|
Amended
IN
Assembly
April 23, 2026 |
CALIFORNIA LEGISLATURE—
2025–2026 REGULAR SESSION
Assembly Bill
No. 2169
| Introduced by Assembly Member Lowenthal |
February 18, 2026 |
An act to add Chapter 22.2.10 (commencing with Section 22589.10) to Division 8 of the Business and Professions Code, relating to personal information.
LEGISLATIVE COUNSEL'S DIGEST
AB 2169, as amended, Lowenthal.
Social media platforms: artificial intelligence models.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose to the consumer certain information about that personal information, including the categories of personal information it has collected about that consumer and the specific pieces of personal information it has collected about that consumer.
This bill, the Digital Choice Act, would require a social media company or a person that deploys an artificial intelligence model, makes an artificial
intelligence model available to a third party for use, modification, copying, or combination with other software, defined as a model operator, deployer, to allow a consumer to request a copy of the consumer’s personal information, contextual data, and social graph and would require the social media company or model operator deployer to respond to that request within five business days in a format that is, among other things, portable to the extent technically feasible. The bill would define “contextual data” to mean information provided by a user to an artificial intelligence model and any context or
derivative data associated with the user’s interactions with the artificial intelligence model, as specified, and any model-generated or inferred data linked to or generated from those interactions. The bill would define “social graph” to mean data that represents a person’s connections and interactions within a social media platform, as specified.
This bill would require, among other things, a social media company to implement a transparent, third-party-accessible interoperability interface that allows a user to choose to share a covered user’s social graph or user-selected parts of the social graph to a social media platform designated by the user and enable a third party to, with the user’s permission, access a social graph created by the user and be notified when a new or updated social graph is available, as prescribed. The bill would require a model operator
deployer to implement a third-party-accessible interoperability interface to allow a user to share the user’s contextual data directly with other artificial intelligence models as the user designates and enable those artificial intelligence models to be notified when new or updated data is available, as prescribed.
This bill would authorize the Attorney General to adopt specified regulations, as provided, and require the Attorney General to enforce the bill’s provisions by bringing an administrative action, as specified.
The people of the State of California do enact as follows:
SECTION 1.
Chapter 22.2.10 (commencing with Section 22589.10) is added to Division 8 of the Business and Professions Code, to read:CHAPTER 22.2.10. Digital Choice
22589.10.
This chapter shall be known as the Digital Choice Act.22589.11.
For purposes of this chapter:(a) “Artificial intelligence model” has the meaning defined in Section 22757.11.
(b) “Business” has the meaning defined in Section 1798.140 of the Civil Code.
(c) “Consumer” has the meaning defined in Section 1798.140 of the Civil Code.
(d) (1) “Contextual data” means information provided by a user to an artificial intelligence model and any context or derivative data associated with the user’s interactions with the artificial intelligence
model, including prompts, conversational histories, files, preferences, metadata, and any model-generated or inferred data linked to or generated from those interactions.
(2) “Contextual data” does not include a model operator’s deployer’s trade secrets.
(e) (1) “Model operator” means a person that deploys an artificial intelligence model, including under license or contract. “Deployer” means a person that makes an artificial intelligence model available to a third party for use, modification, copying, or combination with other software.
(2) “Model operator” “Deployer” does not include a person that interacts with artificial intelligence models solely through application programming interfaces, licensed services, prompting, or fine tuning.
(f) “Open protocol” means a publicly available set of rules that enables interoperability and data exchange between social media platforms or model operators
deployers by providing a common data infrastructure by which multiple social media platforms or model operators deployers
can access a user’s personal information that is free from licensing fees and patent restrictions.
(g) “Personal information” means any information that identifies or describes an individual.
(h) (1) “Social graph” means data that represents a person’s connections and interactions within a social media platform, including all of the following:
(A) The person’s social connections with other users users.
(B) Content created by the person.
(C) The person’s responses to other users’ content, including comments, reactions, mentions, reposts, shares, and other responses.
(D) Other users’ responses to the person’s content.
(E) Metadata associated with any of the items described in subparagraphs (A) to (D), inclusive.
(F) Relational references sufficient to maintain the associations among data elements in the items described in subparagraphs (A) to (E), inclusive.
(2) “Social graph” does not include another user’s or an entity’s content and responses that have been designated private by those users and entities, including private
messages.
(i) “Social media company” has the meaning defined in Section 22675.
(j) “Social media platform” has the meaning defined in Section 22675 of the Business and Professions Code.
22589.12.
(a) A social media company or(b) If a consumer requests a copy of the consumer’s personal information, contextual data, and social graph pursuant to subdivision (a), a social media company or model operator deployer
shall provide, within five business days, the consumer’s personal information, contextual data, and social graph in a format that is all of the following:
(1) Portable to the extent technically feasible.
(2) Readily usable to the extent practicable.
(3) In a form that allows the consumer to transmit the data to another social media platform or model operator deployer without impediment if the social media platform or model operator
deployer processes the data by automated means.
(c) At the request of a consumer, a social media company shall permanently delete a user’s personal information, including the user’s social graph, and relational references.
22589.13.
(a)(1) Share a covered user’s social graph or user-selected parts of the social graph to a social media platform designated by the user.
(2) Enable a third party to, with the user’s permission, access social graph created by the user
and be notified when a new or updated social graph is available.
(b) A model operator To the extent it is technically feasible, a deployer shall implement a third-party-accessible interoperability interface to allow a user to share the user’s contextual data directly with other artificial intelligence models as the user designates and enable those artificial intelligence models to be notified when new or updated data is available.
(c) To comply with subdivisions (a) and (b), and to the extent it is technically feasible, a social
media company or model operator deployer shall do all of the following:
(1) Utilize an open protocol.
(2) Facilitate and maintain interoperability and continuous, real-time data sharing with other social media platforms or artificial intelligence models through an interoperability interface based on reasonable terms that do not discriminate.
(3) Disclose to other social media companies or model operators
deployers complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.
(d) A social media company or model operator deployer shall reasonably secure a user’s personal information, contextual data, or social graph obtained through an interoperability interface.
(e) A business that accesses an interoperability interface shall take reasonable steps to meet platform integrity standards, including data security, data privacy, and abuse-mitigation practices necessary to preserve user protections and secure
any data it acquires, processes, or transmits.
(f) A social media company, model operator, deployer, or other controller shall not share or receive a user’s personal information, contextual data, or social graph through the interoperability interface without the user’s consent.
(g) A social media company or model operator deployer shall adopt an accessible, prominent, and persistent method for users to give consent for data sharing with
other social media platforms or model operators
deployers through the interoperability interface.
(h) This section does not require a social media company to do any of the following:
(1) Provide access to either of the following:
(A) Inferences, analyses, or derived data that the social media company has generated internally about a user.
(B) Proprietary algorithms, ranking systems, or other internal operating mechanisms.
(2) Transmit personal information, contextual data, or a social graph that is stored or structured in a proprietary format and with respect to that personal information, contextual data, or
social
graph, both of the following apply:
(A) An open, industry standard format is not reasonably available.
(B) Transmitting the personal information, contextual data, or social graph would disclose information described in paragraph (1).
(i) A business that uses an artificial intelligence model provided by a model operator deployer to provide an application or a service to a consumer shall promptly transmit a consumer’s request to the model operator
deployer with sufficient information for the model operator deployer to execute the request and communicate about the request with the consumer.
(j) A third-party-accessible interoperability interface shall not collect, retain, use, sell, share, or otherwise access consumer data transferred between social media platforms pursuant to this section.
22589.14.
(a) The Attorney General may adopt regulations to identify specific open protocols that the Attorney General has determined, after an assessment, meet the definition of “open protocol” listed in Section 22589.11.(b) If a social media company uses an open protocol that the Attorney General identifies under subdivision (a), the social media company shall be entitled to a rebuttable presumption that the social media company provides access on reasonable terms that do not discriminate.
22589.15.
(a) The Attorney General shall enforce this chapter.(b) A social media company or model operator deployer that violates this chapter shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation.
(c) In a proceeding brought pursuant to this chapter, the Attorney General may petition for appropriate
injunctive relief.