Bus. & Prof. Code, § 22757.2

(a) A covered provider shall make available a disclosure verification tool at no cost to the user that meets all of the following criteria:

(1) The tool allows a user to assess whether image, video, or audio content, or content that is any combination thereof, was created or altered, except by minor modification, by the covered provider’s GenAI system.

(2) The tool outputs any system provenance data that is detected in the content.

(3) (A) Except as provided in subparagraph (B), the tool does not output any personal information that is detected in the content.

(B) The tool may output personal information that is detected in the content if the user to whom the personal information pertains expressly consents, clearly and conspicuously in plain language, to including personal information specified by the user in the content pursuant to a notice that does both of the following:

(i) Informs the user of the personal information that may be output by the tool.

(ii) Informs the user that once personal information is embedded into provenance data and exported, the information becomes part of the file’s permanent digital footprint and cannot be retracted from copies already in circulation.

(4) (A) Subject to subparagraph (B), the tool is publicly accessible.

(B) A covered provider may impose reasonable limitations on access to the tool to prevent, or respond to, demonstrable risks to the security or integrity of its GenAI system or to prevent misuse of the tool for malicious purposes.

(5) The tool allows a user to upload content or provide a uniform resource locator (URL) linking to online content.

(6) The tool supports technology, including an application programming interface, that allows a user to invoke the tool without visiting the covered provider’s internet website.

(b) A covered provider shall collect user feedback related to the efficacy of the covered provider’s AI disclosure verification tool and incorporate relevant feedback into any attempt to improve the efficacy of the tool.

(c) (1) Except as provided in paragraph (2), a covered provider shall not collect, use, retain, sell, share, or otherwise make available personal information derived either from a user of the covered provider’s AI disclosure verification tool or from any content processed by the disclosure verification tool beyond what is strictly necessary to comply with this chapter.

(2) A covered provider may collect, retain, or use personal information for the sole purpose of communicating with a user that opts into being contacted by the covered provider.

(d) A covered provider shall not make access to the covered provider’s GenAI system or disclosure verification tool contingent upon a user providing personal information beyond what is strictly necessary to comply with this chapter.

(e) A covered provider may satisfy the requirements of this section by directing a user to a third-party disclosure verification tool that is all of the following:

(1) In compliance with this section.

(2) Compatible with latent disclosures included in content produced or altered by the covered provider’s GenAI system.

(3) Clearly and conspicuously accessible through the user interface of the covered provider’s GenAI system.