California SB 361 (2025) — Data Broker Disclosure of Sharing With Generative AI Developers
California · Cal. Civ. Code 1798.99.82 (SB 361, 2025)
This law expands what data brokers must reveal when they register each year with the California Privacy Protection Agency. Among the new disclosures, brokers must state whether, during the prior year, they sold or shared consumers' personal information with developers of generative AI systems. The aim is to give the public and regulators visibility into how personal data flows into AI training and development.
Technical detail
SB 361 amends Cal. Civ. Code 1798.99.82 to expand mandatory data broker registration disclosures to the CPPA, including whether the broker sold or shared consumers' personal information with developers of generative AI systems in the preceding year.
Who is protected: California consumers whose personal information is collected and traded by data brokers.
Who must comply: Data brokers required to register with the California Privacy Protection Agency.
Key facts
| Jurisdiction | California |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2026-01-01 |
| Enacted | 2025-10-08 |
| Citation | Cal. Civ. Code 1798.99.82 (SB 361, 2025) |
| Enforced by | California Privacy Protection Agency (CPPA). |
| Private right of action | No — agency enforcement only |
| Penalties | Failure to register can result in an administrative fine of up to $200 per day of noncompliance, plus fees due and the CPPA's enforcement costs. |
| Topics | consumer data privacy · AI disclosure and transparency |
| Last verified | 2026-06-16 |
| Official source | SB-361 Data brokers: data collection and deletion ↗ |
More AI rules in California
- CCPA/CPRA + ADMT Regulations · In effect
- AB 2013 (Training Data Transparency) · In effect
- SB 942 (AI Transparency Act) · Enacted (not yet in effect)
- SB 53 (Frontier AI Safety) · In effect
- AB 2839 (Election Deepfakes) · Blocked / in litigation
- AB 602 (Deepfake Intimate Images) · In effect
Related consumer data privacy rules elsewhere
- TAKE IT DOWN Act · In effect
- FCRA (AI in credit & background checks) · In effect
- COPPA + 2025 Rule (childrens data) · In effect
- TCPA (AI voice calls) · In effect
- DEFIANCE Act (deepfake-porn civil suits) · Proposed / pending
- BIPA · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.