Bill Text: CA AB1824 | 2023-2024 | Regular Session | Amended

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: California Consumer Privacy Act of 2018: opt out right: mergers.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Passed) 2024-09-29 - Chaptered by Secretary of State - Chapter 940, Statutes of 2024. [AB1824 Detail]

Download: California-2023-AB1824-Amended.html

---

Amended  IN  Assembly  March 19, 2024

CALIFORNIA LEGISLATURE— 2023–2024 REGULAR SESSION

Assembly Bill

No. 1824

---

Introduced by Assembly Member Valencia

January 11, 2024

---

An act relating to artificial intelligence. An act to amend Section 1798.120 of the Civil Code, relating to privacy.

LEGISLATIVE COUNSEL'S DIGEST

AB 1824, as amended, Valencia. Artificial intelligence: disclosure. California Consumer Privacy Act of 2018: opt-out right: mergers.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumer’s opt-out direction to the transferor.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law defines “automated decision system” as a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.

This bill would state the intent of the Legislature to enact legislation that would create a disclosure requirement for content generated through artificial intelligence.

Digest Key

Vote: MAJORITY   Appropriation: NO   Fiscal Committee: NOYES   Local Program: NO  

---

Bill Text

The people of the State of California do enact as follows:

SECTION 1.

 Section 1798.120 of the Civil Code is amended to read:

1798.120.

 Consumers’ Right to Opt Out of Sale or Sharing of Personal Information

(a) (1) A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. This right may be referred to as the right to opt-out of sale or sharing.

(2) A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s direction to the transferor made pursuant to this subdivision.

(b) A business that sells consumers’ personal information to, or shares it with, third parties shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be sold or shared and that consumers have the “right to opt-out” opt out” of the sale or sharing of their personal information.

(c) Notwithstanding subdivision (a), a business shall not sell or share the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.

(d) A business that has received direction from a consumer not to sell or share the consumer’s personal information or, in the case of a minor consumer’s personal information has not received consent to sell or share the minor consumer’s personal information, shall be prohibited, pursuant to paragraph (4) of subdivision (c) of Section 1798.135, from selling or sharing the consumer’s personal information after its receipt of the consumer’s direction, unless the consumer subsequently provides consent, for the sale or sharing of the consumer’s personal information.

SEC. 2.

 The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.

SECTION 1.

It is the intent of the Legislature to enact legislation that would create a disclosure requirement for content generated through artificial intelligence.