California AI Transparency Act

This section establishes the foundational terms that define who and what the law applies to. A 'covered provider' is any entity that creates or produces a generative AI system used by over one million monthly visitors or users, setting a clear threshold for applicability to major platforms. This means smaller developers or systems with limited reach are generally exempt from these specific requirements.

The law defines a 'generative artificial intelligence system' as AI capable of creating synthetic content like text, images, video, or audio. Crucially, it distinguishes between 'manifest disclosure,' which refers to visible, human-readable labels on AI-generated content, and 'latent disclosure,' which means embedded, machine-readable metadata that persists with the content. Understanding these distinctions is vital for compliance, as the law mandates both types of transparency.

Covered providers are required to offer free, publicly accessible tools that can assess whether content was created or significantly altered by their specific generative AI systems. This provision aims to empower users, platforms, and researchers to verify the origin of synthetic content, helping to combat misinformation and deepfakes.

The detection tools must be capable of identifying content generated by the provider's *own* AI models, not just any AI-generated content. This places a direct responsibility on providers to develop or integrate robust detection capabilities specific to their technology. The goal is to provide a mechanism for external parties to confirm if a piece of media originated from a particular large generative AI system.

This provision mandates that all AI-generated content must embed invisible, machine-readable metadata, known as latent disclosures. This metadata must include essential information such as the provider's name, the generative AI system's name and version, a timestamp of creation, and a unique identifier for the content. The critical aspect here is that this metadata must be designed to persist even when the content is shared, modified, or undergoes common transformations like compression or format conversion.

The intent is to create a permanent digital fingerprint for AI-generated media, allowing its synthetic origin to be traced and verified regardless of how it is distributed or altered. This 'system provenance data' is distinct from 'personal provenance data,' which identifies individuals, and is subject to different privacy considerations.

In addition to invisible metadata, covered providers must offer users the option to include clear, conspicuous, and human-readable labels that identify content as AI-generated. These 'manifest disclosures' must be appropriate for the specific medium—whether it's text, images, video, or audio—and easily understandable to a reasonable person.

The goal is to provide immediate, visible cues to consumers that the content they are engaging with is synthetic. This empowers users to make informed decisions about the authenticity and origin of information, complementing the machine-readable latent disclosures. Providers must design user interfaces that make these labeling options accessible and effective without being overly intrusive.

This provision emphasizes the importance of privacy in the implementation of AI transparency measures. It mandates that detection tools must not retain personal information from users beyond what is strictly necessary for their operation. This ensures that while content origin is verifiable, user privacy is not compromised.

Furthermore, the law requires a clear distinction between 'system provenance data' (technical metadata about the AI system) and 'personal provenance data' (information that identifies an individual or their device). Any handling of personal provenance data would trigger enhanced privacy protections, likely aligning with existing California privacy laws like the CCPA and CPRA. This ensures that the pursuit of transparency does not inadvertently lead to new privacy risks for individuals.

This provision extends transparency obligations beyond the direct provider to entities that license generative AI technology. Covered providers must ensure that their licensing agreements with third parties contractually require these licensees to maintain the mandated disclosure capabilities—both manifest and latent. This means licensees cannot disable or remove the transparency features built into the AI system.

Furthermore, if a provider discovers that a licensee has modified the technology in a way that disables these disclosure capabilities, the provider is obligated to revoke the license within 96 hours. This creates a strong incentive for both providers to monitor their licensed technology and for licensees to comply with the transparency requirements, ensuring that the integrity of AI-generated content is maintained throughout its distribution chain.

This provision specifically addresses the technical resilience of latent (invisible) disclosures. It mandates that these embedded metadata elements must be designed to be either permanent or extremely difficult to remove. This requirement is crucial because AI-generated content often undergoes various transformations as it is shared and distributed across different platforms and applications.

The disclosures must be able to survive common content manipulations such as compression, format conversion, cropping, and even screenshot capture. The intent is to prevent malicious actors from easily stripping away the provenance data, thereby ensuring that the synthetic nature of the content remains verifiable throughout its lifecycle. This places a significant technical challenge on providers to implement highly robust embedding techniques.

To facilitate broader and more efficient verification of AI-generated content, SB 942 requires that the mandated detection tools provide API (Application Programming Interface) access. This means that in addition to a public-facing website or application, the detection capabilities must be programmatically accessible.

API access enables other platforms, researchers, journalists, and automated systems to integrate the detection functionality directly into their own workflows. This supports large-scale content verification, automated monitoring, and the development of third-party tools that can leverage the provider's detection capabilities. It moves beyond manual, one-off checks to enable systemic detection across the digital ecosystem.

This provision mandates that covered providers must implement mechanisms to collect user feedback on the accuracy and performance of their AI detection tools. Furthermore, providers are required to actively use this feedback to continuously improve their detection capabilities over time.

This requirement acknowledges that AI detection technology is constantly evolving and that real-world usage can reveal limitations or areas for enhancement. By integrating user feedback into the development cycle, the law aims to foster a dynamic and responsive approach to AI transparency, ensuring that detection tools remain effective and reliable as generative AI systems become more sophisticated.

SB 942 establishes significant civil penalties for violations, designed to create strong financial incentives for compliance. Each violation carries a penalty of $5,000, and critically, 'each day of violation constitutes a separate offense.' This means that ongoing non-compliance can quickly accumulate substantial fines, potentially reaching millions of dollars for extended periods of non-adherence.

Enforcement authority is distributed among the California Attorney General, city attorneys, and county counsel, allowing for multiple pathways for legal action. Prevailing government plaintiffs are also entitled to recover reasonable attorney's fees and costs. While there is no private right of action for individuals, the law does allow for injunctive relief actions against third-party licensees who disable disclosure capabilities, providing equitable remedies beyond monetary penalties. Appeals follow standard California civil procedure.