California AG’s Legal Advisory on the Application of Existing Laws to AI

California Attorney General’s Legal Advisory on the Application of Existing California Laws to Artificial Intelligence The California Attorney General’s Office (AGO) issues this advisory to provide guidance to consumers and entities that develop, sell, and use artificial intelligence (AI)1 about their rights and obligations under California law, including under the state’s consumer protection, civil rights, competition, and data privacy laws.2 1 While the definition of AI may vary depending upon the context, for the purposes of this advisory, AI includes “a machinebased system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine and human-based inputs to—(A) perceive real and virtual environments; (B) abstract such perceptions into models through analysis in an automated manner; and (C) use model inference to formulate options for information or action.” (15 U.S.C. § 9401(3).) California has also recently passed a law defining the term in certain instances as “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.” (See Gov. Code § 11546.45.5 et seq., added by AB 2885, Stats. 2024, ch. 843.) 2 This advisory provides the AGO’s guidance on general application of California law to AI. This advisory does not address all potential violations or avenues of enforcement for the identified laws, nor does it identify all laws that may apply to AI.

Artificial Intelligence Holds Great Potential and Great Risks AI systems are at the forefront of the technology industry, and hold great potential to achieve scientific breakthroughs, boost economic growth, and benefit consumers. As home to the world’s leading technology companies and many of the most compelling recent developments in AI, California has a vested interest in the development and growth of AI tools. The AGO encourages the responsible use of AI in ways that are safe, ethical, and consistent with human dignity to help solve urgent challenges, increase efficiencies, and unlock access to information—consistent with state and federal law.

While AI tools present new opportunities, the use of AI can run the risk of exacerbating bias, discrimination, and the spread of disinformation, creating opportunities for fraud and causing harm to California’s people, institutions, infrastructure, economy, and environment. For AI systems to achieve their positive potential without doing harm, they must be developed and used ethically and legally. Existing California law provides a host of protections that may be applicable to the development and use of AI tools.

Consumers must have visibility into when and how AI systems are used to impact their lives and whether and how their information is being used to develop and train systems. Developers and entities that use AI, including businesses, nonprofits, and government, must ensure that AI systems are tested and validated, and that they are audited as appropriate to ensure that their use is safe, ethical, and lawful, and reduces, rather than replicates or exaggerates, human error and biases. Developers and users must understand any risks involved in the use of AI, and ensure that AI is not used in a manner that causes harm to individuals, entities, infrastructure, competition, or the environment, or to the public at large.

AI systems are proliferating at an exponential rate and already affect nearly all aspects of everyday life. Businesses are using AI systems to evaluate consumers’ credit risk and guide loan decisions, screen tenants for rentals, and target consumers with ads and offers. AI systems are also used in the workplace to guide employment decisions, in educational settings to provide new learning systems, and in healthcare settings to inform medical diagnoses. But many consumers are not aware of when and how AI systems are used in their lives or by institutions that they rely on. Moreover, AI systems are novel and complex, and their inner workings are often not understood by developers and entities that use AI, let alone consumers. The rapid deployment of such tools has resulted in situations where AI tools have generated false information or biased and discriminatory results, often while being represented as neutral and free from human bias.

Entities that develop or use AI systems must ensure that they and their systems comply with California law, including laws protecting consumers from unfair and fraudulent business practices, anticompetitive harm, discrimination and bias, and abuse of their data. Businesses must understand how the AI systems they utilize are trained, what information the systems consider, and how the systems generate output. They must also understand that they can be held accountable under tort, contract, or other laws if the employment of AI results in harm, particularly when AI systems are employed negligently or in use cases that could entail a level of risk. Developers and users of AI must also be transparent with consumers about whether consumer information is being used to train AI and how they are using AI to make decisions affecting consumers.

California’s Consumer Protection, Civil Rights, and Competition Laws Provide Broad Protections A. California’s Unfair Competition Law California’s Unfair Competition Law protects the state’s residents against unlawful, unfair, or fraudulent business acts or practices. (Bus. & Prof. Code, § 17200 et seq.) The law was intentionally written with broad, sweeping language to protect Californians from obvious and familiar forms of fraud and deception as well as new, creative, and cuttingedge forms of unlawful, unfair, and misleading behavior. (People ex rel. Mosk v. Nat’l Research Co. (1962) 201 Cal. App.2d 765, 772.) AI provides new tools for businesses and consumers alike, and also creates new opportunity to deceive Californians. Practices that deceive or harm consumers fall squarely within the purview of the Unfair Competition Law, and developers, entities that use AI, and end-users of AI systems should be aware that traditional consumer legal protections apply equally in the AI context. In addition to prohibiting consumer deception, the Unfair Competition Law makes a violation of any other state, federal, or local law “independently actionable” under the Unfair Competition Law. (Farmers Ins. Exchange v. Superior Court (1994) 2 Cal.4th 377, 383.) Thus, the scope of the Unfair Competition Law is broad and incorporates numerous laws that may apply to AI in a variety of contexts.

For example, it may be unlawful under California’s Unfair Competition Law to:3 • Falsely advertise the accuracy, quality, or utility of AI systems. This includes claiming that an AI system has a capability that it does not; representing that a system is completely powered by AI when humans are responsible for performing some of its functions; representing that humans are responsible for performing some of a system’s functions when AI is responsible instead; or claiming without basis that a system is accurate, performs tasks better than a human would, has specified characteristics, meets industry or other standards, or is free from bias. (See, e.g., Bus. & Prof. Code, § 17500 et seq.; Civ. Code, § 1770 [The Consumer Legal Remedies Act].) • Use AI to foster or advance deception. For example, the creation of deepfakes, chatbots, and voice clones that appear to represent people, events, and utterances that never existed or occurred would likely be deceptive.4 Likewise, in many contexts it would likely be deceptive to fail to disclose that AI has been used to create a piece of media. • Use AI to create and knowingly use another person’s name, voice, signature, photograph, or likeness without that person’s prior consent. (Civ. Code, §§ 3344, 3344.1; see also Civ. Code, § 1708.86 [prohibiting the creation and disclosure of sexually explicit material without the depicted person’s consent]).5 • Use AI to impersonate a real person for purposes of harming, intimidating, threatening, or defrauding another person. (Pen. Code, § 528.5.) • Use AI to impersonate a real person for purposes of receiving money or property. (Pen. Code, § 530; see also Pen. Code, § 529 [false personation of another in private or official capacity while doing specified acts].) • Use AI to impersonate a real person for any unlawful purpose. (Pen. Code, § 530.5 [identity theft]; Pen. Code, § 530.55 [personal identifying information includes unique biometric data including fingerprint, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation]; see also People v. Bollaert (2016) 248 Cal.App.4th 699, 711-12 [unlawful purpose for identity theft includes intentional civil torts including invasion of privacy].) • Use AI to impersonate a government official in the execution of official duties. (See Pen. Code, § 538d [impersonating a peace officer]; Pen. Code, § 146a [impersonating a state officer while committing specified acts]; Pen. Code, § 538f [impersonating a public utility officer]; Pen. Code, § 538g [impersonating a state/ county/city/special district/city or county officer or employee].) • Use AI in a manner that is unfair, including using AI in a manner that results in negative impacts that outweigh its utility, or in a manner that offends public policy, is immoral, unethical, oppressive, or unscrupulous, or causes substantial injury. • Create, market, or disseminate an AI system that does not comply with federal or state laws, including the false advertising, civil rights, and privacy laws described below, as well as laws governing specific industries and activities. Businesses may also be liable for supplying AI products when they know, or should have known, that AI will be used to violate the law. (See, e.g., People v. Toomey (1984) 157 Cal.App.3d 1, 15 [liability under section 17200 can be imposed for aiding and abetting].) [footnotes omitted]

B. California’s False Advertising Law California’s False Advertising Law provides another layer of protection for California’s citizens against deceptive advertising. (Bus. & Prof. Code, § 17500 et seq.) The False Advertising Law “broadly prohibit[s] false or misleading advertising, declaring that it is unlawful for any person or business to make or distribute any statement to induce the public to enter into a transaction ‘which is untrue or misleading, and which is known, or which by exercise of reasonable care should be known, to be untrue or misleading.’” (Nationwide Biweekly Administration, Inc. v. Superior Court (2020) 9 Cal.5th 279, 306 [quoting Bus. & Prof. Code, § 17500].) The law would prohibit false advertising regarding the capabilities, availability, and utility of AI products, the use of AI in connection with a good or service, as well as false advertising regarding any topic, whether or not it is generated by AI.

C. California’s Competition Laws California’s competition laws, including the Cartwright Act, which prohibits anticompetitive trusts (Bus. & Prof. Code, § 16720), and the Unfair Practices Act, which regulates practices such as below-cost sales and loss leaders, protect California’s economy. (Bus. & Prof. Code, § 17000 et seq.) The Unfair Competition Law, discussed above, also prohibits acts and practices that violate antitrust laws, among other practices. This includes, but is not limited to, conduct that threatens an incipient violation of an antitrust law, that violates the policy or spirit of one of those laws because its effects are comparable to a violation of the law, or that otherwise significantly threatens or harms competition. AI developers and users should be aware of any risks to fair competition created by AI systems, such as those that set pricing. Even inadvertent harm to competition resulting from AI systems may violate one or more of California’s competition laws. Anticompetitive actions by dominant AI companies may also harm competition in AI markets and violate both state and federal competition laws.

D. California’s Civil Rights Laws California’s Unruh Civil Rights Act protects the freedom and equality of all people within the state, “no matter what their sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic information, marital status, sexual orientation, citizenship, primary language, or immigration status.” (Civ. Code, § 51.) The California Fair Employment and Housing Act (FEHA) also protects Californians from harassment or discrimination in employment or housing based on a number of protected characteristics, including sex, race, disability, age, criminal history, and veteran or military status. (Gov. Code, § 12900 et seq.) Businesses may be liable for FEHA-prohibited discriminatory screening carried out by an agent, and further, the agents themselves may be directly liable to the individuals who were discriminated against. (See Raines v. U.S. Healthworks Medical Grp. (2023) 15 Cal.5th 268, 291.) And Section 11135 prohibits denial of full and equal access to the benefits of, or discrimination under, any program or activity receiving state funds. (Gov. Code, § 11135.) This includes practices that, regardless of intent, have an adverse or disproportionate impact on members of a protected class, or create, reinforce, or perpetuate discrimination or segregation of members of a protected class. (Cal. Code of Regs., tit. 2, § 14027.)

We have seen AI systems incorporate societal and other biases into their decision-making.6 Developers and users of AI should be wary of these potential biases that may be unlawfully impacting Californians.7 Other laws also require that entities that take adverse action against citizens provide specific reasons for those adverse actions, including when AI was used to make the determination. As one example, the federal Fair Credit Reporting Act and Equal Credit Opportunity Act, as well as the California Consumer Credit Reporting Agencies Act, require such specific reasons be provided to Californians who receive adverse actions based on their credit scores. (See 15 U.S.C. § 1681 et seq.; 15 U.S.C. § 1691 et seq.; Civ. Code, § 1785.1 et seq.) The Consumer Financial Protection Bureau recently clarified that creditors who use AI or complex credit models must still provide individuals with specific reasons when they deny or take another adverse action against an individual.8 [footnotes omitted]

E. California’s Election Misinformation Prevention Laws9 California law also provides guidance on a number of scenarios in which the use of AI may be illegal in the context of elections.10 California law prohibits the use of undeclared chatbots with the intent to mislead a person about its artificial identity in order to incentivize a purchase or influence a vote in an election. (Bus. & Prof. Code, § 17941.) It is also impermissible to use AI to impersonate a candidate for elected office, or a candidate or initiative’s website (Elec. Code, § 18320),11 and to use AI to distribute, with actual malice, materially deceptive audio or visual media of a candidate for elective office within 60 days of that candidate’s election with the intent to injure the candidate’s reputation or deceive a voter into voting for or against the candidate. (Elec. Code, § 20010.) [footnotes omitted]

Data Protection Laws Provide Additional Broad Protections for Californians Data is the bedrock underlying the massive growth in AI, and Californians’ broad privacy and data rights directly impact AI systems, whether through the data used to build and train AI, or through the information that may be exposed by AI outputs. Californians possess a constitutional right to privacy that applies to both government and private entities. (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 20.) Informational privacy, i.e., the “interest in precluding the dissemination or misuse of sensitive and confidential information” is a core privacy interest protected by the California Constitution. (Id. at 35.) Developers and entities that use AI must carefully monitor AI systems’ training data, inputs, and outputs to ensure that Californians’ constitutional right to privacy is respected. The California Consumer Privacy Act (CCPA) broadly regulates the collection, use, sale, and sharing of consumers’ personal information, including heightened protections for sensitive personal information. Personal information may also include inferences about consumers made by AI systems. (See Civ. Code, § 1798.140(v).) CCPA grants consumers important rights: • The right to know about the personal information a business collects about them, and how it is used and shared; • The right to correct inaccurate personal information that a business has about them; • The right to delete personal information collected about them (with some exceptions); • The right to opt out of the sale or sharing of their personal information; and • The right to limit the use and disclosure of their sensitive personal information. (Id. § 1798.100 et seq.)

AI developers and users that collect and use Californians’ personal information must comply with CCPA’s protections for consumers, including by ensuring that their collection, use, retention, and sharing of consumer personal information is reasonably necessary and proportionate to achieve the purposes for which the personal information was collected and processed. (Id. § 1798.100.) Businesses are prohibited from processing personal information for non-disclosed purposes, and even the collection, use, retention, and sharing of personal information for disclosed purposes must be compatible with the context in which the personal information was collected. (Ibid.) AI developers and users should also be aware that using personal information for research is also subject to several requirements and limitations. (Id. § 1798.140(ab).) A new bill signed into law in September 2024 confirms that the protections for personal information in the CCPA apply to personal information in AI systems that are capable of outputting personal information. (Civ. Code, § 1798.140, added by AB 1008, Stats. 2024, ch. 804.) A second bill expands the definition of sensitive personal information to include “neural data.” (Civ. Code, § 1798.140, added by SB 1223, Stats. 2024, ch. 887.) The California Invasion of Privacy Act (CIPA) may also impact AI training data, inputs, or outputs. CIPA restricts recording or listening to private electronic communication, including wiretapping, eavesdropping on or recording communications without the consent of all parties, and recording or intercepting cellular communications without the consent of all parties. (Pen. Code, § 630 et seq.) CIPA also prohibits use of systems that examine or record voice prints to determine the truth or falsity of statements without consent. (Id. § 637.3.) Developers and users should ensure that their AI systems, or any data used by the system, do not violate CIPA.

California law contains heightened protection for particular types of consumer data, including education and healthcare data that may be processed or used by AI systems. The Student Online Personal Information Protection Act (SOPIPA) broadly prohibits education technology service providers from selling student data, engaging in targeted advertising using student data, and amassing profiles about students, except for specified school purposes. (Bus. & Prof. Code, § 22584 et seq.) SOPIPA applies to services and apps used primarily for “K-12 school purposes.” This includes services and apps for home or remote instruction, as well as those intended for use at a public or private school. Developers and users should ensure any educational AI systems comply with SOPIPA, even if they are marketed directly to consumers. Finally, the Confidentiality of Medical Information Act (CMIA) governs the use and disclosure of Californians’ medical information and applies to businesses that offer software or hardware to consumers for the purposes of managing medical information, or for diagnosis treatment, or management of medical conditions, including mobile applications or other related devices. (Civ. Code, § 56 et seq.) The rise of mental health and reproductive apps led to recent amendments to clarify that mental health and reproductive or sexual health digital services, such as apps and websites, are subject to the requirements of CMIA. Developers and users should ensure that any AI systems used for healthcare, including direct-to-consumer services, comply with the CMIA.

New California AI Laws California has recently enacted the following legislation, effective January 1, 2025,12 which addresses the use of AI and has broad impact for businesses and individuals: Disclosure Requirements for Businesses • AB 2013 (Irwin) requires AI developers to disclose information on their websites about their training data on or before January 1, 2026, including a high-level summary of the datasets used in the development of the AI system or service. (Civ. Code, § 3110 et seq.) • AB 2905 (Low) requires telemarketing calls that use AI-generated or significantly modified synthetic marketing to disclose that use. (Pub. Util. Code, § 2874.) • SB 942 (Becker) places obligations on AI developers, starting January 1, 2026, to make free and accessible tools to detect whether specified content was generated by generative AI systems. These developers are required to offer visible markings on AI-generated content to identify it as such and other detection features. (Bus. & Prof. Code, § 22757 et seq.) [footnotes omitted]

Unauthorized Use of Likeness in the Entertainment Industry and Other Contexts • AB 2602 (Kalra) requires that contracts authorizing the use of an individual’s voice and likeness in a digital replica created through AI technology include a “reasonably specific description” of the proposed use and that the individual be represented by legal counsel or by a labor union. Absent these requirements, the contract is unenforceable, unless the uses are otherwise consistent with the terms of the contract and the underlying work. (Lab. Code, § 927.) • AB 1836 (Bauer-Kahan) prohibits the use of a deceased personality’s digital replica without prior consent within 70 years of the personality’s death, imposing a minimum $10,000 fine for the violation. A deceased personality is any natural person whose name, voice, signature, photograph, or likeness has commercial value at the time of that person’s death, or because of that person’s death. (Civ. Code, § 3344.1.)

Use of AI in Election and Campaign Materials • AB 2355 (Carrillo) requires any campaign advertisements generated or substantially altered using AI to include the following disclosure: “Ad generated or substantially altered using artificial intelligence.” (Gov. Code, § 84504 et seq.) • AB 2655 (Berman) requires that large online platforms (with at least one million California users) develop and implement procedures using state-of-the-art techniques to identify and remove certain materially deceptive election-related content—deepfakes—during specified periods before and after elections in California. It also requires certain additional content be labeled as manipulated, inauthentic, fake, or false during a longer period of time around elections in California. Platforms must provide an easy mechanism for California users to report the prohibited materials. (Code. Civ. Proc., § 35; Elec. Code, § 20510.)13 [footnotes omitted]

Expanded Prohibitions and Reporting of Exploitative Uses of AI • AB 1831 (Berman) and SB 1381 (Wahab) expands existing criminal prohibitions on child pornography to include the use of AI in the creation of visual depictions of the sexual abuse and exploitation of children. (Pen. Code, §§ 311, 311.2, 311.3, 311.4, 311.11, 311.12, 312.3.) • SB 926 (Wahab) extends criminal penalties to the creation of nonconsensual pornography using deepfake technology. (Pen. Code, § 647.) • SB 981 (Wahab) requires social media platforms to provide a mechanism for California users to report sexually explicit digital identity theft or deepfake pornography. (Bus. & Prof. Code, § 22670 et seq.)

Supervision of AI Tools in Healthcare Settings • SB 1120 (Becker) requires health insurers to ensure that licensed physicians supervise the use of AI tools that make decisions about healthcare services and insurance claims. (Health & Saf. Code, § 1367.01; Ins. Code, § 10123.135.)

Entities Should Remain Vigilant About Other Laws and Regulations Which May Be Applicable to AI Technologies Beyond the laws and regulations discussed in this advisory, other California laws—including tort, public nuisance, environmental and business regulation, and criminal law—apply equally to AI systems and to conduct and business activities that involve the use of AI. Conduct that is illegal if engaged in without the involvement of AI is equally unlawful if AI is involved, and the fact that AI is involved is not a defense to liability under any law. This overview is not intended to be exhaustive. Entities that develop or use AI have a duty to ensure that they understand and are in compliance with all state, federal, and local laws that may apply to them or their activities. That is particularly so when AI is used or developed for applications that could carry a potential risk of harm to people, organizations, physical or virtual infrastructure, or the environment.