California Privacy Rights Act Expands Definition of Personal Information to Include Output by Artificial Intelligence

As artificial intelligence (AI) continues to revolutionize industries, concerns about data privacy are becoming increasingly critical, especially as AI systems increasingly rely on vast data sets often containing personal information. To combat this concern, California Governor Newsom signed AB 1008 on September 28, 2024, which went into effect on January 1, 2025, and  expands the definition of personal information under the California Privacy Rights Act (CPRA) to include a wide array of formats, including AI models. Thus, it broadens the scope of privacy protections to data utilized by automated systems and machine learning models or large language models. This will impose new requirements on businesses using AI, significantly altering the governance and management of AI models, particularly those trained on personal information. Even if personal information is collected from public sources, such data remains protected under the CPRA, requiring businesses to comply with privacy regulations, including obtaining consent and respecting consumers’ data rights.