Reuses other publishers' content, in California

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Assemb. B. 2013, 2023-2024 Reg. Sess. (chaptered Sept. 28, 2024) · Read the law's page

• Applies to you only if you develop a generative AI system.
• Publish on your website a summary of the training data used for your generative AI system; compliance was required by 1 January 2026.
• In that summary, disclose the data's copyright status and ownership, and whether it included personal information or third-party copyrighted content (including news).
• You need not check for a publisher's opt-out under this law: it grants publishers no explicit opt-out or compensation right, and its pressure on developers who scraped news for training comes from disclosure.
• Expect enforceability to be uncertain: a December 2025 federal executive order directed review of state AI regulations for conflict with federal policy.

Cal. Bus. and Prof. Code Sections 22757 to 22757.6 · Read the law's page

• Make available, at no cost to the user, a disclosure verification tool that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by your generative AI system and that outputs any system provenance data detected in the content
• To the extent it is technically feasible, embed in image, video, and audio content your system creates or alters a latent disclosure carrying your name, the system's name and version, the time and date, a unique identifier, and whether the system created or altered the content, and make it permanent or extraordinarily difficult to remove
• Do not collect, use, retain, sell, share, or otherwise make available personal information derived from a user of the verification tool or from content it processes beyond what is strictly necessary, and do not make access to your system or the tool depend on a user providing personal information beyond that
• If you license your system, tell the licensee its obligations under the chapter; if you know a licensee modified it so that it no longer complies, end the licensee's authorization or notify the licensee within 72 hours, and report an unresolved licensee's noncompliance to the Attorney General
• Do not falsely represent that your generative AI system is designed to primarily function as assistive technology
• If you run a large online platform, from 1 January 2027 detect provenance data in content distributed on it, show users a clear indication of whether any system provenance data or digital signature identifies the content as generated, substantially altered, or captured by a device, let users inspect that data, and, to the extent technically feasible, do not knowingly strip it
• If you manufacture a capture device that you first produce for sale in California on or after 1 January 2028, provide users the option to include in captured content a latent disclosure naming you as manufacturer, the device's name and version, and the time and date of the content's creation or alteration, and embed latent disclosures in captured content by default, to the extent technically feasible and compliant with widely adopted specifications
• Later phases add duties for GenAI hosting platforms from 1 January 2027

Cal. Bus. and Prof. Code Section 17610 (SB 1050, Ch. 246, Stats. 2026) · Read the law's page

• Include a clear and conspicuous disclosure in any advertisement you create and cause to be published that prominently includes a synthetic performer, a digital figure, voice, or representation made in whole or in part with generative AI that gives the realistic impression of a human performer who is not an identifiable natural person
• Use disclosure wording substantially similar to "this performance features a synthetic performer" or "no human performer is depicted"
• If you are an advertising medium served with a court order finding that an advertisement violates the chapter or enjoining its creator, remove, disable access to, or stop disseminating the advertisement in California and stop accepting payment for further dissemination