Trains models, in California

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Civ. Code § 1798.140(v) · Read the law's page

• Do not treat personal data scraped from a third-party aggregator, directory, or re-posting site as publicly available under the CCPA merely because it appears on a public page; the exemption reaches only lawfully available government records, information lawfully made available to the general public by the consumer or from widely distributed media, and information made available by a person to whom the consumer disclosed it without restricting the audience.
• Never treat biometric information a business collected about a consumer without that consumer's knowledge as publicly available, regardless of source.
• If you meet CCPA's revenue or volume thresholds, personal data you collect by scraping still triggers the Act's business obligations, including when it feeds AI training.

AB 316 (Ch. 672, Stats. 2025), Cal. Civ. Code Section 1714.46 · Read the law's page

• Do not defend a claim that artificial intelligence you developed, modified, or used caused harm to the plaintiff by arguing that the artificial intelligence autonomously caused the harm; the defense is unavailable (Civil Code Section 1714.46(b)).
• You may still present any other affirmative defense, including evidence relevant to causation or foreseeability, and evidence relevant to the comparative fault of any other person or entity (Section 1714.46(c)).

Cal. Assemb. B. 2013, 2023-2024 Reg. Sess. (chaptered Sept. 28, 2024) · Read the law's page

• Applies to you only if you develop a generative AI system.
• Publish on your website a summary of the training data used for your generative AI system; compliance was required by 1 January 2026.
• In that summary, disclose the data's copyright status and ownership, and whether it included personal information or third-party copyrighted content (including news).
• You need not check for a publisher's opt-out under this law: it grants publishers no explicit opt-out or compensation right, and its pressure on developers who scraped news for training comes from disclosure.
• Expect enforceability to be uncertain: a December 2025 federal executive order directed review of state AI regulations for conflict with federal policy.

Cal. Civ. Code Sections 3110 and 3111 · Read the law's page

• Post training-data documentation on your website before making a generative AI system publicly available to Californians, and again before any substantial modification
• Cover the datasets and their sources and owners, an approximate count and description of the data points, whether the data includes copyrighted or personal information, and whether synthetic data generation was used
• The duty reaches systems first made publicly available on or after 1 January 2022

Cal. Civ. Code §§ 3110-3111 (AB 2013, Ch. 817, Statutes of 2024) · Read the law's page

• If you develop a generative AI system made available to Californians, publicly post documentation of your training datasets before each release or substantial modification, starting January 1, 2026.
• State whether those datasets include copyrighted, trademarked, or patented data, and whether they include personal information.

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Gov. Code Sections 8898 to 8898.4 (SB 813, Ch. 179, Stats. 2026) · Read the law's page

• This chapter does not require you to engage an independent verification organization (IVO) or undergo a covered AI audit as a condition of developing, deploying, or operating an AI system or model in California; doing so is voluntary.
• If you want to be designated as an IVO, apply once the Government Operations Agency publishes its application requirements and designation criteria, due by January 1, 2028.
• If you are a designated IVO, submit an annual report on your standards, methodologies, governance changes, and conflicts of interest to the agency and the Legislature, starting no sooner than 12 months after your designation.
• If a court considers whether your AI system or model caused harm, an audit performed to a standard identified under this chapter is relevant to, but not conclusive of, that action; the chapter creates no safe harbor or affirmative defense.

Cal. Gov. Code Sections 11549.80 to 11549.86 (AB 1405, Ch. 178, Stats. 2026) · Read the law's page

• This chapter binds AI auditors (anyone who assesses an AI system or model on behalf of a third party), not the developer or deployer of the AI system being assessed, unless that developer or deployer also offers covered AI audits to others.
• If you offer, sell, or conduct a covered AI audit, an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with California law, register with the Government Operations Agency before doing so, starting January 1, 2029.
• If you register as an AI auditor, give the agency your business name, contact information, the California laws or regulations you audit under, relevant certifications, a description of your services, and a standard operating procedure describing the standards you apply and the basis for your accuracy and reliability claims.
• If you are a registered AI auditor, update that information with the agency within 90 days of any change that materially affects its accuracy or completeness.
• If you are a registered AI auditor, do not conduct a covered AI audit of a system, process, control, assessment, or other subject matter you materially designed, developed, implemented, or operated for the auditee, and otherwise maintain independence, objectivity, and competence throughout the audit.
• If you are a registered AI auditor conducting a covered AI audit, give the auditee a report covering the audit's scope and objectives, its results and supporting documentation, each deficiency found and how it could reasonably be addressed, whether the auditee followed its own internal safety standards and protocols within the audit's scope, the audit's limitations, and a signed and dated statement that the audit met this chapter's requirements.
• If you are a registered AI auditor, retain the information you gave the auditee and the documentation behind your audit results for at least 10 years.
• If you are a registered AI auditor, display your registration number clearly and conspicuously on advertising for your audit services, and do not retaliate against an employee who reports suspected noncompliance to the Attorney General, the Labor Commissioner, or the agency.