Law / United States / 
California
California Consumer Privacy Act, publicly-available-information exemption (as amended by AB 1008)
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- Do not treat personal data scraped from a third-party aggregator, directory, or re-posting site as publicly available under the CCPA merely because it appears on a public page; the exemption reaches only lawfully available government records, information lawfully made available to the general public by the consumer or from widely distributed media, and information made available by a person to whom the consumer disclosed it without restricting the audience.
- Never treat biometric information a business collected about a consumer without that consumer's knowledge as publicly available, regardless of source.
- If you meet CCPA's revenue or volume thresholds, personal data you collect by scraping still triggers the Act's business obligations, including when it feeds AI training.
These lines are LexLint's reading of the law's text. Also read by: California Department of Justice, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://oag.ca.gov/privacy/ccpa
- Guidance body
- California Department of Justice, Office of the Attorney General
- Open questions
- Does personal data a business collects from a consumer's public social media profile count as information "lawfully made available to the general public by the consumer" under Civil Code section 1798.140(v)(2)(B)(i)(II)?
- Is information that an aggregator or data broker re-posts "made available by a person to whom the consumer has disclosed the information" under Civil Code section 1798.140(v)(2)(B)(i)(III) when the consumer never restricted the audience?
What it makes you log
Logging duty
Subdivision (v) defines personal information, excludes publicly available information and deidentified or aggregate information in paragraphs (2) and (3), and lists the formats personal information can take in paragraph (4). It is a definition and states no duty to create, keep or produce a record. The Act's business duties, its consumer-request records and the regulator's powers sit in other sections of the title that the row does not cite. Subdivision (i) of the same section defines a consumer as a California resident; subdivision (v) itself states no territorial test.
- Kind
- None
- As of
What this law does
Section 1798.140(v) defines publicly available narrowly: lawfully available government records, information a business has a reasonable basis to believe the consumer themselves lawfully made available to the public or through widely distributed media, or information made available by a person to whom the consumer disclosed it without restricting the audience, and it expressly excludes biometric information a business collected about a consumer without the consumer's knowledge.
The publicly available carve-out applies only to information within one of those limbs, and a for-profit entity doing business in California that determines the purposes and means of processing consumers' personal information it collects, including by gathering, obtaining or accessing it by any means, is a business under the Act if it has annual gross revenues above $25,000,000 (as adjusted), buys, sells or shares the personal information of 100,000 or more consumers or households, or derives 50 percent or more of its annual revenues from selling or sharing it.
AB 1008 (Chapter 802, Statutes of 2024) amended this section to specify that personal information can exist in various formats. Those formats include artificial intelligence systems that are capable of outputting personal information. Section 1.5 of SB 1223 (Chapter 887, Statutes of 2024) incorporates the amendments proposed by both bills.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .