Artificial Intelligence

Requires human oversight and approval of AI systems managing critical state infrastructure by July 2026. Mandates annual AI safety training for state personnel overseeing critical infrastructure systems. Establishes yearly assessments of AI systems to evaluate risks and performance in critical infrastructure. Requires real-time human monitoring of AI operations in vital state services like energy and healthcare.

Increases penalties for social media platforms that violate cyberbullying prevention rules to $50,000 per violation. Establishes that each day of non-compliance counts as a separate violation for penalty purposes. Authorizes courts to order platforms to comply and award attorney fees to successful plaintiffs.

Establishes a new state registry system for artificial intelligence auditors who evaluate AI systems in California. Requires AI auditors to enroll with the state, pay fees, and follow industry standards by January 2027. Prohibits auditors from working for audited companies within 12 months before or after conducting an audit. Creates a public reporting system for misconduct and protects whistleblowers who report violations.

Prohibits businesses from collecting location data unless necessary to provide requested services. Requires prominent notices when location data is collected and mandates detailed privacy policies. Bans the sale or monetization of location information by businesses and government agencies. Establishes penalties up to $25,000 per violation and allows both state enforcement and private lawsuits.

Prohibits third-party platforms from listing restaurant reservations without written agreements from establishments. Authorizes the Attorney General to impose civil penalties up to $1,000 per violation. Creates a state fund from collected penalties to enforce restaurant reservation regulations. Allows restaurants and authorized reservation services to sue unauthorized platforms for damages.

Establishes a state working group to evaluate artificial intelligence use in mental health treatment by July 2026. Requires input from health organizations, tech companies, and advocacy groups through three public meetings. Mandates comprehensive reports to the Legislature on AI in mental health by July 2028 and January 2030. Creates a framework for training mental health professionals on effective use of AI tools in treatment.

Requires law enforcement to disclose and track the use of artificial intelligence in police reports. Mandates retention of all AI-generated report drafts alongside final versions. Prohibits vendors from sharing or selling law enforcement data processed by AI systems. Requires officers to verify the accuracy of AI-generated reports with their signature.

Requires California to develop a statewide AI cybersecurity playbook by July 2026 to combat emerging threats. Mandates information sharing between state AI contractors about potential cybersecurity vulnerabilities. Establishes strict confidentiality rules for shared cybersecurity threat information. Creates a dedicated cyber incident response team to detect and address threats across California.

Expands student privacy protections to cover K-12, preschool, and higher education institutions by July 2026. Prohibits operators from using student data to train AI systems unless specifically for educational purposes. Requires operators to implement data security measures and delete student information upon request. Allows students to sue operators for privacy violations with damages up to $500 per incident.

Requires social media platforms to provide clear reporting mechanisms for child sexual abuse material. Mandates platforms to review reported content through hash matching and human review within 30 days. Imposes penalties up to $250,000 per day on platforms that fail to maintain functional reporting systems. Requires platforms to undergo bi-annual third-party safety audits and publicly release findings.

Prohibits AI systems from providing mental health therapy or forming emotional bonds with children under 18. Bans the use of AI to collect children's biometric data or create social scores without parental consent. Requires developers to prevent children from accessing AI systems not designed for their use. Allows penalties up to $25,000 per violation and enables families to sue for damages.

Requires device manufacturers to verify user age during account setup to protect minors online. Mandates apps to receive age verification signals before allowing downloads for users under 18. Establishes fines up to $7,500 per child for intentional violations of age verification requirements. Prohibits manufacturers and developers from sharing age data with third parties for unrelated purposes.

Establishes comprehensive regulations for automated decision systems that make important decisions affecting individuals' lives. Requires developers to conduct annual performance evaluations and third-party audits of automated decision systems starting 2030. Mandates that organizations notify individuals when AI systems are used to make decisions about them and allow appeals. Authorizes penalties up to $25,000 per violation and enables enforcement by state agencies and city attorneys.

Requires businesses using high-risk AI systems to implement comprehensive data security programs to protect personal information. Mandates annual security reviews and immediate updates when business practices significantly change. Establishes strict access controls including encryption, monitoring, and unique authentication for AI system data. Violations are classified as deceptive trade practices subject to penalties under California's Unfair Competition Law.

Establishes Quantum Innovation Zones to accelerate California's quantum computing development. Creates a diverse board of directors with representatives from government, industry, and academia. Requires annual progress reports tracking job creation and workforce training in quantum computing. Mandates partnerships between cities, universities, and businesses to secure funding and resources.

Requires all California state agencies to implement Zero Trust cybersecurity architecture by 2030. Mandates multifactor authentication and continuous monitoring for all state systems and data access. Establishes a two-phase implementation with Advanced maturity required by 2026 and Optimal by 2030. Requires agencies to submit annual security assessment reports tracking Zero Trust implementation progress.

Requires AI companies with over 1 million monthly users to provide free detection tools for AI-generated content. Mandates large online platforms to label AI-generated content with clear disclosures about its artificial origin. Prohibits the creation of tools designed to remove or hide AI content disclosures. Requires camera manufacturers to add permanent digital watermarks to photos and videos by 2028.

Requires developers to assess high-risk AI systems for discrimination before deployment starting January 2026. Mandates companies notify individuals when AI systems are used in decisions affecting their rights or benefits. Establishes penalties up to $25,000 for AI systems that discriminate based on protected characteristics. Prohibits state agencies from contracting AI systems unless certified to comply with civil rights laws.

Prohibits algorithms that use competitors' private data to set prices or rental rates in the same market. Imposes penalties up to $1,000 per violation for companies selling or using price-setting algorithms illegally. Allows businesses to avoid penalties by obtaining written proof that algorithms do not use nonpublic competitor data. Authorizes state and local prosecutors to enforce the law through civil actions and seek damages.

Requires a state study on artificial intelligence's impact on jobs and worker well-being in California. Mandates the UCLA Labor Center to conduct the comprehensive workforce impact study. Sets a June 2027 deadline for submitting study findings to the state Legislature.

Requires data brokers to disclose detailed information about personal data collection and sharing practices. Establishes a centralized deletion system allowing consumers to remove their data from all data brokers at once. Mandates data brokers to check for and process deletion requests every 45 days starting August 2026. Imposes $200 daily fines on data brokers who fail to register or comply with deletion requirements.

Expands legal protections against deepfake pornography by allowing victims to sue creators and facilitators. Increases maximum penalties to $250,000 for malicious creation or sharing of non-consensual explicit content. Requires services enabling deepfake pornography to cease operations within 30 days of receiving violation evidence. Authorizes public prosecutors to pursue civil cases against violators without proving victim harm.

Requires food delivery apps to provide full refunds for undelivered or incorrect orders. Mandates that delivery drivers receive all tips without any deductions from their base pay. Requires platforms to provide live customer service representatives when automated systems fail. Establishes clear pricing rules to prevent overcharging customers for food and delivery.

Requires web browsers to include easy-to-find settings for opting out of personal data sharing. Mandates browser companies to clearly explain how their opt-out settings work and what data they protect. Authorizes the California Privacy Protection Agency to create and enforce implementation rules.

Prohibits AI systems from falsely implying they are licensed healthcare professionals in their communications. Requires healthcare facilities using AI to clearly disclose when communications are AI-generated. Empowers medical licensing boards to enforce violations and issue penalties for each deceptive AI communication. Mandates clear instructions for patients to contact human healthcare providers when interacting with AI systems.