Makes justice decisions, in California

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Code Regs. tit. 11, sections 7020 to 7028 and 7060 to 7063 · Read the law's page

• If you operate exclusively online and have a direct relationship with the consumers you collect personal information from, give consumers an email address for requests to delete, correct and know. Every other business must give two or more designated methods, one of them a toll-free telephone number, and a website method such as a webform if you maintain a website (section 7020(a) and (b)).
• Confirm receipt of a request to delete, correct or know within 10 business days, and respond within 45 calendar days of receipt. You may extend once by up to 45 more days if you give the consumer notice and an explanation (section 7021).
• To comply with a request to delete, erase the personal information from your existing systems (archived and backup systems excepted), deidentify it or aggregate it, tell your service providers and contractors to delete it, and notify the third parties you sold or shared it with unless that proves impossible or involves disproportionate effort, in which case give the consumer a detailed explanation (section 7022(b)).
• Do not disclose specific pieces of personal information to a requestor you cannot verify, and tell the requestor that you cannot verify their identity (section 7024(a)).
• Establish, document and comply with a reasonable method for verifying that a person making a request to delete, correct or know is the consumer about whom you hold information (section 7060(a)).
• Do not require a consumer to verify their identity to opt out of sale or sharing or to limit use of sensitive personal information (section 7060(b)).
• If you sell or share personal information, process an opt-out preference signal that is in a commonly used format, and that the sending platform makes clear is meant to opt the consumer out of sale and sharing, as a valid opt-out request (section 7025(b)).
• If you collect personal information online and receive such a signal, treat it as a valid request to opt out for that browser or device and any profile associated with it, including pseudonymous profiles, and do not require the consumer to supply more than is necessary to send the signal (section 7025(c)(1) and (2)).
• Display on your website whether you have processed the consumer's opt-out preference signal as a valid request to opt out of sale or sharing (section 7025(c)(6)).
• If you sell or share personal information, provide two or more designated methods for requests to opt out, which for an online business must include an opt-out preference signal and one other listed method. A cookie banner or cookie controls alone do not count (section 7026(a)).
• If you use or disclose sensitive personal information for purposes beyond those in section 7027(m), provide two or more designated methods for requests to limit (section 7027(b)).
• Take a request to opt in after opting out through a two-step process, a clear request followed by a separate confirmation (section 7028(a)).

AB 316 (Ch. 672, Stats. 2025), Cal. Civ. Code Section 1714.46 · Read the law's page

• Do not defend a claim that artificial intelligence you developed, modified, or used caused harm to the plaintiff by arguing that the artificial intelligence autonomously caused the harm; the defense is unavailable (Civil Code Section 1714.46(b)).
• You may still present any other affirmative defense, including evidence relevant to causation or foreseeability, and evidence relevant to the comparative fault of any other person or entity (Section 1714.46(c)).

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Bus. and Prof. Code Section 6068.1 (SB 574, Ch. 858, Stats. 2026) · Read the law's page

• If you are an attorney, do not delegate the practice of law to generative artificial intelligence
• If you are an attorney who uses generative AI to assist in the practice of law, do not enter confidential, personal identifying, or other nonpublic information into a generative AI system unless access to what you input is restricted to you and persons you authorize under obligations to protect its confidentiality
• Take reasonable steps to verify the accuracy of generative AI outputs, including all case and statutory citations, and to correct any erroneous or hallucinated output in any material you use
• Disclose the use of generative AI to the court for all documents you submit to the court, and consider whether to disclose its use if it is used to create content provided to the public
• Do not file a brief, pleading, motion, or other paper in any court that contains a citation you have not personally verified, including a citation provided by generative AI
• If you are an arbitrator, do not delegate any part of your decisionmaking process to any generative AI tool, and do not rely on information generated by generative AI outside the record without making appropriate disclosures to the parties beforehand and, as far as practical, allowing them to comment on its use