CA Bill To Protect Children's Data From AI Moves Forward

EAST BAY, CA — A bill by California state Assemblymember Rebecca Bauer-Kahan, D-Orinda, to protect children's data from being used for artificial intelligence passed the Assembly floor with a bipartisan, unanimous vote of 73- 0.

Assembly Bill 2877, approved Monday by the state's House of Representatives, amends the California Consumer Privacy Act of 2018 and California Privacy Rights then to prohibit businesses from using, sharing or selling the personal data of children 16 and younger to train AI tools without a parent's authorization.

"Our children need to be protected from exploitation," Bauer-Kahan said. "We cannot make the same mistakes we made allowing social media companies to prey on our children. AB 2877 restricts the use of children’s data in AI development, ensuring their highly sensitive information is not used without express consent."

If approved by the state Sentate and signed by the governor, AB 2877 would amend the California Consumer Privacy Act to prohibit a developer from collecting and using the personal information of consumers younger than 16 years to "train" an artificial intelligence system.

According to a legislative analysis of the bill, AI uses algorithms — sets of rules — to transform inputs into outputs. In order to function, AI tools first need to be trained. During this period of machine learning, an AI tool is exposed to data and allowed to explore its structure. Machine learning tools develop their algorithms automatically. The process of exposing a machine learning tool to data is known as "training."The algorithm that a machine learning tool develops during training is known as its "model."

The analysis states that just as humans cannot intentionally forget information they have learned, it is not currently possible to remove data from a trained AI tool. Unlike an Excel spreadsheet, which stores data in neat columns, AI tools store data in the connections between neurons in a deep neural network. Every connection is influenced by every piece of training data, and a large model like ChatGPT4 is reported to have more than 1.7 trillion connections. It is not possible to specifically alter these connections in order to remove data without fundamentally changing the model; as a result, for data to be removed, the model must be retrained from scratch.

ChatGPT-4 is estimated to have taken four to seven months to train in the first place. Any legislative efforts seeking to grant Californians a "right to be forgotten" by AI tools should consider targeting training data before it has been incorporated into a model, the analysis states.

This bill intends to do that for children. Specifically, it prohibits CCPA-covered-businesses that are the developers of AI tools from collecting and using the personal information of consumers younger than 16 to train AI tools without first obtaining express consent, and even with consent the data must be de-identified and aggregated.

Under the CCPA currently, the restrictions for the personal information of consumers under the age of 16 pertain to the selling and sharing of that information, not its collection and use.

"As AI becomes ever more present in our lives, we must be especially cautious about AI that
is designed to primarily interact with children," Bauer-Kahan said. "Businesses can use children's personal data to train AI without any safeguards and without the consent or even knowledge of the child or their parents. With AB 2877 I am committed to establishing rules around who can use
children's personal data to better protect vulnerable young people from businesses that use
their data to train AI systems."

AB 2877 takes a simple but important step in ensuring that data collection through AI training models is aligned with the California Privacy Protection Act, according to Danny Weiss, chief advocacy officers of Common Sense Media, the sponsor of the bill.

"The promises and perils of AI are becoming increasingly clear, with the use of a minor’s personal data presenting an especially urgent set of risks," Weiss said. "We are grateful for Assemblymember Bauer-Kahan's leadership on this bill that shows foresight in making sure California's strong data privacy law will also apply to AI products and services used by kids under 16."

The bill now heads to the California State Senate. If a majority of the Senate votes in favor of the legislation, it would head to the governor's desk for his stamp of approval.

"AB 2877 is sorely needed to ensure responsible AI development and uphold the fundamental rights of our youngest citizens," Bauer-Kahan said.