Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

CA AB1008: California Consumer Privacy Act of 2018: personal information.

Enacted California · 2023–2024 session

Last verified Oct 12, 2026 · official bill text

AB1008 · where it stands

4 of 5 steps complete
  1. Introduced Complete
  2. Passed first chamber Complete
  3. Passed both chambers Complete
  4. Enacted Complete
  5. Effective Date not recorded
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

AB 1008 amended Civil Code Section 1798.140, the CCPA definitions section. It specifies that personal information can exist in various formats, including physical formats, digital formats, and abstract digital formats such as compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information. This brings personal information held in or produced by AI models within the CCPA's consumer rights and business obligations.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Businesses training or deploying AI models on consumer data should treat personal information in those systems as subject to CCPA rights such as access and deletion.

Key provisions

  1. Amends the CCPA definition of personal information (Civil Code 1798.140)
  2. Personal information can exist in physical, digital, and abstract digital formats
  3. Abstract digital formats include AI systems capable of outputting personal information
  4. Declared to further the purposes of the California Privacy Rights Act

Latest legislative action

Sep 28, 2024. Approved by the Governor September 28, 2024. Chaptered by Secretary of State - Chapter 802, Statutes of 2024.

Topics and industries

Related topics

AI Privacy

Affected industries

TechnologyConsumer Protection

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error

Related AI laws in California

All California bills →
AB1159 Student personal information. AB 1979 Health care services: artificial intelligence. SB574 Attorneys, arbitrators, judicial officers, and alternative resolution providers. SB1119 Companion chatbots: children’s safety. SB361 Data brokers: data collection and deletion. AB1337 Information Practices Act of 1977.

Same topic in other states

Vermont H0211 An act relating to data brokers and personal information Maine LD1585 An Act To Increase Privacy and Security by Regulating the Use of Facial Surveill Connecticut SB1295 An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Idaho S1227 Adds to existing law to establish provisions regarding generative artificial int South Carolina H3431 South Carolina Social Media Regulation Act New Jersey A4015 "New Jersey Kids Code Act"; adopts New Jersey Age-Appropriate Design Code and re