On February 15, 2024, Assembly Bill 2877 to amend Sections 1798.199.10 and 1798.199.15 of the Civil Code relating to privacy was introduced to the California State Assembly and thereafter read, on the same date, for the first time.

The bill would require members of the board of the California Privacy Protection Agency (CPPA) to have qualifications, experience, and skills in consumer rights.

You can read the bill here and track its progress here.

Bill read for a second time and amended

On April 18, 2024, the bill was read for a second time and amended to be the California Consumer Privacy Act of 2018: artificial intelligence: minors.

If enacted, the bill would prohibit a developer from using the sensitive personal information of natural persons under 18 years of age to train an artificial intelligence (AI) system or service and require the CPPA to enforce the bill.

Additionally, the bill provides definitions for the terms 'artificial intelligence,' 'developer,' and 'minor.'

You can read the bill here and track its progress here.

Bill re-referred to the Committee on Privacy and Consumer Protection

On April 22, 2024, the bill was re-referred to the Committee on Privacy and Consumer Protection.

You can read the bill here and track its progress here.

Bill recommended for passage as amended and re-referred to Committee on Appropriations

On April 29, 2024, the bill was recommended for passage as amended and re-referred to the Committee on Appropriations.

You can read the bill here and track its progress here.

Update: May 1, 2024

Bill amended and read for second time

On April 30, 2024, the bill was amended to read as Assembly Bill 2877 on the California Consumer Privacy Act of 2018: artificial intelligence: training, and read for a second time. In particular, amendments to the bill replace the term 'minors' in the title with 'training.'

More specifically, the bill now prohibits a developer from using the personal information of a consumer less than 16 years of age, as specified, to train an AI system or service unless the consumer or the consumer's parent or guardian, as specified, has affirmatively authorized that use of the consumer's personal information. In addition, where affirmative authorization is given, personal information must be deidentified and aggregated before being used to train an AI system or service.

The definition of AI is also amended to mean 'an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.'

You can read the bill here and track its progress here.