AB 1008 is a significant development in the evolving landscape of AI regulation. It marks a crucial step towards ensuring that AI systems are developed and deployed in a manner that respects and protects the privacy of Californians. The bill’s impact will be felt across various sectors, from healthcare to finance, and its implications for the future of AI are far-reaching. The bill’s core principle is to address the growing concern about the use of personal data in AI models.

This is a complex issue with no easy answers. The California Consumer Privacy Act (CCPA) already grants consumers certain rights regarding their personal information. However, the CCPA does not explicitly address the use of LLMs trained on personal information. The question of whether an LLM trained on personal information contains personal information is a key factor in determining the scope of consumer privacy rights.

This shift in focus from training to post-training compliance is a significant change in the landscape of AI privacy law. The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are the primary legal frameworks governing privacy in California. The CCPA, enacted in 2018, grants consumers certain rights regarding their personal information, including the right to know, the right to delete, and the right to opt out of the sale of their personal information.