Spell out digital replica uses in performer contracts
A contract term can let a digital replica of a person’s voice or likeness replace work they would have done in person. Such a term is unenforceable if it lacks a reasonably specific description of the uses and the person had no lawyer or union negotiating for them.
Who must do it
Anyone contracting with a person in California for personal or professional services, such as actors, voice artists and creators. It covers new performances fixed from January 1, 2025.
The law
AB 2602 (Chapter 259, Statutes of 2024), Labor Code section 927
Who enforces it
No regulator or fine; such a term cannot be enforced.
Do not let AI tools discriminate; keep their data 4 years
Using an automated decision system that discriminates against job applicants or workers is unlawful, even when a vendor runs it for you. Keep the system’s data with your employment records for four years. Evidence of anti-bias testing can count for or against you.
Who must do it
Employers covered by California’s Fair Employment and Housing Act, usually those with 5 or more employees, plus employment agencies and unions.
The law
Civil Rights Council regulations, California Code of Regulations title 2, sections 11008.1, 11009(f) and 11013(c)
Who enforces it
Civil Rights Department complaints and lawsuits under the Fair Employment and Housing Act; damages rather than a fixed fine.
Do a risk assessment before using AI to judge people
Do and document a privacy risk assessment, and review it at least every three years, before you use automated decision-making for significant decisions such as jobs, loans, housing, education or health care. The same applies to automated tools that infer workers’, students’ or applicants’ performance, health, behaviour or location from systematic observation, and to training such tools or face recognition on personal data. Uses that began before 2026 need one by December 31, 2027.
Who must do it
Businesses covered by the California Consumer Privacy Act.
The law
CCPA regulations, California Code of Regulations title 11, sections 7150, 7155 and 7157
Who enforces it
California Privacy Protection Agency or the Attorney General: up to $2,663 per violation, or $7,988 if intentional (2025 amounts).
Give notice and an opt-out before automated decisions
If software makes significant decisions about people without real human involvement, such as hiring, pay, promotion, firing or school admissions, give a notice before use, offer an opt-out, and explain the logic and result on request. In most cases an appeal to a human who can overturn the decision can replace the opt-out.
Who must do it
Businesses covered by the California Consumer Privacy Act, such as those with over $26,625,000 in yearly revenue or that buy, sell or share data on 100,000 or more consumers.
The law
CCPA regulations, California Code of Regulations title 11, sections 7200 and 7220 to 7222
Who enforces it
California Privacy Protection Agency or the Attorney General: up to $2,663 per violation, or $7,988 if intentional (2025 amounts).
Employers may not use surveillance tools to monitor workers in workplace bathrooms, except under a court order, and workers may leave such tools behind when they go in. Simple badges or alarms without audio, video or built-in AI are allowed.
Who must do it
All California employers, public and private.
The law
AB 1331 (Chapter 851, Statutes of 2026), Labor Code sections 1560 to 1565
Who enforces it
Labor Commissioner and public prosecutors; up to $500 per violation.
Do not use AI to read workers’ emotions or neural data
Employers may not use AI-powered workplace surveillance tools to recognise, infer or predict workers’ emotional state, or to collect neural data, meaning measurements of the nervous system. Tools used to keep people safe are not banned.
Who must do it
All California employers, public and private.
The law
AB 1883 (Chapter 853, Statutes of 2026), Labor Code sections 1580 to 1583
Who enforces it
Labor Commissioner, public prosecutors or the worker; up to $500 per violation.
Do not discipline or fire workers by software alone
Do not rely solely on an automated decision system to discipline or fire. If you rely mainly on one, a human must corroborate the result, and the worker gets a written notice when told of the decision. Such systems also may not be used to infer protected traits, and workers can ask for their own data.
Who must do it
Employers in California, including public employers such as cities and counties. It protects employees, not job applicants.
The law
SB 947, the No Robo Bosses Act of 2026 (Chapter 859, Statutes of 2026), Labor Code sections 1520 to 1526.7
Who enforces it
Labor Commissioner and public prosecutors; $500 per violation.
Do not use or sell a shared pricing algorithm as part of an agreement or plan that restrains competition. Do not pressure others to adopt the prices or terms it recommends. A shared pricing algorithm is any software used by two or more businesses that uses competitors’ data to recommend or set prices or terms. Prices here include workers’ pay.
Who must do it
Businesses that use, sell or license pricing software in California; end consumers are excluded.
The law
Cartwright Act, Business and Professions Code section 16729 (AB 325, Chapter 338, Statutes of 2025)
Who enforces it
Attorney General or district attorneys; civil penalties up to $1 million per violation. As a crime, fines up to $6 million for a company, and prison or fines up to $1 million for a person. Anyone harmed can sue for three times their damages.
Get consent before calling people with an AI voice
Calls that use AI-generated or cloned voices count as artificial-voice calls under the federal robocall law, so they need the called person’s prior express consent, unless it is an emergency or an exemption applies. The message must also identify the caller.
It applies in California because California is part of the United States.
CaliforniaIn force
Say when a robocall uses an artificial voice
Before an automatic dialing device plays a prerecorded message, a live, natural voice must state the nature of the call and the caller’s name, address and phone number. It must ask whether the person consents to hear the message, and say if the message uses an artificial voice, such as an AI-generated one.
Who must do it
Anyone placing calls with automatic dialing-announcing devices to people in California.
The law
AB 2905 (Chapter 316, Statutes of 2024), Public Utilities Code section 2874
Who enforces it
California Public Utilities Commission; fines of up to $500 per violation, or disconnection of the line.
Companion chatbots must disclose AI and handle crises
Tell users the chatbot is AI, not human, if they could be misled; keep and publish a suicide and self-harm protocol that refers users to crisis services; and warn that companion chatbots may not suit some minors. Until December 31, 2026, also remind known minors every three hours that it is AI and to take a break, and block sexual content for them. Yearly reports start July 1, 2027.
Who must do it
Operators of companion chatbot platforms available in California.
The law
SB 243 (Chapter 677, Statutes of 2025), Business and Professions Code sections 22601 to 22606; amended by SB 1119 (Chapter 190, Statutes of 2026) from January 1, 2027
Who enforces it
People harmed can sue for the greater of their damages or $1,000 per violation.
Do not present a customer service chatbot as a human, and say clearly that it is AI where a customer could be misled. Offer a simple way to ask for a human agent during business hours. Try to connect within 15 minutes, or book a call within one business day. Keep phone holds under 15 minutes, and under one hour in total.
Who must do it
Businesses with more than $500 million in yearly US revenue that use a customer service chatbot with customers in California.
The law
Business and Professions Code sections 22625 to 22629 (AB 1609, Chapter 733, Statutes of 2026)
Who enforces it
Public prosecutors only: up to $5,000 for a first violation and $10,000 for each later one. No private lawsuits.
Assess, limit and audit companion chatbots for children
From January 1, 2027, check users’ ages or give everyone the child protections. From July 1, 2027, if children may use your companion chatbot, assess child risks before each release, publish a child safety policy and run a crisis protocol. Set parent-controlled limits such as one-hour sessions, block romance, sexual content and purchase pressure, and do not sell children’s data. Independent audits are due from 2029.
Who must do it
Anyone who makes a companion chatbot available in California; most duties apply only if children under 18 may use it. Colleges offering it only for education, and employers offering it only to staff, are excluded.
The law
Adam’s Law, SB 1119 (Chapter 190, Statutes of 2026), Business and Professions Code sections 21810 to 21818
Who enforces it
Public prosecutors; up to $5,000 per affected child for each negligent violation and $15,000 for each intentional one. Harmed children or their parents can sue for damages.
Until January 1, 2031, do not make, sell, exchange or offer to retailers any toy that includes a companion chatbot. A toy here means a product made for play by children under 16.
Who must do it
Toy makers, sellers and distributors in California.
The law
SB 867 (Chapter 189, Statutes of 2026), Business and Professions Code section 22604.5
Who enforces it
People harmed can sue for their actual damages or $1,000 per violation, whichever is greater, plus a court order and legal fees.
Do not post or buy fake reviews, including AI-written ones
Do not write, create, sell or buy reviews or testimonials that falsely suggest the reviewer exists, used the product or had the experience described. The FTC says this covers AI-generated fake reviews.
Who must do it
Businesses selling to US consumers.
The law
FTC Rule on the Use of Consumer Reviews and Testimonials, 16 CFR part 465
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per knowing violation.
It applies in California because California is part of the United States.
CaliforniaIn force
Let users report sexual deepfakes and act within 30 days
Let California account holders report sexually explicit images or videos of themselves that were made or altered digitally without their consent. Confirm each report within 48 hours, update within 7 days, block the material while you check, and decide within 30 days, or 60 days if the delay is beyond your control. Remove it at once if the report holds up.
Who must do it
Social media platforms with users in California; end-to-end encrypted messaging services and charities are excluded.
The law
SB 981 (Chapter 292, Statutes of 2024), Business and Professions Code sections 22670 and 22671
Get estate consent for AI replicas of dead celebrities
Do not use a digital replica of a deceased personality’s voice or likeness in a film, video or sound recording without consent from whoever holds their rights. News, sports, criticism, satire, parody, documentaries, biographies and fleeting uses are excepted.
Who must do it
Studios, labels, advertisers, AI companies and anyone else using such a replica in California.
The law
AB 1836 (Chapter 258, Statutes of 2024), Civil Code section 3344.1
Who enforces it
No regulator; the rights holders can sue for $10,000 or their actual damages, whichever is greater.
It is a federal crime to knowingly publish online an intimate image of an identifiable real person without their consent, including realistic fakes made with AI.
Who must do it
Anyone, people and businesses alike.
The law
TAKE IT DOWN Act (Public Law 119-12), section 2, 47 U.S.C. 223(h)
Who enforces it
Department of Justice; fines and up to two years in prison, or three years if the person shown is a minor.
It applies in California because California is part of the United States.
CaliforniaIn force
Do not make or help spread sexual deepfakes
Do not create or share sexually explicit deepfakes of a real person when you know, or should know, that they did not consent or were a minor, and do not knowingly help others do it. A service mainly for making sexual deepfakes is presumed to know there was no consent. Companies that keep such a service running are presumed liable if they do not stop within 30 days of notice.
Who must do it
Anyone, including people and businesses that run or serve deepfake services.
The law
AB 621 (Chapter 673, Statutes of 2025), Civil Code section 1708.86
Who enforces it
The person shown can sue for profits, actual damages or $1,500 to $50,000 per work, up to $250,000 with malice, plus punitive damages and fees. Public prosecutors can seek $25,000 per violation, or $50,000 with malice.
If an ad for selling property shows a photo changed with editing software or AI, say so clearly on or next to the photo. Add a link, web address or QR code to the original photo. On a website you control, show the original too. Normal edits such as lighting, cropping or colour correction do not count.
Who must do it
Real estate brokers and salespeople in California, and anyone advertising for them.
The law
Business and Professions Code section 10140.8 (AB 723, Chapter 497, Statutes of 2025); amended by AB 2025 (Chapter 572, Statutes of 2026) from January 1, 2027
Who enforces it
Department of Real Estate: a breach of the Real Estate Law, which can lead to a suspended or revoked licence. Wilful violations are a crime, with a fine up to $10,000, up to six months in jail, or both.
Remove reported intimate deepfakes within 48 hours
Give people a clear, plain-language way to report intimate images of themselves posted without consent, including AI-made fakes. Remove a valid reported image within 48 hours, and make reasonable efforts to remove known identical copies.
Who must do it
Public websites, apps and online services that mainly host content from users, with no size threshold. Broadband providers and email are excluded.
The law
TAKE IT DOWN Act (Public Law 119-12), section 3
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per violation. Removals made in good faith are protected.
It applies in California because California is part of the United States.
CaliforniaIn force
Embed hidden AI labels and offer a free checking tool
If you make a generative AI system that people in California can use, add hidden provenance data to the images, video and audio it creates or alters, where technically feasible. Also offer a free disclosure verification tool, your own or a compliant third-party one. Since September 30, 2026 this applies however many users you have; AI built mainly as assistive technology is exempt until 2029.
Who must do it
Makers of generative AI systems publicly available in California.
The law
California AI Transparency Act, Business and Professions Code sections 22757 to 22757.6 (SB 942, Chapter 291, Statutes of 2024; amended by AB 853, Chapter 674, Statutes of 2025, and SB 1000, Chapter 861, Statutes of 2026)
Who enforces it
Attorney General, city attorneys or county counsel; $5,000 per violation, with each day a separate violation. Falsely claiming the assistive-technology exemption costs $50,000 per violation.
Big platforms must show whether content is AI-made
Detect provenance data in content on your platform, clearly show whether it says the content was made or substantially altered by AI or captured by a camera or recorder, and let users inspect that data. Where technically feasible, do not knowingly strip it.
Who must do it
Public-facing social media, file-sharing, mass-messaging and stand-alone search services with more than 2 million unique monthly users over the past 12 months. Broadband and telecom services are excluded.
The law
Business and Professions Code section 22757.3.1, added by AB 853 (Chapter 674, Statutes of 2025) and amended by AB 2713 (Chapter 856, Statutes of 2026)
Who enforces it
Attorney General, city attorneys or county counsel; $5,000 per violation, with each day a separate violation.
If an ad prominently shows a synthetic performer, a realistic performer made with generative AI who is not a real, recognisable person, add a clear disclosure such as “this performance features a synthetic performer”.
Who must do it
Anyone who creates an ad and has it published. Ads for films, TV shows and video games are excluded when the AI use matches the work, and so is AI used only for translation or accessibility.
The law
Business and Professions Code section 17610 (SB 1050, Chapter 246, Statutes of 2026)
Who enforces it
Treated as false advertising under section 17500, and enforced under the unfair competition law (section 17200 and following); a court can order the ad taken down.
Get consent before using a person’s AI voice or likeness
Do not use a digital replica of a living person’s voice or likeness on products, in ads or to sell things without their prior consent. The law now says plainly that California’s right of publicity covers digital replicas, and using one to impersonate someone counts as false impersonation under criminal law.
Who must do it
Anyone using a person’s voice or likeness commercially in California.
The law
SB 1111 (Chapter 862, Statutes of 2026), Civil Code section 3344(f) and Penal Code section 540
Who enforces it
No regulator; the person can sue for $750 or their actual damages, whichever is greater, plus profits, punitive damages and fees.
Do not knowingly use AI to make it look as if a real person appeared before, sent information to or otherwise dealt with a government agency. One example would be AI-written public comments sent in real people’s names.
Who must do it
Anyone, including businesses and groups that send comments or requests to government agencies in California.
The law
Government Code section 8319 (SB 1159, Chapter 863, Statutes of 2026)
Who enforces it
The law sets no penalty of its own and names no enforcer.
If an ad for renting property shows a photo made fully by AI, or changed with editing software or AI, say so clearly on or next to the photo. Also show the original photo, or give a link, web address or QR code to it. Renderings not made with a camera need no original. Normal edits such as lighting, cropping or colour correction do not count.
Who must do it
Anyone who advertises property for rent in California, such as landlords, property managers and agents.
The law
Civil Code section 1940.11 (AB 2025, Chapter 572, Statutes of 2026)
Who enforces it
For real estate licensees, a violation is a breach of their licensing law. For others the section sets no penalty of its own; false advertising law still applies.
This covers cameras, phones with cameras or microphones, and voice recorders first made for sale in California from January 1, 2028. Offer users hidden provenance data in what the device records, and turn it on by default. It names the maker, the device and its version, and the time and date. This applies where technically feasible and where widely adopted standards allow it.
Who must do it
Makers of cameras, phones and voice recorders for sale in California; companies that only assemble devices are excluded.
The law
California AI Transparency Act, Business and Professions Code section 22757.3.3 (AB 853, Chapter 674, Statutes of 2025)
Who enforces it
Attorney General, city attorneys or county counsel; $5,000 per violation, with each day a separate violation.
If a mass layoff, relocation or closure is caused wholly or substantially by AI or other automation, the 60-day notice must say so under the line “This notice is for a technology displacement”. It must give the number, job type and work location of those jobs, the tasks that will be automated and the kind of technology used.
Who must do it
Employers with a California site that has employed 75 or more people in the past year.
Existing Cal/WARN remedies, as SB 951 adds no new penalty: workers not given notice are owed back pay and benefits for up to 60 days, and a missing notice to officials can cost up to $500 a day. Workers, unions and local governments can sue.
Get parents’ separate consent to train AI on kids’ data
If your site, app or service is aimed at children under 13, or you know you collect their data, get a parent’s separate, verifiable consent before disclosing a child’s personal information to third parties. The FTC says disclosing it to train or develop AI needs this consent.
Who must do it
Operators of websites, apps and online services, including education technology, aimed at children under 13 or knowingly collecting their data.
The law
Children’s Online Privacy Protection Rule, 16 CFR 312.5(a)(2), as amended in 2025
Who enforces it
Federal Trade Commission and state attorneys general; civil penalties of up to $53,088 per violation.
It applies in California because California is part of the United States.
CaliforniaFrom January 1, 2027
Do not train AI on students’ data from your school app
If your website, service or app is designed or marketed for preschool, school or college use, do not use the student information it creates or gathers, including persistent identifiers, to train generative AI or develop any AI system. The rules for colleges start on July 1, 2027.
Who must do it
Operators of education websites, services and apps that know they are used for school purposes in California, and companies working for them.
The law
AB 1159 (Chapter 182, Statutes of 2026), Business and Professions Code sections 22584, 22586 and 22587 and following
Who enforces it
Students or parents who suffer damages can sue, also as a class, for their actual damages or $500 per violation, whichever is greater, after giving the operator 60 days’ written notice to fix it.