California Agency Retreats on Bold AI Regulation Plans
Key highlights this week:
We’re tracking 977 bills in all 50 states related to AI during the 2025 legislative session.
Virginia enacted a law restricting AI decision-making in the criminal justice field.
Governors in Montana and New Jersey signed new deepfake bills into law.
And Kansas joined a handful of other states in banning the Chinese AI model DeepSeek from government devices.
Last Friday, the California Privacy Protection Agency (CPPA) considered proposed regulations on automated decision-making technology (ADMT), cybersecurity audits, and risk assessments, ultimately directing staff to revise the proposals in response to public comments. Board members called for some of the more aggressive regulatory proposals to be either narrowed in scope or deleted. While the agency signaled it remains committed to protecting consumer privacy, last week’s meeting shows a retreat on regulation due to industry pushback and a recognition of shifting political winds.
Last fall, we wrote about California’s attempts to regulate ADMT when the CPPA voted to initiate formal rulemaking. The proposed rules would require assessments to ensure ADMT works as intended and does not discriminate against protected classes. The rules would also require notice to consumers before ADMT is used with certain disclosures and a right to opt-out. The agency received industry pushback during the comment period, which influenced its decisions last week.
