California · Assembly Bill · 2023–2024 Regular Session
AB2877
Assembly Bill No. 2877 — An act to add Section 1798.199.41 to the Civil Code, relating to privacy

Status ● Failed Effective N/A Passage Likelihood N/A

WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE

How Is This Bill Enforced

Enforcement Authority
Enforcement by the California Privacy Protection Agency (CPPA). No private right of action created by this section.
Private Right of Action
No private right of action. Enforcement is exclusive to the designated authority.
Penalties
The bill does not specify independent penalties. Enforcement is vested in the CPPA, which has existing administrative penalty authority under the CCPA framework (up to $2,500 per violation or $7,500 per intentional violation). No private right of action or independent damages provision is created by this section.

What This Bill Requires

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text
Analysis & Obligations
Civ. Code § 1798.199.41
Prohibition on using minors' sensitive personal information for AI training
Developer

(a)(1)–(3) For purposes of this section, the following definitions shall apply: (1) "Artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs that can influence physical or virtual environments.Civ. Code § 1798.199.41(a)(1)" means an engineered or machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs that can influence physical or virtual environments. (2) "DeveloperDeveloper"Developer" means a person, partnership, state or local government agency, or corporation that designs, codes, or produces an automated decision tool, or substantially modifies an artificial intelligence system or service for the intended purpose of making, or being a controlling factor in making, consequential decisions, whether for its own use or for use by a third party.Civ. Code § 1798.199.41(a)(2)" means a person, partnership, state or local government agency, or corporation that designs, codes, or produces an automated decision tool, or substantially modifies an artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs that can influence physical or virtual environments.Civ. Code § 1798.199.41(a)(1) system or service for the intended purpose of making, or being a controlling factor in making, consequential decisions, whether for its own use or for use by a third party. (3) "MinorMinor"Minor" means a natural person under 18 years of age.Civ. Code § 1798.199.41(a)(3)" means a natural person under 18 years of age.

(b) 1 A developerDeveloper"Developer" means a person, partnership, state or local government agency, or corporation that designs, codes, or produces an automated decision tool, or substantially modifies an artificial intelligence system or service for the intended purpose of making, or being a controlling factor in making, consequential decisions, whether for its own use or for use by a third party.Civ. Code § 1798.199.41(a)(2) shall not use a minorMinor"Minor" means a natural person under 18 years of age.Civ. Code § 1798.199.41(a)(3)'s sensitive personal information to train an artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs that can influence physical or virtual environments.Civ. Code § 1798.199.41(a)(1) system or service.

(c) This section shall be enforced by the agency.

This section establishes a categorical prohibition against developers using minors' sensitive personal information to train artificial intelligence systems or services. The term "sensitive personal information" is not independently defined here — it inherits its meaning from the existing CCPA definition at Civil Code § 1798.140(ae). The prohibition is absolute: no consent mechanism, business justification, or opt-out procedure is offered as an alternative.

The definition of developer is notably broad, encompassing not only private entities but also state and local government agencies, and extending to those who "substantially modify" AI systems — a scope that reaches well beyond original model creators. Enforcement is vested exclusively in the California Privacy Protection Agency, with no private right of action created.

Compliance actions 1 item
1
DevelopersDeveloper"Developer" means a person, partnership, state or local government agency, or corporation that designs, codes, or produces an automated decision tool, or substantially modifies an artificial intelligence system or service for the intended purpose of making, or being a controlling factor in making, consequential decisions, whether for its own use or for use by a third party.Civ. Code § 1798.199.41(a)(2) must not use a minorMinor"Minor" means a natural person under 18 years of age.Civ. Code § 1798.199.41(a)(3)'s sensitive personal information to train an artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs that can influence physical or virtual environments.Civ. Code § 1798.199.41(a)(1) system or service.
D-01.5
SEC. 2 (Legislative Findings)
Legislative findings — California Privacy Rights Act of 2020

The Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.

This section contains the required legislative finding that the bill furthers the purposes and intent of the California Privacy Rights Act of 2020 (Proposition 24). This finding is a procedural prerequisite under the CPRA, which authorizes the Legislature to amend the act only by majority vote and only to further the act's purposes and intent. The provision creates no independent compliance obligation.

Passage Likelihood

Failed
Status Failed
Final action In committee: Held under submission.

Legislative History

2024-02-15 Read first time. To print.
2024-02-16 From printer. May be heard in committee March 17.
2024-03-04 Referred to Com. on P. & C.P.
2024-04-18 From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended.
2024-04-22 Re-referred to Com. on P. & C.P.
2024-04-29 From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 11. Noes 0.) (April 23).
2024-04-30 Read second time and amended.
2024-05-01 Re-referred to Com. on APPR.
2024-05-08 From committee: Do pass. (Ayes 15. Noes 0.) (May 8).
2024-05-09 Read second time. Ordered to third reading.
2024-05-20 Read third time. Passed. Ordered to the Senate. (Ayes 73. Noes 0. Page 5319.)
2024-05-21 In Senate. Read first time. To Com. on RLS. for assignment.
2024-05-29 Referred to Com. on JUD.
2024-06-17 From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on JUD.
2024-06-26 From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 11. Noes 0.) (June 25).
2024-06-27 Read second time and amended. Re-referred to Com. on APPR.
2024-08-05 In committee: Referred to APPR suspense file.
2024-08-15 In committee: Held under submission.

Entry Last Reviewed

2026-05-16
AI generated