California AB 1008 amends the California Consumer Privacy Act to clarify that personal information is still personal information regardless of format, including when it exists inside AI systems that are capable of outputting it. The law has been in effect since January 1, 2025.
What California AB 1008 Clarifies
The statute lists physical formats, digital formats, and abstract digital formats such as compressed or encrypted files and AI models. In other words, data does not lose its protected status just because it has been transformed, embedded, or absorbed into a model.
The Practical Effect for AI Companies
Companies cannot argue that personal data absorbed into an AI model falls outside the CCPA. Businesses training or deploying AI on consumer data owe those consumers the full set of CCPA rights, including deletion and access.
For any company building on consumer data in California, that means privacy compliance now reaches into the model itself, not just the databases that feed it. Data governance and AI development can no longer be treated as separate compliance tracks.
Source: California Legislative Information: AB 1008
Report a violation: If you believe a business is violating this law, you can file a complaint with the California Attorney General Consumer Protection.
