Artificial Intelligence

Requires state agencies to establish human oversight of AI systems used in critical infrastructure operations. Mandates reporting of AI incidents within 4 hours to 14 days based on severity level. Establishes annual safety assessments of AI systems used in state critical infrastructure. Imposes $500 weekly penalties for failing to report AI-related adverse events.

Increases penalties for social media platforms that violate cyberbullying prevention rules to $50,000 per violation. Establishes that each day of non-compliance counts as a separate violation for penalty purposes. Authorizes courts to order platforms to comply and award attorney fees to successful plaintiffs.

Establishes a new state registry system for artificial intelligence auditors who evaluate AI systems in California. Requires AI auditors to enroll with the state, pay fees, and follow industry standards by January 2027. Prohibits auditors from working for audited companies within 12 months before or after conducting an audit. Creates a public reporting system for misconduct and protects whistleblowers who report violations.

Prohibits businesses from collecting location data unless necessary to provide requested services. Requires prominent notices when location data is collected and mandates detailed privacy policies. Bans the sale or monetization of location information by businesses and government agencies. Establishes penalties up to $25,000 per violation and allows both state enforcement and private lawsuits.

Prohibits third-party platforms from listing restaurant reservations without written agreements from establishments. Authorizes the Attorney General to impose civil penalties up to $1,000 per violation. Creates a state fund from collected penalties to enforce restaurant reservation regulations. Allows restaurants and authorized reservation services to sue unauthorized platforms for damages.

Establishes a state working group to evaluate artificial intelligence use in mental health treatment by July 2026. Requires input from health organizations, tech companies, and advocacy groups through three public meetings. Mandates comprehensive reports to the Legislature on AI in mental health by July 2028 and January 2030. Creates a framework for training mental health professionals on effective use of AI tools in treatment.

Requires law enforcement to disclose and identify any use of artificial intelligence in official police reports. Mandates officers to sign and verify the accuracy of all AI-generated reports. Requires retention of initial AI-generated report drafts for as long as final reports are kept. Establishes audit trails to track who uses AI and what audio or video footage was analyzed.

Requires California to develop a statewide AI cybersecurity playbook by July 2026 to combat emerging threats. Mandates information sharing between state AI contractors about potential cybersecurity vulnerabilities. Establishes strict confidentiality rules for shared cybersecurity threat information. Creates a dedicated cyber incident response team to detect and address threats across California.

Expands student privacy protections to cover K-12, preschool, and higher education institutions by July 2026. Prohibits operators from using student data to train AI systems unless specifically for educational purposes. Requires operators to implement data security measures and delete student information upon request. Allows students to sue operators for privacy violations with damages up to $500 per incident.

Requires social media platforms to provide clear reporting mechanisms for child sexual abuse material. Mandates platforms to review reported content through hash matching and human review within 30 days. Imposes penalties up to $250,000 per day on platforms that fail to maintain functional reporting systems. Requires platforms to undergo bi-annual third-party safety audits and publicly release findings.

Prohibits AI systems from using children's personal data without parental consent for those under 13 years old. Bans the development of AI chatbots designed to form emotional bonds with children in California. Requires AI developers to prevent children from accessing AI systems not intended for minors. Authorizes the Attorney General to impose $25,000 penalties per violation and allows victims to sue for damages.

Requires device manufacturers to verify user age during account setup to protect minors online. Mandates parental consent for users under 16 to download apps from application stores. Establishes age brackets for users under 18 to control data sharing with app developers. Imposes penalties up to $7,500 per child for intentional violations of age verification requirements.

Establishes comprehensive regulations for automated decision systems that make important decisions about individuals' lives. Requires companies using AI systems to conduct regular audits and allow people to opt out of automated decisions by 2027. Mandates clear disclosures to individuals before and after AI-powered decisions affecting their employment, housing, or healthcare. Authorizes penalties up to $25,000 per violation and empowers state agencies to enforce compliance through civil actions.

Requires businesses using high-risk AI systems to implement comprehensive data security programs to protect personal information. Mandates annual security reviews and immediate updates when business practices significantly change. Establishes strict access controls including encryption, monitoring, and unique authentication for AI system data. Violations are classified as deceptive trade practices subject to penalties under California's Unfair Competition Law.

Establishes Quantum Innovation Zones to accelerate California's quantum computing development. Creates a diverse board of directors with representatives from government, industry, and academia. Requires annual progress reports tracking job creation and workforce training in quantum computing. Mandates partnerships between cities, universities, and businesses to secure funding and resources.

Requires all California state agencies to implement Zero Trust cybersecurity architecture by 2030. Mandates multifactor authentication and continuous monitoring for all state systems and data access. Establishes a two-phase implementation with Advanced maturity required by 2026 and Optimal by 2030. Requires agencies to submit annual security assessment reports tracking Zero Trust implementation progress.

Requires AI platforms with over 1 million monthly users to provide free AI detection tools for digital content. Mandates large online platforms to clearly label AI-generated content with system and provenance information. Requires camera and device manufacturers to embed origin data in photos and videos by default. Imposes $5,000 daily fines per violation for companies that fail to comply with disclosure requirements.

Requires developers to assess high-risk AI systems for discrimination before deployment starting January 2026. Mandates companies notify individuals when AI systems are used in decisions affecting their rights or benefits. Establishes penalties up to $25,000 for AI systems that discriminate based on protected characteristics. Prohibits state agencies from contracting AI systems unless certified to comply with civil rights laws.

Prohibits the use of algorithms that process private competitor data to set prices or rental rates. Imposes penalties of up to $1,000 per violation for companies sharing pricing algorithms between competitors. Allows businesses to avoid penalties by obtaining written proof that algorithms do not use private competitor data. Authorizes state and local prosecutors to pursue civil actions against violators.

Requires a state study on artificial intelligence's impact on jobs and worker well-being in California. Mandates the UCLA Labor Center to conduct the comprehensive workforce impact study. Sets a June 2027 deadline for submitting study findings to the state Legislature.

Expands data broker reporting requirements to include sensitive personal data collection and sharing practices. Requires data brokers to disclose if they share data with foreign actors, governments, or AI developers. Imposes daily fines of $200 for data brokers who fail to register or comply with deletion requests. Mandates data brokers to provide clear website instructions for consumers to exercise privacy rights.

Expands legal protections against deepfake pornography by allowing victims to sue creators and facilitators. Increases maximum penalties to $250,000 for malicious creation or sharing of non-consensual explicit content. Requires services enabling deepfake pornography to cease operations within 30 days of receiving violation evidence. Authorizes public prosecutors to pursue civil cases against violators without proving victim harm.

Requires food delivery apps to provide human customer service representatives when automated systems fail. Mandates full refunds including fees and taxes for undelivered or incorrect orders. Prohibits delivery platforms from using customer tips to offset drivers' base pay. Requires detailed pay breakdowns showing base pay, tips, and bonuses for delivery drivers.

Requires web browsers to include easy-to-find settings for opting out of personal data sharing. Mandates browser companies to clearly explain how their opt-out settings work and what data they protect. Authorizes the California Privacy Protection Agency to create and enforce implementation rules.

Prohibits AI systems from falsely implying they are licensed healthcare professionals in their communications. Requires healthcare facilities using AI to clearly disclose when communications are AI-generated. Empowers medical licensing boards to enforce violations and issue penalties for each deceptive AI communication. Mandates clear instructions for patients to contact human healthcare providers when interacting with AI systems.