California decided AI outputs can be personal information

The design

California's legislature passed Assembly Bill 1008, and the governor approved it on 28 September 2024, filed with the Secretary of State the same day as Chapter 802 of the Statutes of 2024. The enrolled bill text amends a single section of the Civil Code, Section 1798.140, the definitions section of the California Consumer Privacy Act (CCPA). It does not create a new AI statute; it is a technical clarification sitting beneath the state's companion-specific and bot-disclosure laws already covered on this site.

What the evidence says

The bill's own digest states its function precisely: it specifies that personal information “can exist in various formats.” The amended statutory text lists those formats, including, in the bill's own words, “abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.” That clause does not redefine what counts as personal information; it clarifies that the CCPA's existing definition reaches personal data regardless of the technical form it takes, including a trained AI system able to output such data. The enrolled text also notes the bill was enacted alongside a related bill, SB 1223, extending CCPA protections to neural data, and states that only one of the two bills' amendments to Section 1798.140 becomes operative depending on enactment order.

What it asks of people

The clarification does not create a new consumer right; it confirms that rights a consumer already has under the CCPA — to know what personal information a business holds, to delete it, and to opt out of its sale or sharing — extend to personal information embedded in or generated by an AI system's outputs, not only to information stored in conventional records. For a company operating a companion AI product in California, the amendment forecloses an argument that data a trained model can output, as opposed to data stored in a conventional field, falls outside the CCPA's reach.

Privacy and safeguards

Enforcement of the CCPA, as the Attorney General's own CCPA page states, runs through the Attorney General and the California Privacy Protection Agency; for most violations, an individual consumer cannot sue directly. The amendment adds no new enforcement mechanism, retention limit, or breach-notification duty specific to AI; it operates entirely by adjusting a definition that other CCPA provisions already reference.

• Does a specific companion app's model output personal information in a form the amended definition now clearly covers?
• Has the California Privacy Protection Agency issued regulations interpreting “artificial intelligence systems that are capable of outputting personal information”?
• How does this definitional change interact with the separate SB 1223 amendment covering neural data?

AB 1008 is a narrow, technical amendment rather than a new AI law, and its significance lies in closing a definitional gap beneath the CCPA rather than in creating any obligation that did not already exist in principle.