California Bills regulating major AI systems of tomorrow, the data of minors, algorithms, and web browsers made key advancements in the legislature Tuesday. As a watered down federal data privacy law appears to be in jeopardy, and California is forging relationships with international allies over Washington D.C. in the name of data privacy, these bills move closer to the governor’s desk. Today is the last day for policy committees to report bills.
Here’s a look at some tech bills that passed out of the Senate and Assembly Judiciary Committees:
One-time Opt Out
Despite rights in effect right now directing businesses to limit, delete and stop sharing personal information directly collected from a person, there still exists a barrier to privacy rights in California. And that’s being unable to convey all your privacy preferences in one collective swoop. Brave, DuckDuckGo and Firefox allow for this privacy preference signal, but these browsers aren’t very popular. The top three browsers—Google’s Chrome, Apple’s Safari and Microsoft’s Edge—make up for nearly 90 percent of the browser market share, but don’t support such a signal. These same companies also collect our data.
As it stands now, exercising privacy rights is left to busy bodies with the patience and time that most don’t have to fill out thousands of forms in order to opt out. However, advancing out of the Senate Judiciary Committee to Appropriations is Assembly Bill 3048 (Lowenthal), the privacy preference signal bill that will allow users to globally opt out of things like the sale of personal information. It’s a simple bill that will help streamline rights. Without it, people will be more likely to give up on exercising data protections, and companies will continue to have the upper hand on the use of people’s personal information.
Future AI
Imagine if 20 years ago, companies like Facebook were simply required to show us if their products were safe. But that never happened because no laws were passed protecting us, and it led to disrupting elections and damaging people’s mental health on a massive scale.
The Safe and Secure Innovation for Frontier Artificial Intelligence Systems Act, or SB 1047 (Wiener), which passed out of the Senate Judiciary Committee to Appropriations, is trying to stop a repeat of the past with AI. The bill’s aim is to put safeguards and policies around only the biggest AI systems—ones that haven’t been invented yet—in order to prevent AI-enabled crime and weapons of mass destruction that we can’t even begin to comprehend.
The bill has not surprisingly caught huge opposition from the tech world, who have argued it will divert innovation to China instead of California, hurt start ups, and even send developers to jail.
But the bill is largely doing what AI developers have already voluntarily agreed to do on the national and international level, except they don’t actually want to be held to it. This bill is calling their bluff. The bill won’t stop companies from making money. It won’t stop companies from innovating. There is no computational limit placed on models. And developers will not be going to jail. That’s never even happened before. Wiener pointed out that developers can already get sued under common Tort law, and the bill could actually help companies avoid getting sued by making sure their systems are safe.
In fact, many companies won’t even be affected by the bill. Only the biggest AI models, costing $100 million to train or more, and with the computational power of a Chat GPT, will have to establish a safe method to train their AI. Then companies must submit risk assessments of their systems detailing how catastrophic harm will be avoided. Operators of these models will also be required to be able to shut down covered models. The bill will develop a body overseeing the development of AI in the state, much like other industries have. And the bill will add important whistleblower protections. Enforcement action can only be undertaken by the Attorney General’s Office.
The state of California has been a global leader in technological innovation for over 50 years while also being at the forefront of technological regulation, and that hasn’t stopped the Googles, Apples and Open AIs of the world.
Read Consumer Watchdog’s support letter here.
Protecting Children’s Data
AB 1949 (Wicks) will change how businesses collect, sell and share the personal data of children and teens. With social media companies keeping kids scrolling by exploiting them with addicting algorithms, it leads to the collection of more data. Under the bill, businesses will have to obtain authorization from those between the ages of 13-18 years old, or the parents of those under the age of 13, before collecting any of the minor’s personal information. The use and disclosure of a minor’s personal information is also prohibited unless authorization is given.
Clearview is barred from selling its product to private businesses in California due to a settlement, but there are no statewide restrictions on the company to sell its tech to government and law enforcement agencies in the state. The company is still subject to the California Consumer Privacy Act.
But a key portion of the bill is going to change following its passage through the Senate Judiciary Committee. Originally, the bill removed language that limits businesses obtaining authorization to having “actual knowledge” that a person is a minor. This would change how some of the biggest abusers of children’s privacy have to operate, such as Clearview AI, which uses AI facial recognition technology to compile a sort of “Google, but for faces.” Without this law, Clearview can get away with collecting, processing and selling children’s personal information without consent because the company doesn’t actually have to profess to know the ages of any people in its database.
Now, the bill’s author, Buffy Wicks, has agreed to remove the actual knowledge standard, an amendment groups like the California Chamber of Commerce sought.
“In response to these concerns, the author has agreed to amendments that replace the actual knowledge standard into the various sections of the bill, essentially imposing the restrictions of the bill for only those consumers the business has actual knowledge are under 18 years of age,” states an analysis by the Judiciary Committee. “This new approach removes the strict liability standard but still ensures children are given enhanced privacy rights in order to avoid the ills outlined above.”
The bill now moves to Senate Appropriations.
Consumer Watchdog wrote a report on Clearview and how existing California laws can reign the company in.
Algorithms
A bill that will force companies to show how their automated decisionmaking technology (ADMT) is not discriminatory or biased passed onto Appropriations. Assembly Bill 2930 (Bauer-Kahan) also authorizes the Civil Rights Department to investigate a report of algorithmic discrimination. However, the bill has been amended to make all impact assessments disclosed to the California Privacy Protection Agency be exempt from the California Public Records Act.
The bill also overlaps with the California Consumer Privacy Act, and has faced criticism within the privacy world. It appears to have been drafted with input from tech companies such as Workday, who circulated a confidential model bill with state lawmakers across the country. Verbiage similar to the company’s model bill made it into AI bills in Connecticut, Illinois, Rhode Island, New York, Washington, and here in California. Some of the similar language state that regulations would only apply to an automated decision tool that has been, “specifically developed and marketed to, or specifically modified to be the controlling factor in making a consequential decision.”
With such language, companies could argue that their products were not “specifically” made to be factor in making a significant decision, such as a loan or college admission, thus freeing them from any liability. That line was previously in Bauer-Kahan’s bill, but it has since been taken out. When the bill was introduced by Bauer-Kahan, a Workday lobbyist was quoted in the press release, who said Workday was “pleased to have contributed to its development.”
Following assembly discussion over what would be considered ADMT, Bauer-Kahan said she will continue looking into the line between AI and human input. Committee Chair Tom Umberg said he would support the bill, which ultimately passed the Senate Judiciary, but not on the floor unless it is improved.
AI to Stop AI
Assembly Bill 2655 (Berman and Pellerin), a bill aimed at combating deepfakes, narrowly passed out of the Senate Judiciary Committee and to Appropriations by a vote of 2-1, with a number of assembly members missing in action. The major debate surrounding the bill was about whether it would survive on constitutional grounds, and instead go beyond regulating deepfake technology by acting as a censor of political speech.
Autonomous Truckers
Although robotaxis must undergo testing with a safety driver, that is not the case for an AV weighing over 10,001 pounds. Moving to Senate Appropriations, Assembly Bill 2286 (Aguiar-Curry), seeks to change that. The bill would provide a framework for autonomous trucks as they undergo testing. Backed by labor, the bill requires that a certified human safety operator supervises AVs when they are on public roads. It will also provide better data that will be analyzed by the state’s executive branch. This should allow technology to develop safely and help the state’s transportation workers get better accustomed to AV technology.
Bridging the Data Gap for Autonomous Vehicles
Currently the law doesn’t mandate that the California DMV report collision and disengagement data for deployment permits of Autonomous Vehicles (AV). But per Assembly Bill 3061 (Haney), which advanced out of the Senate Transportation Committee and onto Appropriations, a maker of an AV will have to report to the DMV any accident, traffic violation, disengagement, or harassment of any passenger in the state of California. Such reports will be published online within 30 days. If not, companies will face fines, or suspension of a testing or deployment permit.
