Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

California: Bill on CPPA board qualifications introduced to Assembly

On February 15, 2024, Assembly Bill 2877 to amend Sections 1798.199.10 and 1798.199.15 of the Civil Code relating to privacy was introduced to the California State Assembly and thereafter read, on the same date, for the first time.

The bill would require members of the board of the California Privacy Protection Agency (CPPA) to have qualifications, experience, and skills in consumer rights.

You can read the bill here and track its progress here.

Update: April 22, 2024

Bill read for a second time and amended

On April 18, 2024, the bill was read for a second time and amended to be the California Consumer Privacy Act of 2018: artificial intelligence: minors.

If enacted, the bill would prohibit a developer from using the sensitive personal information of natural persons under 18 years of age to train an artificial intelligence (AI) system or service and require the CPPA to enforce the bill.

Additionally, the bill provides definitions for the terms 'artificial intelligence,' 'developer,' and 'minor.'

You can read the bill here and track its progress here.

Update: April 24, 2024

Bill re-referred to the Committee on Privacy and Consumer Protection

On April 22, 2024, the bill was re-referred to the Committee on Privacy and Consumer Protection.

You can read the bill here and track its progress here.

Update: April 30, 2024

Bill recommended for passage as amended and re-referred to Committee on Appropriations

On April 29, 2024, the bill was recommended for passage as amended and re-referred to the Committee on Appropriations.

You can read the bill here and track its progress here.

Update: May 1, 2024

Bill amended and read for second time

On April 30, 2024, the bill was amended to read as Assembly Bill 2877 on the California Consumer Privacy Act of 2018: artificial intelligence: training, and read for a second time. In particular, amendments to the bill replace the term 'minors' in the title with 'training.'

More specifically, the bill now prohibits a developer from using the personal information of a consumer less than 16 years of age, as specified, to train an AI system or service unless the consumer or the consumer's parent or guardian, as specified, has affirmatively authorized that use of the consumer's personal information. In addition, where affirmative authorization is given, personal information must be deidentified and aggregated before being used to train an AI system or service.

The definition of AI is also amended to mean 'an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.'

You can read the bill here and track its progress here.

Update: May 9, 2024

Bill recommended for passage

On May 8, 2024, the bill was recommended for passage by the Committee on Appropriations.

You can read the bill here and track its progress here.

Update: May 10, 2024

Bill read for second time and ordered to third reading

On May 9, 2024, the bill was read for a second time and ordered to third reading.

You can read the bill here and track its progress here.

Update: May 30, 2024

Bill referred to Committee on Judiciary

On May 29, 2024, the bill was referred to the Committee on Judiciary. Prior to this, the bill passed its third reading in the Assembly on May 20, 2024, and was read for the first time in the Senate on May 21, 2024. 

You can read the bill here and track its progress here.

Update: June 18, 2024

Bill read for second time and amended in the Senate

On June 17, 2024, the bill was read for a second time, amended, and re-referred to the Committee on Judiciary. 

The amendments include making changes to the definition of the term 'developer,' which is now defined as 'a qualified business that designs, codes, or otherwise produces an artificial intelligence system or service, or substantially modifies an existing artificial intelligence system or service, by training or retraining the artificial intelligence system or service on personal information.'

It also adds the term 'qualified business,' which is a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that collects consumers' personal information, or on the behalf of which that information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State, and that satisfies one or more of the following thresholds:

  • as of January 1 of the calendar year, had annual gross revenues in excess of $25 million in the preceding calendar year, as adjusted pursuant to Section 1798.185(5)(a) of the Civil Code; 
  • alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households;
  • derives 50% or more of its annual revenues from selling or sharing consumers' personal information; or
  • provides a system or service for use in schools. 

You can read the bill here and track its progress here.