Data Digesters Beware: An Analysis of CA AB 3204
It’s been another whirlwind week as state legislatures keep AI legislation moving, sending a handful of bills to governors as many more pass their chambers of origin. Some key highlights:
Governor signs New Mexico political deepfake bill into law. This is the second AI bill signed into law this year after South Dakota’s sexual deepfake bill.
Lawmakers sent AI bills to the governors in Florida (political deepfake), Oregon (political deepfake), Virginia (impact assessments), and Tennessee (ELVIS Act).
Plus, an AI executive order in Rhode Island, a Task Force report in Connecticut, and a key AV approval in California.
So far, much of the state-level focus of AI regulation has targeted the outputs the systems produce — how AI models impact individuals. Far less attention has been given to the inputs fed into the systems — the terabytes of data developers use to train AI models. But the California Legislature is currently considering a bill that would do just that.
California Assembly Member Rebecca Bauer-Kahan (D) has proposed legislation (CA AB 3204) that would require disclosures to individuals about the personal information used to train artificial intelligence. The bill introduces a new term — “data digester” — to describe any business that uses personal information to train AI. Data digesters would be required annually to register with the California Privacy Protection Agency (CPPA), pay a registration fee, and provide the following information that would be published on the CPPA’s website:
The name of the business and its contact information;
Each category of personal information that the data digester uses to train AI;
Each category of sensitive personal information that the data digester uses to train AI;
Each category of information related to consumers’ receipt of sensitive services;
Whether the data digester trains AI using the personal information of minors; and
Whether and to what extent the data digester, or any of its subsidiaries, is regulated by privacy laws for insurers, financial institutions, credit issuers, health care providers, or educational institutions.
The bill borrows definitions from the California Consumer Privacy Act, so it applies only to a business that either has at least $25 million in annual gross revenues; buys, sells, or shares the personal information of 100,000 consumers or households; or derives at least 50 percent of its annual revenues from the sale of consumer personal information. “Personal information” under that law excludes information that is already publicly available. The bill would empower the CPPA to promulgate regulations under the law and data digesters that fail to register on time will be subject to an escalating schedule of daily fines by the CPPA.
Many popular AI models have been trained on publicly available personal information, but some models also use information licensed through third parties. Consumers have raised concerns about biometric and personal data used to train models, such as voice recordings of consumers used to create "voice prints." The FTC has recently brought cases against developers of facial recognition technology for using consumer information in violation of stated privacy policies to train AI models.
Aside from privacy concerns, many artists and content providers have raised concerns about copyrighted material used to train AI models. The New York Times filed a major lawsuit against AI developers for using millions of their articles to train models. Artists have sued developers of generative AI tools for the uncompensated use of their work to train models of.
While copyright issues involving AI will likely have to be settled in the courts or Congress, the protection of personal information from being used in AI models could become more of a state issue. The California bill would simply require registration with no additional regulation, but the state already has a robust privacy law to protect personal information. Today, fourteen states have comprehensive privacy laws in place after Gov. Sununu (R) signed a consumer data protection bill into law in New Hampshire this week. In the absence of a federal comprehensive privacy law, more states may be motivated to offer similar protections to consumers to protect their data from AI systems.
Recent Developments
In the News
Claude 3: Anthropic released its latest AI model Claude 3 this week. The early reviews and benchmarking place Claude 3 as a real competitor to the industry-leading OpenAI GPT-4 and Google Gemini 1.5 models. Anthropic was originally spun out of OpenAI in 2021 after a leadership split on AI safety philosophies.
State of the Union: President Biden (D) called on Congress to "ban AI voice impersonation" during his annual State of the Union address. Earlier in the speech, the president also asked lawmakers to "harness the promise of AI and protect us from its peril.”
Major Policy Action
New Mexico: On Tuesday, Gov. Lujan Grisham (D) signed a political deepfake bill (NM HB 182) into law, which will go into effect on May 15, 2024 (90 days after the legislature adjourned). The law will require a political advertisement generated in whole or in part by using AI to include a disclaimer and prohibits distribution within 90 days of an election.
Rhode Island: Last Thursday, Gov. McKee (D) issued an executive order that establishes an AI Center of Excellence to promote AI policy and procedures and improve state operations. The order also establishes an AI Task Force to assess risks and opportunities and provides for the development of AI training and education opportunities.
Connecticut: Last week, the AI Task Force issued its final report that provides several recommendations, many of which have already been incorporated into lawmakers’ comprehensive AI legislation (CT SB 2, which we analyzed here).
California: Last Friday, the California Public Utilities Commission granted Google’s autonomous vehicle (AV) provider, Waymo, approval to operate a commercial robotaxi service in Los Angeles, the San Francisco Peninsula, and on San Francisco freeways. The approval allows Waymo to expand its commercial services in the Golden State to LA and extend trips to and from the San Francisco International Airport.
Wisconsin: On Monday, an AI task force created by Gov. Evers (D) met to discuss AI’s potential impact on the workforce. The task force hopes to release an advisory plan this summer, with recommendations to be included in the governor’s next two-year state budget proposal.
Florida: Last Friday, only two days after the House passed a political deepfake bill, the Senate unanimously passed the bill, sending it to Gov. DeSantis (R). The House bill (FL HB 919) would require a disclaimer for political advertisements created in whole or in part with the use of generative AI. On the same day, the House unanimously passed the Senate’s broader deepfake bill as well, sending it to the governor. The Senate bill (FL SB 1680) would require watermarks for deepfake media, disclosure for AI-generated political ads, and prohibits the use of AI in obscene material depicting a minor. The legislature is scheduled to adjourn on Friday, which gives the governor 15 days to veto or sign the bills into law.
Oregon: On Tuesday, the House passed a political deepfake bill (OR SB 1571), which the Senate had passed last week, sending the bill to Gov. Kotek (D) for her signature to become law. The bill would require disclosure of the use of synthetic media in campaign communications (with exceptions for content carriers and broadcasters).
Virginia: On Tuesday, the House passed an impact assessments bill (VA SB 487), which the Senate had passed last month, sending the bill to Gov. Youngkin (R) for his signature to become law. The bill would require a public body that uses AI to conduct impact assessments to ensure its use will not result in any unlawful discrimination against any individual or group of individuals or have any disparate impact. The governor has until April 8, 2024, (30 days after the legislature adjourns this Saturday) to veto or sign the bill into law.
Tennessee: On Thursday, the Senate unanimously passed the ELVIS Act (TN HB 2091), after the House passed the bill earlier this week, sending the bill to Gov. Lee (R) for his expected signature. The bill will add "voice" as a protected personal right. We previously wrote about this legislation in “Lawmakers Respond to AI-Induced Job Displacement.”
Utah: Lawmakers sent three more AI-related bills to Gov. Cox (R) for his signature to become law. Two of the bills relate to sexual deepfakes (UT HB 148 & UT HB 238) and the third bill (UT SB 231) would prohibit a governmental entity from obtaining biometric surveillance information without a warrant. This places a total of six AI-related bills on the governor's desk right now. Last week, lawmakers sent the governor an electoral deepfake bill (UT SB 131) and the broader “AI Policy Act” (UT SB 149) that sets up various offices dedicated to AI and would establish liability for the use of AI that violates consumer protection laws if not properly disclosed. And last month, the governor received a bill (UT SB 66) to add generative images to the state’s definition of counterfeit intimate images in the criminal code. The governor has 20 days after receiving a bill to veto or sign the bill into law.
Georgia: Last Thursday, the House passed a sexual deepfake bill (GA HB 1361), sending it to the Senate for consideration.
Missouri: On Wednesday, the House passed a political deepfake bill (MO HB 2628). The bill passed a voice vote, and a formal roll call vote will need to take place before the bill formally is sent to the Senate for its consideration.
Iowa: On Wednesday, the House passed a political deepfake bill (IA HF 2549), sending it to the Senate for consideration. The bill would require disclosure of any published material generated through AI that advocates for the election or defeat of a candidate or a ballot issue.
Hawaii: On Tuesday, the House (HI HB 1766) and Senate (HI SB 2687) both passed political deepfake bills, sending each bill to the other chamber for its consideration. Both bills would require a disclaimer for any materially deceptive media distributed within a certain time frame of an election.
Oklahoma: On Tuesday, the Senate passed political deepfake (OK SB 1655) and sexual deepfake (OK SB 1268) bills, sending them to the House for consideration.
Notable Proposals
California: Assembly Member Evan Low (D) introduced a bill (CA AB 3058) that would guarantee a universal basic income program for residents whose employment is replaced by AI. The bill is currently a shell bill introduced to meet a legislative deadline, but the bill will likely be amended with substantive text in committee.
Louisiana: Senator Patrick Connick (R) pre-filed a bill (LA SB 118) that would require an AI foundation model used in the state to be registered with the secretary of state. The legislature is scheduled to start its 2024 legislative session on March 11.
New Jersey: Assembly Member Herb Conaway, Jr. (D) introduced a bill (NJ AB 3858) that would require disclosure when an insurance carrier uses an automated utilization management system as well as a report of how many claims the system reviewed the previous year.