California SB 361 (2025) — Data Broker Disclosure of Sharing With Generative AI Developers
California · Cal. Civ. Code 1798.99.82 (SB 361, 2025)
This law expands what data brokers must reveal when they register each year with the California Privacy Protection Agency. Among the new disclosures, brokers must state whether, during the prior year, they sold or shared consumers' personal information with developers of generative AI systems. The aim is to give the public and regulators visibility into how personal data flows into AI training and development.
Technical detail
SB 361 amends Cal. Civ. Code 1798.99.82 to expand mandatory data broker registration disclosures to the CPPA, including whether the broker sold or shared consumers' personal information with developers of generative AI systems in the preceding year.
Who is protected: California consumers whose personal information is collected and traded by data brokers.
Who must comply: Data brokers required to register with the California Privacy Protection Agency.
Key facts
| Jurisdiction | California |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2026-01-01 |
| Enacted | 2025-10-08 |
| Citation | Cal. Civ. Code 1798.99.82 (SB 361, 2025) |
| Enforced by | California Privacy Protection Agency (CPPA). |
| Private right of action | No — agency enforcement only |
| Penalties | Failure to register can result in an administrative fine of up to $200 per day of noncompliance, plus fees due and the CPPA's enforcement costs. |
| Topics | consumer data privacy · AI disclosure and transparency |
| Last verified | 2026-06-16 |
| Official source | SB-361 Data brokers: data collection and deletion ↗ |
More AI rules in California
- CA EO N-6-26 (AI Workforce) · In effect
- California AB 489 (AI healthcare chatbot misrepresentation ban) · In effect
- X.AI v. Bonta (AB 2013 training-data disclosure) · Blocked / in litigation
- CA SB 1298 (2012 AV authorization) · In effect
- CA AB 856 (2015 drone trespass) · In effect
- California Bot Disclosure Act (bots must self-identify in sales/election messaging) · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.