California AB 1008 (2024) — CCPA Applies to AI-Embedded Personal Information
CA · Cal. Civ. Code § 1798.140; AB 1008 (Stats. 2024, ch. 853)
California clarified that personal information remains protected by the CCPA even when it is embedded in or generated by AI systems — including model weights and AI-generated synthetic content about a person. Closes a loophole AI developers had used to argue training data and model outputs fell outside privacy law.
Technical detail
Cal. Civ. Code § 1798.140 amendments (AB 1008, ch. 853, Stats. 2024) — clarifies that 'personal information' under CCPA includes information embedded in artificial intelligence systems and may exist in 'physical or digital formats including but not limited to AI systems capable of outputting personal information.' Eff. Jan. 1, 2025.
Who is protected: California consumers whose personal information is embedded in or output by AI systems
Who must comply: Businesses subject to the CCPA developing or deploying AI
Key facts
| Jurisdiction | CA |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Moderate protection |
| Effective date | 2025-01-01 |
| Enacted | 2024-09-28 |
| Citation | Cal. Civ. Code § 1798.140; AB 1008 (Stats. 2024, ch. 853) |
| Enforced by | California Privacy Protection Agency; California Attorney General |
| Private right of action | Yes — individuals can sue |
| Penalties | CCPA fines up to $2,500/$7,500 per violation; private right limited to data-breach claims |
| Topics | consumer data privacy · consumer protection · automated decision-making |
| Last verified | 2026-06-17 |
| Official source | California AB 1008 — Consumer Privacy Act Clarification (AI) ↗ |
More AI rules in CA
- CA AB 2148 no-AI school employees (2026) · Enacted (not yet in effect)
- CA AG Bonta · In effect
- CA Bar GenAI Guidance · In effect
- CA CPPA ADMT Regs · In effect
- CA SB 1120 (AI prior auth) · In effect
- CA AB 2655 (deepfake takedown) · Blocked / in litigation
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.