California AB 1170, SEC. 27-28 (CCPA Amendment 2025)

• Authority: California
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2025-07-28

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• AI pursuing its own goals
• Lack of capability or robustness
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of risk domains, with primary focus on privacy compromise (2.1) through definitions of personal information and data processing. It addresses automated decision-making and profiling (7.1, 7.3) through regulatory requirements. Coverage is concentrated in privacy/security and system safety domains, with limited explicit coverage of other risk categories.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Educational Services
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

This is a cross-sectoral privacy regulation that applies to all businesses operating in California that meet specified thresholds for revenue, data volume, or data-derived revenue. The regulation governs automated processing and profiling across all economic sectors where businesses collect and process consumer personal information. No specific sectors are exclusively targeted; rather, the law applies horizontally to any qualifying business regardless of industry.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding California state statute (AB 1170) amending the California Civil Code with mandatory obligations, enforcement mechanisms through the California Privacy Protection Agency and Attorney General, and legal penalties for non-compliance.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: California State Legislature; THE PEOPLE OF THE STATE OF CALIFORNIA
• Summary: The document is a California state legislative act (AB 1170) enacted by the California legislature, as indicated by the formal enactment language and legislative structure.

Target

• Entity Types: AI_Developer, AI_Deployer
• Entities: businesses; service providers; contractors
• Summary: The document applies to businesses that collect and process consumer personal information, including through automated processing and profiling. It specifically targets entities that meet threshold criteria for revenue, data volume, or data-derived revenue.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Attorney General; California Privacy Protection Agency
• Summary: The document explicitly assigns enforcement authority to the Attorney General and the California Privacy Protection Agency, with the latter assuming primary regulatory authority after July 1, 2021.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: California Privacy Protection Agency; Attorney General
• Summary: The California Privacy Protection Agency is assigned monitoring and oversight responsibilities, including receiving risk assessments and cybersecurity audits from businesses. The document also establishes audit authority for the agency.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor stages through requirements for automated decision-making systems, profiling, and ongoing risk assessments. It implicitly covers Build and Use Model through definitions of automated processing and profiling. The focus is on post-deployment governance, consumer rights, and ongoing monitoring rather than early-stage development.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions automated processing and profiling as forms of AI systems. It does not use terms like 'AI models,' 'AI systems,' 'frontier AI,' 'general purpose AI,' or 'foundation models.' There are no compute thresholds mentioned. The focus is on automated decision-making technology and profiling rather than specific AI model categories.