory settings or a similar state that removes all account holders, as provided. The bill would specify the requirements for a device protection request and would impose certain requirements on an account manager in processing a request. By providing that a device protection request may include a copy of a signed affidavit, the bill would expand the crime of perjury, and thus impose a state-mandated local program. This bill would require the account manager to clearly describe the process to submit a device protection request on their internet website or mobile application and would prohibit the account manager from providing specified information to the perpetrator. The bill would require an account manager and any officer, director, employee, vendor, or agent thereof to treat any information submitted by a survivor or a designated representative of a survivor as confidential and securely dispose of the information, as provided. This bill would authorize enforcement of these provisions by injunction or civil penalty in any court action by any person injured by a violation of those provisions, the Attorney General, a district attorney, county counsel, a city attorney, or a city prosecutor, against an account manager or perpetrator, as provided. The bill would prohibit a waiver of these prohibitions and would declare that these provisions are severable. Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law generally provides for the regulation of law enforcement agencies, including, among other things, requiring each local law enforcement agency to conspicuously post on their internet websites all current standards, policies, practices, operating procedures, and education and training materials that would otherwise be available to the public under specified circumstances. This bill would require each law enforcement agency to maintain a policy to require an official report prepared by a law enforcement officer or any member of a law enforcement agency that is generated using artificial intelligence either fully or partially to include specified information, including a disclosure statement and the signature of the law enforcement officer or member of a law enforcement agency who prepared the official report, as specified. If an officer or any member of an agency uses artificial intelligence to create an official report, the bill would require the first draft created to be retained for as long as the official report is retained. The bill would, except for the official report, prohibit a draft of any report created with the use of artificial intelligence from constituting an officer's statement. The bill would require an agency utilizing artificial intelligence to generate a first draft or official report to maintain an audit trail that identifies, at a minimum, certain things, including the person who used artificial intelligence to create a report. The bill would prohibit a contracted vendor from sharing, selling, or otherwise using information provided by a law enforcement agency to be processed by artificial intelligence, except as provided. The bill would define terms for purposes of these provisions. By requiring local law enforcement agencies to adopt a new policy, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
Existing law provides that everyone is responsible not only for the result of their willful acts, but also for an injury occasioned to another by their want of ordinary care or skill in the management of their property or person. Existing law requires the developer of a generative artificial intelligence system or service that is released on or after January 1, 2022, and made publicly available to Californians for use, to post on the developer's internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service. Existing law defines "artificial intelligence" for these purposes. This bill would prohibit a defendant who developed, modified, or used artificial intelligence, as defined, from asserting a defense that the artificial intelligence autonomously caused the harm to the plaintiff.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, including the right to request that a business disclose specified information that has been collected about the consumer, to request that a business delete personal information about the consumer that the business has collected from the consumer, and to direct a business not to sell or share the consumer's personal information, as specified. The CCPA defines various terms for these purposes. The California Privacy Rights Act of 2020 (CPRA) , approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the agency, and defines "data broker" to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. Existing law requires a data broker, in registering with the agency, to pay a registration fee in an amount determined by the agency and provide specified information, including, among other things, the name of the data broker and its primary physical, email, and internet website addresses, and whether the data broker collects the personal information of minors, consumers' precise geolocation, or consumers' reproductive health care data. This bill would require a data broker to provide additional information to the agency, including whether the data broker collects consumers' names, dates of birth, ZIP Codes, email addresses, phone numbers, login or account information, various government identification numbers, mobile advertising, connected television, or vehicle identification numbers, citizenship data, union membership status, sexual orientation status, gender identity and gender expression data, biometric data, and up to 3, but no fewer than one, of the most common types of personal information that the data broker collects, as provided. The bill would also require a data broker to provide information regarding whether, in the past year, the data broker shared or sold consumers' data to a foreign actor, as defined, the federal government, other state governments, law enforcement, as provided, or a developer of a GenAI system, as defined. The bill would make changes to the administrative fines and costs that apply to data brokers who fail to register. Existing law requires, beginning January 1, 2026, the California Privacy Protection Agency to establish an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. Existing law requires, beginning August 1, 2026, a data broker to access the accessible deletion mechanism at least once every 45 days and, among other things, process a denied request to delete personal information as an opt-out of the sale or sharing of the consumer's personal information under the CCPA, as specified. This bill would require a data broker to process the above-described denied request within 45 days of receiving the request. Existing law requires the agency to create a page on its internet website where registration information provided by data brokers and the accessible deletion mechanism is accessible to the public. This bill would prohibit the agency from making accessible to the public on its internet website information regarding whether the data broker collects consumers' names, dates of birth, zip codes, email addresses, phone numbers, mobile advertising, connected television, or vehicle identification numbers, and the most common types of personal information that it collects. This bill would declare that it furthers the purposes and intent of the CPRA for specified reasons.
Existing law requires a social media platform to take various steps to prevent cyberbullying of minors on the platform, including by requiring the platform to establish a prominent mechanism within its internet-based service that allows any individual, whether or not that individual has a profile on the internet-based service, to report cyberbullying or any content that violates the existing terms of service related to cyberbullying. Existing law authorizes the State Department of Public Health to establish the Office of Suicide Prevention in the department, as prescribed. This bill would, among other things related to making a companion chatbot platform safer for users, if a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human, require an operator of a companion chatbot platform to issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human. The bill would also require an operator to take certain actions with respect to a user the operator knows is a minor, including disclose to the user that the user is interacting with artificial intelligence. The bill would also require an operator to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, as specified, and would require an operator to publish details on that protocol on the operator's internet website. This bill would, beginning July 1, 2027, require an operator to annually report to the Office of Suicide Prevention certain things, including protocols put in place to detect, remove, and respond to instances of suicidal ideation by users, and would require the office to post data from that report on its internet website. The bill would authorize a person who suffers injury in fact as a result of noncompliance with the bill to bring a certain civil action.
Existing law grants to a depicted individual a cause of action against a person who creates and intentionally discloses sexually explicit material if the person knows, or reasonably should have known, that the depicted individual in that material did not consent to its creation or disclosure or who intentionally discloses sexually explicit material that the person did not create if the person knows the depicted individual in that material did not consent to the creation of the sexually explicit material. Existing law defines "sexually explicit material" for purposes of that provision to mean any portion of an audiovisual work that shows the depicted individual performing in the nude or appearing to engage in, or being subjected to, sexual conduct and defines "depicted individual" to mean an individual who appears, as a result of digitization, to be giving a performance the individual did not actually perform or to be performing in an altered depiction. Existing law authorizes a plaintiff to recover, among other relief, statutory damages of not less than $1,500 but not more than $30,000, or $150,000 for a malicious violation, as prescribed. This bill would revise and recast the provision described above to additionally grant to a depicted individual a cause of action against a person who knows, or reasonably should know, that the depicted individual was a minor when the digitized sexually explicit material was created and would additionally grant a cause of action to that depicted individual against a person who knowingly facilitates or recklessly aids or abets conduct prohibited by that provision. The bill would define "digitized sexually explicit material" to mean any portion of a visual or audiovisual work created or substantially altered through digitization, including an image, that shows the depicted individual in the nude or appearing to engage in, or being subjected to, sexual conduct. This bill would make a person that provides a service that enables the ongoing operation of a deepfake pornography service presumed to be engaged in knowing facilitation or reckless aiding or abetting, as described above, if a depicted individual or public prosecutor provides the person with evidence sufficient to demonstrate that the person is providing services that enable the ongoing operation of a deepfake pornography service that engages in conduct described in the provisions described above, and the person fails to take all necessary steps to stop providing services that enable the ongoing operation of a deepfake pornography service within 30 days of receiving that evidence, as specified. This bill would increase the maximum statutory damages available to a depicted individual to $50,000 if the violation was not malicious and $250,000 for a malicious violation and would authorize certain public attorneys to bring a civil action to enforce these provisions, as specified.
Existing law generally regulates social media platforms, including, among other laws, the Protecting Our Kids from Social Media Addiction Act that prohibits an operator of an addictive internet-based service or application, including a social media platform, from providing an addictive feed, as defined, to a minor user, except as prescribed. This bill would enact the Social Media Warning Law that would require a covered platform, as defined, to display a certain black box warning to certain users each day the user initially accesses the social media platform, again after 3 hours of cumulative active use, and thereafter at least once per hour of cumulative active use, as prescribed. This bill would specify that its provisions shall not be interpreted to serve as the basis for a private right of action, as specified. The bill would make its provisions operative on January 1, 2027, and would declare these provisions severable.
