PRIVACY FOR GenAI - 4986.10

(New: 02/2025)

 

Scope:

This Chapter of the GenAI Policy applies to all State Entities.

Policy:

A.  Privacy and Security

1. A State Entity using or procuring GenAI must protect the privacy and security of data in accordance with state and federal laws and policies.
2. A State Entity must implement measures to prevent unauthorized access, use, or sharing of confidential, proprietary, and sensitive state data used by GenAI.

A.  Privacy Disclosures 

For the transparency of the use of GenAI, irrespective of data classification, all GenAI which involves state data, or provides public service are required to notify consumers that they are interacting with GenAI as described below. 

1. All content created or substantially altered by GenAI must have a specified disclosure that the content is generated or substantially altered using GenAI.
2. A State Entity that provides content to a person for government services that was created or substantially altered by GenAI must ensure those communications include:
   1. A disclaimer before the use or consumption of GenAI indicating that the communication type outlined in the Government Code § 11549.66 was generated by GenAI.
      1. A disclaimer example: “This (image/audio/video/text/other form of data) has been generated, in whole or in part, using artificial intelligence.”
   2. A description of how the person may contact an employee of the state entity with appropriate contact information.
3. A provision to opt-out of communicating with GenAI and speak to a real person.
4. A State Entity ingesting data to train GenAI models from external sources, including customers and other systems (including GenAI), must disclose any data that is collected, processed, or shared with trusted partners to the data subject.

References:

Civil Code 1798.29; 1798.3; GC 11549.66