State Legislation Update: January 2026

Since the last update (September 2025), Governor Newsom has signed the following state bills which may be of interest to the Section. The summaries of those bills are as follows:

AB 316, Krell-D, Artificial intelligence: defenses.

Summary: Current law requires the developer of a generative artificial intelligence system or service that is released on or after January 1, 2022, and made publicly available to Californians for use, to post on the developer’s internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service. Existing law defines “artificial intelligence” for these purposes. This bill would prohibit a defendant who developed, modified, or used artificial intelligence, as defined, from asserting a defense that the artificial intelligence autonomously caused the harm to the plaintiff.

AB 566, Lowenthal-D, California Consumer Privacy Act of 2018: opt-out preference signal

Summary: The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. This bill would prohibit a business from developing or maintaining a browser or browser engine, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser or browser engine, as prescribed. The bill would require a business that develops or maintains a browser or browser engine to make clear to a consumer in its public disclosures how the opt-out preference signal works and the types of personal information to which the signal would apply. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

AB 853, Wicks-D, California AI Transparency Act.

Summary: The California AI Transparency Act requires a person that creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within the geographic boundaries of the state to make available an AI detection tool at no cost to the user that, among other things, allows a user to assess whether image, video, or audio content, or content that is a combination thereof, was created or altered by that person’s generative artificial intelligence system and outputs any system provenance data that is detected in the content. Existing law makes the California AI Transparency Act operative on January 1, 2026. This bill would delay the operation of the California AI Transparency Act until August 2, 2026. This bill would, January 1, 2027, among other things related to the provenance of content on the platform, detect whether any provenance data that is compliant with widely adopted specifications adopted by an established standards-setting body is embedded into or attached to content distributed on the large online platform. The bill would also require, beginning January 1, 2028, a capture device manufacturer, with respect to any capture device the capture device manufacturer first produced for sale in the state on or after January 1, 2028, to, among other things, provide a user with the option to include a latent disclosure in content captured by the capture device that conveys certain information, including the name of the capture device manufacturer. The bill would define “capture device” to mean a device that can record photographs, audio, or video content, including, but not limited to, video and still photography cameras, mobile phones with built-in cameras or microphones, and voice recorders. This bill would, beginning January 1, 2027, prohibit a GenAI system hosting platform, as defined, from knowingly making available a GenAI system that does not place disclosures, pursuant to those provisions.

SB 53, Weiner-D, Artificial intelligence models: large developers.

Summary: Current law generally regulates artificial intelligence, including by requiring, on or before January 1, 2026, and before each time thereafter, that a generative artificial intelligence system or service, or a substantial modification to a generative artificial intelligence system or service, released on or after January 1, 2022, is made publicly available to Californians for use, the developer of the system or service to post on the developer’s internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service, as prescribed. This bill would enact the Transparency in Frontier Artificial Intelligence Act (TFAIA) that would, among other things related to ensuring the safety of a foundation model developed by a large developer, require a large developer to write, implement, and clearly and conspicuously publish on its internet website a safety and security protocol that describes in specific detail, among other things, the testing procedures that the large developer uses to assess catastrophic risks from its foundation models, as specified. The TFAIA would define “foundation model” to mean an artificial intelligence model that is trained on a broad data set, designed for generality of output, and adaptable to a wide range of distinctive tasks.

SB 243, Padilla-D, Companion chatbots.

Summary: Current law requires a social media platform to take various steps to prevent cyberbullying of minors on the platform, including by requiring the platform to establish a prominent mechanism within its internet-based service that allows any individual, whether or not that individual has a profile on the internet-based service, to report cyberbullying or any content that violates the existing terms of service related to cyberbullying. Current law authorizes the State Department of Public Health to establish the Office of Suicide Prevention in the department, as prescribed. This bill would, among other things related to making a companion chatbot platform safer for users, require an operator of a companion chatbot platform to take reasonable steps to prevent a companion chatbot, as defined, on its companion chatbot platform from providing rewards to a user at unpredictable intervals or after an inconsistent number of actions or from encouraging increased engagement, usage, or response rates. The bill would also require an operator to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator has implemented a protocol for addressing suicidal ideation, suicide, or self-harm expressed by a user to the companion chatbot, as specified, and publish details on that protocol on the operator’s internet website. This bill would require an operator to annually report to the Office of Suicide Prevention certain things, including the number of times the operator has detected exhibitions of suicidal ideation by users, and would require the office to post data from that report on its internet website.

SB 361, Becker-D, Data Broker registration: data collection

An act to amend Section 1798.99.82 of the Civil Code, relating to privacy.

Summary: The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, including the right to request that a business disclose specified information that has been collected about the consumer, to request that a business delete personal information about the consumer that the business has collected from the consumer, and to direct a business not to sell or share the consumer’s personal information, as specified. The CCPA defines various terms for these purposes. The California Privacy Rights Act of 2020 (CPRA), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the agency, and defines “data broker” to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. Existing law requires a data broker, in registering with the agency, to pay a registration fee in an amount determined by the agency and provide specified information, including, among other things, the name of the data broker and its primary physical, email, and internet website addresses, and whether the data broker collects the personal information of minors, consumers’ precise geolocation, or consumers’ reproductive health care data. This bill would require a data broker to provide additional information to the agency, including whether the data broker collects consumers’ login or account information, various government identification numbers, citizenship data, union membership status, sexual orientation status, gender identity and gender expression data, and biometric data. The bill would also require a data broker to provide information regarding whether, in the past year, the data broker shared or sold consumers’ data to a foreign actor, as defined, the federal government, other state governments, law enforcement, or a developer of an AI system or model, as defined. This bill would declare that it furthers the purposes and intent of the CPRA for specified reasons.

SB 446, Hurtado-D. Data breaches: customer notification.

Summary: Existing law requires an individual or a business that conducts business in California, and that owns or licenses computerized data that includes personal information, to disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was compromised, as specified, and requires that disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. This bill would require that data breach disclosure to be made within 30 calendar days of discovery or notification of the data breach but would authorize an individual or business to delay the disclosure to accommodate the legitimate needs of law enforcement, as specified, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Existing law also requires an individual or business that is required to issue the security breach notification described above to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General.

This bill would require that submission to the Attorney General to be made within 15 calendar days of notifying affected consumers of the security breach.

As of January 9, 2026 the following state bills have been identified which may be of interest to the Section. The California legislature reconvened on January 5, 2026. As we are in the second year of the 2025-2026 Biennium, legislators may introduce new bills and/or try to progress bills, introduced during the first year, that had not made it to the Governor’s desk. More chatbot bills are expected. As some may recall, SB 690 (An act to amend Sections 631, 632, 632.7, 637.2, and 638.50 of the Penal Code, relating to crimes), after passing the Senate, stalled in the Assembly Privacy and Consumer Protection Committee. SB 690 aims to de-conflict the California Invasion of Privacy Act (CIPA) and the California Consumer Privacy Act of 2018 (CCPA. It is possible that discussions on said bill will restart. The current legislative session ends on August 31, 2026. The summary and status of bills are as follows:

AB 1542, Ward-D, An act to amend Sections 1798.100 and 1798.121 of the Civil Code, relating to privacy.

Status: Introduced on 1/5/26

Summary: The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information, as defined, about the consumer to limit its use, as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

This bill would, under the CCPA, prohibit a business, service provider, or contractor from selling or sharing sensitive personal information to a third party.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

SB 300, Padilla-D, Companion chatbots.

Status: Senate Judiciary Committee (hearing scheduled for 1/13/26)

Summary: Existing law requires that if a reasonable person interacting with a companion chatbot, as defined, would be misled to believe that the person is interacting with a human, an operator of a companion chatbot platform must issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human. Existing law requires a chatbot operator to maintain a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, as specified, and would require an operator to publish details on that protocol on the operator’s internet website. Existing law requires an operator to take certain actions with respect to a user the operator knows is a minor, including instituting reasonable measures to prevent the companion chatbot from producing sexually explicit visual material or proposing sexually explicit conduct.

This bill would instead require a companion chatbot operator to take the above actions when it has constructive knowledge that a user is a minor. This bill would instead require an operator to prevent its companion chatbot from producing or facilitating the exchange of any sexually explicit material or proposing sexually explicit conduct.

SB 574, Umberg-D. Generative artificial intelligence: attorneys and arbitrators.

Status: Senate Judiciary Committee (hearing scheduled for 1/13/26)

Summary: Existing law, the State Bar Act, provides for the licensure and regulation of attorneys by the State Bar of California, a public corporation. The act requires an attorney to strictly maintain client confidences and to preserve client secrets at their own peril.

This bill would obligate an attorney who uses generative artificial intelligence to practice law to ensure that confidential personal identifying, or other nonpublic information, is not entered into a public generative artificial intelligence system. The bill would also require an attorney to ensure that reasonable steps are taken to verify the accuracy of generative artificial intelligence material and to correct any erroneous or hallucinated output in any material used by the attorney.

Existing law requires every pleading, petition, written notice of motion, or other similar paper to be signed by the attorney of record, or if a party is unrepresented, by the party, thereby certifying to the best of the person’s knowledge, information, and belief that it is not being presented primarily for an improper purpose and that the claims, defenses, and legal and factual contentions are warranted, as specified.

This bill would prohibit a brief, pleading, motion, or any other paper filed in any court from containing any citations that the attorney responsible for submitting the pleading has not personally read and verified, including any citation provided by generative artificial intelligence.

Existing law, the California Arbitration Act, provides a statutory framework for the enforcement of contractual arbitration under California law. The act establishes that a written agreement to submit a present or future controversy to arbitration is valid, enforceable, and irrevocable, except as specified. The act defines a neutral arbitrator as one who is selected jointly by the parties or by the parties’ arbitrators, or is appointed by the court if the parties or their arbitrators cannot jointly select an arbitrator. The act requires a person selected to serve as a neutral arbitrator to disclose all matters that could cause a person aware of the facts to reasonably entertain a doubt as to the proposed neutral arbitrator’s impartiality.

This bill would prohibit an arbitrator from delegating any part of their decision-making process to any generative artificial intelligence tool. The bill would prohibit an arbitrator from relying on information generated by generative artificial intelligence outside the record without making appropriate disclosures to the parties beforehand. The bill would require an arbitrator to assume responsibility for all aspects of an award, regardless of any use of generative artificial intelligence tools to assist with the decision-making process.

SB 867, Padilla-D, Toys: Companion Chatbots, Senate Rules Committee (pending)

Summary: Existing law regulates the sale, manufacture, and exchange of toys in the state and prohibits the manufacture, sale, or exchange, possession with intent to sell or exchange, and exposition or offer for sale or exchange to a retailer a toy that is contaminated with a toxic substance, as provided. Violation of these provisions is punishable as a misdemeanor. Existing law requires an operator of a companion chatbot platform, as defined, to issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human if a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human. For these purposes, existing law defines a “companion chatbot” to mean an artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user’s social needs, including by exhibiting anthropomorphic features and being able to sustain a relationship across multiple interactions. Existing law also requires an operator to take certain actions with respect to a user the operator knows is a minor, including to disclose to the user that the user is interacting with artificial intelligence. Violation of these provisions is subject to civil liability.

This bill would, until January 1, 2031, prohibit the manufacture, sale, exchange, possession with intent to sell or exchange, and exposition or offer for sale or exchange to a retailer a toy, as defined, that includes a companion chatbot.