Regulations
by Glyph
Data, privacy and AI rules
Search laws like GDPR, EU AI Act, CCPA and 187 more
Due in 60 days
12
Regulations
190
12
due in 60 days
·
190
regulations
Home
/
Jurisdictions
/
California
Jurisdiction
California privacy and AI laws
Part of
US States
.
Regulations
Add to calendar
Apple Calendar or Outlook
Google Calendar
Download .ics
Enacted
California AI Auditor Registry
Creates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.
Next:
Jan 1, 2027
Act takes effect · in 2 months
Amended
California AI Transparency Act (SB 942)
Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.
Next:
Jan 1, 2027
Large online platform and hosting platform duties · in 2 months
Enacted
California Digital Age Assurance Act
Operating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.
Next:
Jan 1, 2027
Age signal duties begin · in 2 months
In force
California SB 53 (TFAIA)
Frontier AI developers must publish transparency reports when deploying new or substantially modified frontier models and report critical safety incidents to the Office of Emergency Services (OES). Large frontier developers must also write, implement and publish a frontier AI framework for catastrophic risk, update it annually, and send OES quarterly summaries of their catastrophic-risk assessments. The act also adds whistleblower protections and creates the CalCompute public computing consortium.
Next:
Jan 1, 2027
First OES anonymized incident report and CDT definition review · in 2 months
In force
California SB 976 addictive feeds
Bars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.
Next:
Jan 1, 2027
Age assurance duty and AG rules · in 2 months
Amended
CCPA / CPRA
Gives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.
Next:
Jan 1, 2027
ADMT requirements compliance date · in 2 months
In force
California Delete Act / DROP
Requires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.
Next:
Jan 31, 2027
Annual data broker registration deadline · in 3 months
In force
California SB 243 (companion chatbots)
Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.
Next:
Jul 1, 2027
First annual report to Office of Suicide Prevention · in 8 months
In force
California AB 2013 (AI training data transparency)
Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.
In effect since Jan 1, 2026
In force
California ADS employment regulations
Clarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.
In effect since Oct 1, 2025
In force
California AI autonomous-harm defense ban
A defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.
In effect since Jan 1, 2026
Enacted
Unverified
California Senate Bill 813
Establishes a framework for independent verification organizations to assess AI systems and models for compliance with state law.
No date set
In force
California social media account deletion
Social media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.
In effect since Jan 1, 2026
Upcoming deadlines
Takes effect
Jan 1, 2027 ·
in 2 months
California AI Auditor Registry
Act takes effect
Default effective date for 2026 regular-session statutes.
California
Compliance
Jan 1, 2027 ·
in 2 months
California AI Transparency Act (SB 942)
Large online platform and hosting platform duties
Large online platforms and GenAI hosting platforms must meet the provenance duties added by AB 853.
California
Takes effect
Jan 1, 2027 ·
in 2 months
California Digital Age Assurance Act
Age signal duties begin
OS providers must offer the age interface at account setup and developers must request signals.
California
Reporting
Jan 1, 2027 ·
in 2 months
California SB 53 (TFAIA)
First OES anonymized incident report and CDT definition review
OES begins publishing annual anonymized incident summaries and the Department of Technology begins annual review of the act's definitions; the CalCompute framework report is due to the Legislature.
California
Compliance
Jan 1, 2027 ·
in 2 months
California SB 976 addictive feeds
Age assurance duty and AG rules
Operators must reasonably determine users are not minors; AG regulations on age assurance and parental consent due.
California
Compliance
Jan 1, 2027 ·
in 2 months
CCPA / CPRA
ADMT requirements compliance date
Businesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).
California
Compliance
Jan 1, 2027 ·
in 2 months
CCPA / CPRA
Browsers must support opt-out preference signal (AB 566)
Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).
California
Reporting
Jan 31, 2027 ·
in 3 months
California Delete Act / DROP
Annual data broker registration deadline
Data brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.
California
Compliance
Jul 1, 2027 ·
in 8 months
California Digital Age Assurance Act
Deadline for existing devices and apps
OS providers must offer the age interface for accounts set up before 2027, and developers must request signals for earlier installs.
California
Reporting
Jul 1, 2027 ·
in 8 months
California SB 243 (companion chatbots)
First annual report to Office of Suicide Prevention
Operators begin annual reporting on crisis referrals and detection protocols.
California
Compliance
Dec 31, 2027 ·
in 14 months
CCPA / CPRA
Risk assessments for pre-existing processing due
Risk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).
California
Compliance
Jan 1, 2028 ·
in 14 months
California AI Transparency Act (SB 942)
Capture device manufacturer duties
Capture device manufacturer provenance requirements become operative.
California
Compliance
Jan 1, 2028 ·
in 14 months
California Delete Act / DROP
Independent third-party audits begin
Beginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.
California
Reporting
Apr 1, 2028 ·
in 17 months
CCPA / CPRA
First risk assessment submission to CPPA
Businesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.
California
Reporting
Apr 1, 2028 ·
in 17 months
CCPA / CPRA
Cybersecurity audit due: revenue over $100M
First cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).
California
Compliance
Jan 1, 2029 ·
in 2.2 years
California AI Auditor Registry
Registry opens and registration required
Agency must launch the AI Auditor Registry; unregistered persons may not offer or conduct covered AI audits.
California
Reporting
Apr 1, 2029 ·
in 2.4 years
CCPA / CPRA
Cybersecurity audit due: revenue $50M-$100M
First cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).
California
Reporting
Apr 1, 2030 ·
in 3.4 years
CCPA / CPRA
Cybersecurity audit due: revenue under $50M
First cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.
California
Past deadlines
Milestone
Unverified
Sep 9 ·
48 days ago
California Senate Bill 813
Signed by Governor
Governor Gavin Newsom signed Senate Bill 813, establishing a framework for independent verification organizations to assess AI systems and models for compliance with state law.
California
Milestone
Sep 9 ·
48 days ago
California AI Auditor Registry
Signed by Governor
Chaptered as Chapter 178, Statutes of 2026.
California
Takes effect
Aug 2 ·
3 months ago
California AI Transparency Act (SB 942)
Covered provider duties apply
Detection tool, manifest and latent disclosures, and license-revocation duties become operative.
California
Compliance
Aug 1 ·
3 months ago
California Delete Act / DROP
Data brokers must begin processing DROP deletion requests
Brokers must access DROP at least every 45 days, process verified deletion requests within 45 days, and treat unverified requests as opt-outs of sale/sharing.
California
Reporting
Jan 31 ·
9 months ago
California Delete Act / DROP
Annual data broker registration deadline
Data brokers must register with CalPrivacy and pay the annual fee ($6,000 for 2026) by January 31.
California
Takes effect
Jan 1 ·
10 months ago
CCPA / CPRA
New CCPA regulations take effect
ADMT, risk assessment, cybersecurity audit and updated CCPA regulations become effective; risk assessments required for new high-risk processing.
California
Takes effect
Jan 1 ·
10 months ago
California social media account deletion
Takes effect
Default effective date for 2025 regular-session statutes.
California
Takes effect
Jan 1 ·
10 months ago
California SB 53 (TFAIA)
Frontier developer obligations apply
Frontier AI frameworks, transparency reports, critical safety incident reporting (15 days, or 24 hours for imminent risk of death or serious injury) and whistleblower protections apply.
California
Takes effect
Jan 1 ·
10 months ago
California SB 243 (companion chatbots)
Chatbot safeguards apply
AI disclosure, suicide and self-harm protocols, and minor protections apply.
California
Takes effect
Jan 1 ·
10 months ago
California Delete Act / DROP
DROP opens to consumers
Consumers can submit a single deletion request to all registered data brokers through DROP.
California
Transition ends
Jan 1 ·
10 months ago
California AI Transparency Act (SB 942)
Original operative date (superseded)
Original SB 942 date; delayed to August 2, 2026 by AB 853.
California
Takes effect
Jan 1 ·
10 months ago
California AI autonomous-harm defense ban
Takes effect
Default effective date for 2025 regular-session statutes.
California
Compliance
Jan 1 ·
10 months ago
California AB 2013 (AI training data transparency)
Training-data documentation due
Documentation must be posted for GenAI systems released since January 1, 2022, and before each later release or substantial modification.
California
Milestone
Oct 13, 2025 ·
12 months ago
California SB 243 (companion chatbots)
SB 243 signed
SB 243 chaptered (ch. 677).
California
Milestone
Oct 13, 2025 ·
12 months ago
California Digital Age Assurance Act
Signed by Governor
Chaptered as Chapter 675, Statutes of 2025.
California
Milestone
Oct 13, 2025 ·
12 months ago
California AI Transparency Act (SB 942)
AB 853 signed
AB 853 (ch. 674) delays the operative date and adds platform and device duties.
California
Milestone
Oct 13, 2025 ·
12 months ago
California AI autonomous-harm defense ban
Signed by Governor
Chaptered as Chapter 672, Statutes of 2025.
California
Milestone
Oct 8, 2025 ·
13 months ago
California social media account deletion
Signed by Governor
Chaptered as Chapter 464, Statutes of 2025.
California
Takes effect
Oct 1, 2025 ·
13 months ago
California ADS employment regulations
ADS regulations take effect
Rules apply to employment decisions using automated-decision systems.
California
Milestone
Sep 29, 2025 ·
13 months ago
California SB 53 (TFAIA)
SB 53 signed
Governor Newsom signs SB 53 (chapter 138).
California
Transition ends
Sep 22, 2025 ·
13 months ago
CCPA / CPRA
ADMT, risk assessment and cybersecurity audit regulations approved
OAL approves the CCPA Updates, Cybersecurity Audit, Risk Assessment, ADMT and Insurance regulations and files them with the Secretary of State.
California
Transition ends
Jun 27, 2025 ·
16 months ago
California ADS employment regulations
OAL approves regulations
Office of Administrative Law approves the Civil Rights Council's ADS rules.
California
Transition ends
Jan 1, 2025 ·
22 months ago
CCPA / CPRA
CPI adjustment of thresholds and fines
Revenue threshold rises to $26,625,000 and fines to $2,663 / $7,988 per violation.
California
Takes effect
Jan 1, 2025 ·
22 months ago
California SB 976 addictive feeds
Takes effect
Actual-knowledge feed and notification limits apply, subject to litigation.
California
Milestone
Sep 28, 2024 ·
2.1 years ago
California AB 2013 (AI training data transparency)
AB 2013 signed
AB 2013 chaptered (ch. 817).
California
Milestone
Sep 20, 2024 ·
2.1 years ago
California SB 976 addictive feeds
Signed by Governor
Chaptered as Chapter 321, Statutes of 2024.
California
Milestone
Sep 19, 2024 ·
2.1 years ago
California AI Transparency Act (SB 942)
SB 942 signed
SB 942 chaptered (ch. 291) with an original operative date of January 1, 2026.
California
Takes effect
Jan 1, 2023 ·
3.8 years ago
CCPA / CPRA
CPRA amendments operative
CPRA amendments (correction right, sensitive PI limits, sharing opt-out, employee/B2B data coverage) become operative.
California
Takes effect
Jan 1, 2020 ·
6.8 years ago
CCPA / CPRA
CCPA takes effect
Original CCPA consumer rights and business obligations take effect.
California
Regulationsby Glyph