Binding law — in force
CCPA deletion and right-to-know requests reach AI systems that can output the consumer's personal information (California AB 1008)
Since 2025-01-01, CCPA personal information can exist in abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information (Cal. Civ. Code 1798.140(v)(4), added by AB 1008, Stats. 2024, ch. 802). A business that receives a verifiable consumer request to delete must delete the consumer's personal information from its records, including those formats, and notify its service providers, contractors and the third parties it sold or shared it with (1798.105(a), (c)), subject to the exceptions of 1798.105(d); a request to know reaches the specific pieces of personal information collected about the consumer in the same formats (1798.110(a)-(b)). Detect deletion handlers that skip embeddings, vector stores, chat history, agent memory and provider-held files.
ca-ab1008.consumer-requests-reach-ai-systems · Cal. Civ. Code 1798.140(v)(4) · official source · jurisdictions: US-CA