By Scott Hall 

Businesses can no longer wait to take AI compliance seriously. While there is still no federal AI statute, more than 60 state laws now regulate various aspects of commercial AI, and there is already substantial litigation involving business use of AI tools, largely brought under privacy, wiretap, and biometric statutes that predate the technology by decades. The good news for businesses is that most of what these new AI regimes require is familiar: inventory, notice, consent, vendor terms, retention limits, and human review.

If your business has not evaluated its own AI compliance, both in terms of the tools used internally and any products, services, or tools deployed as part of its business operations, now is the time to do so.

1. Laws to Know

Federal

Recent federal policy has moved toward light-touch AI regulation and a single national framework. The current administration is challenging state AI laws and pressing Congress to preempt them, but that effort has not yet displaced any state laws. Taking a lesson from privacy law, businesses should not take a wait-and-see approach in reliance on a future federal AI regime or preemption that may never happen. For now, companies should make plans to comply with state AI and privacy laws and rules that apply to their products, users, and data.

Notably, the FTC can act under Section 5 of the FTC Act even when no AI-specific statute applies. Businesses can face enforcement for undisclosed or misleading AI practices, including sharing user data with outside AI developers in a way its privacy disclosures do not explain.

States–Four Primary Areas of Legislation

• Chatbots—the most active area of AI lawmaking. California, New York, Connecticut, Colorado, Washington, and several other states have adopted chatbot laws and rules. The details vary, but three obligations are common: (1) disclose when a user is interacting with AI, (2) maintain protocols to detect and respond to self-harm concerns, and (3) protect minors.Coverage turns on how a state defines a chatbot. Some rules reach ordinary customer-service bots, while others focus on companion systems that simulate relationships or remember prior interactions. These laws generally apply based on where your users are located, not where you are incorporated, so a nationwide chatbot should be built to the strictest applicable standard.
• Automated decisions about people. New AI laws and rules are focusing on significant decisions made by AI or automated means. If AI helps decide who gets hired, fired, admitted, housed, insured, or provided services, the company using it should be prepared to disclose the use, explain the decision process, and document testing and oversight. Where states are splitting is the threshold question: how much AI involvement triggers those duties.California’s CCPA rules reach technology that replaces or substantially replaces human decisionmaking, meaning the output is used without meaningful human involvement. A reviewer who understands the output, weighs other relevant information, and has authority to change the result keeps the use outside the rules. Rubber-stamping does not.Colorado’s proposed SB 26-189 sets a broader trigger: AI that materially influences a consequential decision in seven areas including employment, housing, lending, insurance, and healthcare. The proposed law would also require notice after an adverse outcome and let individuals correct the underlying data and seek human reconsideration. The statute does not define “materially influences,” and the Attorney General has asked for comment on competing standards.The practical consequence: keeping a human in the loop may take you outside some state laws but not others. Inventory where AI informs decisions about people, not only where it makes them on its own.

• Sectoral laws, content regulation, and AI-as-privacy. Specific review of AI laws based on industry sector is important, as states continue to regulate AI more restrictively in contexts such as healthcare, employment, and insurance, requiring express notice and consent and restricting uses in various contexts. States are also regulating AI content, including restricting deepfakes, digital replicas, and AI use in election contexts. And many states, including California, continue to regulate many aspects of AI as part of privacy law compliance.
• Developer and frontier-model laws. Finally, we continue to see state laws governing large-scale AI systems. California, New York, and Illinois are imposing safety frameworks, incident reporting, and independent review requirements on developers of powerful frontier AI systems. And while this may not apply to most businesses, everyone who deploys or uses large AI models should monitor these trends.

California-Specific Laws

The CPPA’s rules on automated decisionmaking technology (ADMT) and privacy risk assessments create the clearest near-term deadlines for AI compliance for many businesses:

• ADMT—January 1, 2027. If you use automated technology to make or materially influence significant decisions about California residents (employment, lending, housing, education, healthcare, or essential services), you need published pre-use notices, working opt-out and access workflows, and an explanation of the logic and effects. Employees, applicants, and contractors are included beyond commercial consumers.
• Risk assessments—underway since January 1, 2026. As of now, businesses subject to the CCPA must conduct risk assessments for high-risk processing activities and must submit attestations and summaries to the CPPA by April 1, 2028. High-risk processing includes ADMT uses.

California’s Legislature closed its 2026 session with a package of AI and privacy measures, including several laws aimed at regulating business/employer use of AI:

• SB 947—Bars sole reliance on automated systems for employee discipline or termination; requires human corroboration, post-use notice, and employee data access. Operative July 1, 2027.
• SB 951—Amends Cal/WARN to require additional disclosures when layoffs are caused substantially by AI or automation.
• AB 1883—Categorically prohibits employer use of AI tools to infer emotional states or collect neural data, with no wellness-program exception.
• AB 1331—Prohibits workplace surveillance tools in restrooms.
• Other measures include SB 923 (expanded deletion rights), AB 1609 (chatbot disclosures), and additional rules on data sharing and professional AI use.

The EU AI Act

If your business offers AI-enabled products or services to people in the EU, the EU AI Act can reach you without an EU entity. The EU AI Act applies based on where a system is placed on the market or where its output is used. Compliance obligations scale with risk, and the heaviest requirements fall on “high-risk” uses, which for most US companies means hiring and HR screening tools, credit decisions, and education or admissions systems.

2. Litigation and AI Tool Trends

AI notetakers are a current hot spot. If your company uses an AI notetaker, treat the tool as more than a transcription service. In August 2026, a California court allowed claims against Otter.ai to proceed after plaintiffs alleged that its speaker-tagging feature created voice profiles without the required consent. The same theory has been asserted against other tools, including one tool that took notes without visibly joining the meeting. Before deployment, confirm what data or inputs the tool/vendor records, how long it keeps the data, and whether it uses it for anything beyond providing the service. If so, a court may view it as a separate party and not merely your service provider, and thus subject to heightened notice and consent obligations.

Exposure is not limited to the AI tool/vendor. A company that deploys the tool may also be named, particularly if it helped decide how recordings or voice data were collected, used, or retained. Illinois’s BIPA allows private suits and statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, or actual damages if greater. Recent class actions involving voiceprints from public recordings show how quickly these theories can spread. Speaker identification, voice authentication, and emotion detection are all risk areas.

Chatbots and website tracking. Claims under California’s CIPA involving website chat functions, session replay, and tracking pixels continue to increase and provide statutory damages of $5,000 per violation with no proof of harm required. California’s SB 690 would limit some pen-register and trap-and-trace claims involving websites and apps, but it does not eliminate the broader litigation risk under wiretapping/electronic communication legal theories.

Employment. Using a well-known AI hiring tool or vendor does not shield an employer from discrimination claims. AI screening tools used on an employer’s behalf can expose the employer to liability. Businesses using these tools should run bias audits through counsel where appropriate, and document the scope, methodology, and results.

AI-driven pricing. Dynamic pricing, which involves adjusting prices based on supply, demand, time of day, or competitor pricing, is a long-established business practice, and AI generally makes it faster and more efficient. But risk arises when a system uses personal consumer data, such as browsing behavior, purchase history, location, income proxies, or demographic information, to estimate an individual’s willingness to pay and set a price accordingly. That is personalized, or “surveillance,” pricing.

In August 2026, the FTC proposed an enforcement policy statement making these practices a key focus. Its position is that a business using consumer data to personalize prices should clearly disclose that the price is personalized, the basis for the personalization, and the types of data used; failing to do so may violate Section 5 as deceptive or unfair.

State consumer-protection statutes, privacy laws, and emerging state personalized-pricing legislation create additional risk, and models trained on historical data may produce prices that correlate with race, income, age, or other protected characteristics, creating civil-rights liability even without discriminatory intent. For business clients, the practical line is straightforward: dynamic pricing based on market conditions is generally permissible; personalizing prices from individual consumer data without disclosure is where the legal risk sits. If your business uses AI in pricing, review what data feeds the model and whether consumers know about it.

AI in Litigation and Discovery

Courts are treating AI prompts and outputs as ordinary business records rather than a protected category. For business teams, that means assuming employee chats, meeting transcripts, and AI tool logs may be requested in litigation.

• Prompts entered into public AI tools are generally not confidential. Asking a chatbot a legal question does not create an attorney-client communication, and using a consumer-grade tool undercuts any later claim that the exchange was privileged.
• Employee prompts can become evidence against the company. Courts have relied on chatbot conversations to establish what decision-makers were actually thinking, including where the stated business rationale differed from the exchange.
• Deleting AI logs creates a second problem. Once litigation is reasonably anticipated, AI records carry the same preservation obligations as email, and destroying them invites spoliation arguments on top of whatever the underlying dispute is.
• Work product protection may survive when counsel directs the use. Where an attorney structures the prompts or supervises the work, protection is more likely — but the law is unsettled, and the conservative assumption is that prompts, outputs, transcripts, and logs are discoverable unless counsel has directed otherwise.
• Update preservation infrastructure now. Litigation holds, custodian interviews, and discovery templates should expressly cover AI prompts and outputs, meeting transcripts and summaries, and related metadata — categories most existing templates do not name.
• Recording expands the record. Every AI-generated transcript or summary is a new discoverable document, and one that may not match the formal minutes of the same meeting.

Regulators are Active

State attorneys general are leading AI enforcement by using consumer-protection, civil-rights, and privacy laws that already exist. A coalition of AGs recently warned major AI companies about harmful outputs, and individual states have pursued chatbot operators and AI developers through investigations, injunctions, criminal referrals, and new legislation. Businesses should take note that regulators do not need to wait for AI-specific statutes before acting. They are adapting current laws to these new technologies.

3. Internal AI Use: Risks and Safeguards

Businesses should start from the assumption that AI is already in your workplace. Global survey data puts regular, intentional AI use at roughly three in five workers, and vendors are enabling AI features inside software you already license, sometimes without explicit notice. It is unlikely any business can still represent that they do not use AI, and broad AI tool bans are no longer practical.

Adopt a policy, but do not impose a ban. Prohibition on use of AI tools drives AI use underground, where it cannot be supervised. A workable policy identifies approved and prohibited tools and uses, states what may never be entered into an AI tool, addresses confidentiality and privacy, requires verification, assigns accountability for final work product, and explains consequences. Without a policy, every employee sets their own rules, with many using AI quietly and never disclosing it. Businesses should take a practical approach and reasonably regulate internal AI use. AI policy updates and employee trainings should be expected regularly as AI tools and the legal landscape continue to evolve rapidly.

Watch for AI tools that act, not just advise. Agentic AI systems can approve transactions, send communications, screen applicants, manage workflows, or make decisions with limited human involvement. These tools are arriving quickly, often embedded in software businesses already use, and the compliance stakes rise when the system acts rather than merely provides information. Inventory where AI is taking actions and ensure that appropriate human oversight and audit trails scale with the tool’s level of autonomy.

Use enterprise tools, not free or consumer accounts. Businesses should contract for closed AI systems that prohibit vendor retention, training on your data, and third-party disclosure. The gap between a company’s enterprise account and an employee’s personal free account now has real, legal consequences. Policies should make the distinction explicit and enforce it.

Make a deliberate decision about meeting assistants. We previously addressed these tools here, but the information bears mentioning again. Treat these tools as communications-capture tools rather than productivity :

• Designate meetings where they are never permitted—privileged advice, investigations, HR and accommodation discussions, board deliberations, transactions, and anything involving client-confidential, patient, or applicant information.
• Provide participant-facing notice and capture consent, keeping in mind all-party consent states and external participants who never agreed to your vendor’s terms.
• Disable speaker identification where a plain transcript will suffice. That setting is often the difference between a transcript and a biometric identifier.
• Confirm that administrators can set defaults centrally instead of leaving recording, sharing, and training settings to individual users.
• Reconcile AI summaries against formal minutes. Discrepancies get scrutinized, and verbatim transcripts preserve offhand remarks that curated minutes would omit.

Set retention and deletion rules. Don’t just let AI tool data sit in your systems. Set retention rules and deletion schedules for each category of data these tools generate, including the audio, transcripts and summaries, voice profiles, associated metadata, downloaded exports, and copies that linger in CRM or collaboration systems even after the original is deleted.

Maintain human oversight for important AI-generated output. Several new laws now require it, and many business contracts are now demanding it.

4. Three Priorities Before January 1, 2027

1. Build your AI inventory. You cannot govern what you have not mapped. Document every AI tool, system, and AI-enabled feature in use, as well as the data it touches, and the risk tier.
2. Map your exposure. Based on your AI inventory, identify applicable laws and legal requirements. California’s ADMT compliance, Colorado’s replacement automated-decision law, new state chatbot requirements, and many other laws are going into effect January 1, 2027, and many other laws are already in effect.
3. Name one accountable owner. When legal, HR, security, and the IT function each hold a piece of ownership, the seams between them are where problems go unnoticed. A single senior executive with a clear escalation path closes those seams.

The Bottom Line

AI can no longer be ignored. Whether or not your company has formally adopted it, AI is almost certainly already in use—in tools your employees chose, and in features your vendors switched on without asking. The starting point is not a policy. It is a set of questions every business should be able to answer:

• What AI are we using, including features enabled by default in software we already license?
• Have we disclosed that use to the people it affects—customers, employees, applicants, and meeting participants?
• What do our AI vendors do with our data, and can we turn it off?
• How long do we keep AI-generated content, and can we delete it when we need to?
• Who inside the business owns AI compliance and has authority to act?

Few companies can answer all five questions today. The ones that can will find most new obligations are variations on work they have already done—and the ones that cannot will likely discover the gaps through a regulator’s inquiry or a plaintiff’s discovery request. Ensuring your business can answer these questions now will put you in a good position to deal with the continuing evolution of AI laws and regulations.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

 

 

 

 

Navigating the Evolving Legal Landscape of Data Privacy, Cybersecurity, and AI

By Scott Hall, Phillip Wiese, Meaghan Henderson, Katie Berens, Kat Gianelli, and Dillon Ostlund

Download a PDF version of this report here.

For businesses, the rules governing AI and personal information are being rewritten in real time, and the cost of falling behind has never been higher. AI touches nearly every aspect of daily life and has become near ubiquitous in businesses across the country. At the same time, consumers are becoming increasingly savvy about their individual privacy rights, demanding more information and stronger protections from the businesses to which they provide personal information. Reflecting the importance of these two issues, states are rapidly enacting, updating, and amending their privacy and AI laws. There are now 24 states with comprehensive consumer privacy laws, with piecemeal, topic- or industry-specific privacy and AI laws popping up across the country as well.

Children’s data and other sensitive data collection and use are particular areas of concern and focus. The federal government continues to weigh federal legislation, but has not, to date, passed any federal laws on either AI or privacy, leaving enforcement largely to the states and their patchwork of requirements.

Adding to the complexity, courts and regulators are applying decades-old statutes to new technologies, and regulators and private plaintiffs are more active than ever in examining and testing the bounds of privacy laws and consumer privacy rights. The result is a legal landscape more complex than ever before. What are businesses to do? How do businesses keep up with the ever-changing legal landscape?

Our 2026 Fall Privacy Report untangles the web of recent AI and privacy laws and provides concrete takeaways to help businesses navigate this landscape. View the full report here.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

Jennifer Scharre co-authored “Proposition 40: California Billionaires in the Crosshairs” which was published in the California Trusts & Estates Quarterly. The article discusses Proposition 40, the “One-Time Wealth Tax for State-Funded Healthcare, Education, and Food Assistance Programs Initiative,” also known as the 2026 Billionaire Tax Act (the “Act”) and potential implications of the tax for taxpayers with the text of the Act as a guide. The full article is linked here.

Coblentz special counsel Phillip Wiese presented “Navigating CA’s Newest Consumer Privacy Act Requirements: What Businesses Need to Know About Mandatory CCPA Risk Assessments and Cybersecurity Audits” during the Bar Association of San Francisco’s AI, Cybersecurity, and Privacy Section Conference on October 15, 2026. Phil and his co-panelists discussed the new requirements and steps companies can take to prepare an effective compliance program.

Key Takeaways 

Key Deadlines: Risk assessment obligations began January 1, 2026, with initial reporting to CalPrivacy due April 1, 2028. Cybersecurity audit deadlines are phased in beginning in 2028.

High-Risk Processing: Businesses must conduct risk assessments before undertaking certain activities with a “significant risk” to consumer privacy, including selling or sharing personal information, processing sensitive personal information, and using certain automated decision-making technologies.

Meaningful Risk Evaluations: Risk assessments must evaluate the benefits and potential privacy harms of covered processing activities—not simply check compliance boxes.

18 Cybersecurity Focus Areas: Required audits examine key safeguards, including access controls, encryption, vulnerability management, incident response, and third-party oversight.

Auditor Independence: Cybersecurity audits must be conducted by qualified, independent auditors, whether internal or external.

Start Preparing Now: Businesses should assess applicability, identify gaps, establish risk assessment procedures, and develop remediation plans well before applicable deadlines.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com or Phillip Wiese at pwiese@coblentzlaw.com for further information or assistance.

By Lindsay Gehman and Saachi S. Gorinstein

Our June 2026 article “AI, Influencers, and Liability: What Marketing Agencies Need to Know Before Deploying AI Tools,” surveyed the legal risks organizations face when they use or develop GenAI, including risks under consumer fraud and unfair and deceptive acts and practices (UDAP) laws and under state rights of publicity.

Since then, the legal landscape for AI-generated marketing content has changed considerably. Federal enforcement priorities have shifted, a federal executive order has targeted state AI regulation, New York has adopted the first state law requiring disclosure of AI-generated performers in advertising, digital replica protections have expanded in several states, and the EU AI Act’s transparency obligations now apply.

This article updates and expands the earlier discussion as it applies to advertising and endorsements. It focuses on the rules most relevant to brands, marketing agencies, and influencers that use GenAI to create or modify marketing content, including more details on federal endorsement and review rules.

GenAI is used in influencer marketing in three principal ways:

• AI-assisted real influencers. A real influencer remains the speaker and source of the endorsement, while GenAI helps draft, edit, translate, or produce the content.
• AI replicas of real influencers. AI creates content depicting an identifiable real person saying or doing something the person did not actually record, such as through voice cloning, digital replicas, or synthetic video.
• Fully synthetic influencers. AI creates a fictional persona, sometimes with a realistic appearance, voice, and social media presence, that does not correspond to any real person.

This article sets out the legal framework that applies across all three categories.

A recurring question runs through that framework: when must consumers be told that AI was used? There is currently no general federal rule requiring disclosure solely because AI was used to create or edit advertising content. However, existing consumer protection law applies regardless of whether content is created by a human, an AI system, or both. Under federal law, the more relevant question is whether the use of AI changes what consumers are likely to believe about an advertisement, particularly its source, its authenticity, or the experience of the person making an endorsement. AI-specific disclosure obligations are also beginning to emerge in state law, platform policies, and the EU AI Act.

What Has Changed

The most significant developments include:

• FTC enforcement posture. In December 2025, the FTC reopened and set aside its 2024 consent order against AI writing-tool provider Rytr LLC, citing the July 2025 AI Action Plan. In July 2026, as directed by Executive Order 14365, the FTC proposed a policy statement on the application of Section 5 to AI systems. The FTC also finalized its order against Workado, LLC over unsupported AI-detection accuracy claims (see FTC Act Section 5).
• Federal action on state AI laws. Executive Order 14365, issued December 11, 2025, created a Department of Justice AI Litigation Task Force to challenge state AI laws deemed inconsistent with a national policy framework (see State AI Disclosure Laws).
• New York synthetic performer disclosure. Since June 9, 2026, advertisements that include AI-generated synthetic performers must disclose that fact under New York law (see State AI Disclosure Laws).
• Utah codification. Utah’s 2025 GenAI consumer protection amendments, including the rule that GenAI’s involvement is not a defense to a consumer protection violation, are codified in Chapter 77 of Title 13 of the Utah Code (see State UDAP Laws and State AI Disclosure Laws).
• California AI Transparency Act. California’s provenance disclosure law for large GenAI providers became operative on August 2, 2026 (see State AI Disclosure Laws).
• Expanded digital replica protections. In December 2025, New York broadened its protections for digital replicas of deceased performers. A federal court allowed New York right of publicity claims against an AI voice-cloning company to proceed. Additional states have enacted digital replica laws (see Rights of Publicity and Digital Replica Laws).
• NO FAKES Act. The federal digital replica bill was reintroduced as the NO FAKES Act of 2026, approved by the Senate Judiciary Committee, and placed on the Senate calendar (see Rights of Publicity and Digital Replica Laws).
• Impersonation Rule. The FTC has not finalized its proposal to extend the Impersonation Rule to individuals, has abandoned its proposed means-and-instrumentalities provision, and has opened a separate rulemaking inquiry about platform tools used in impersonation scams (see Impersonation Rule).
• EU AI Act transparency obligations. The EU AI Act’s Article 50 transparency obligations, including deepfake labeling, have applied since August 2, 2026 (see International Laws).

FTC Act Section 5

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce (15 U.S.C. § 45(a)(1)). A representation, omission, or practice is deceptive if it is likely to mislead consumers acting reasonably under the circumstances and is material (FTC Policy Statement on Deception, appended to Cliffdale Assocs., Inc., 103 F.T.C. 110, 174 (1984)). Courts evaluate the net impression an advertisement creates, so a communication can be deceptive even if it contains truthful disclosures (FTC v. Cyberspace.com LLC, 453 F.3d 1196, 1200 (9th Cir. 2006); Kraft, Inc. v. FTC, 970 F.2d 311, 314 (7th Cir. 1992)).

Advertisers must also have a reasonable basis for objective claims before disseminating them. Claims that state or imply a specific level of support, such as “clinical research proves,” require at least that level of substantiation (FTC Policy Statement Regarding Advertising Substantiation, appended to Thompson Med. Co., 104 F.T.C. 648, 839 (1984), aff’d, 791 F.2d 189 (D.C. Cir. 1986); see also FTC, Health Products Compliance Guidance (Dec. 2022)). These obligations apply equally to claims drafted or suggested by GenAI. A GenAI tool may produce confident but unsupported statements, and the fact that a claim originated with AI does not reduce the advertiser’s substantiation obligation.

FTC Enforcement Involving AI

The FTC has repeatedly stated that existing law applies to AI-enabled conduct and has taken action against organizations that use AI, or claims about AI, to deceive consumers (see, for example, FTC: FTC Announces Crackdown on Deceptive AI Claims and Schemes (Sept. 25, 2024)). In April 2025, the FTC announced a proposed order requiring Workado, LLC to stop advertising the accuracy of its AI content detection products unless it has competent and reliable evidence to support those claims, and the FTC later finalized the order (FTC: FTC Order Requires Workado to Back Up Artificial Intelligence Detection Claims (Apr. 28, 2025)).

Under its current leadership, however, the FTC has framed AI enforcement as applying existing fraud and deception law rather than creating AI-specific obligations. The July 2025 AI Action Plan directed the FTC to review prior AI-related investigations, orders, and consent decrees that may unduly burden AI innovation (The White House, Winning the Race: America’s AI Action Plan (July 2025)). Consistent with that directive, in December 2025 the FTC reopened and set aside its 2024 consent order against AI writing-tool provider Rytr LLC, concluding that the complaint did not adequately allege a Section 5 violation and that the order unduly burdened AI innovation (FTC: FTC Reopens and Sets Aside Rytr Final Order in Response to the Trump Administration’s AI Action Plan (Dec. 22, 2025)). The 2024 order had barred Rytr from offering a service that generated consumer reviews and testimonials. Its vacatur signals that the FTC is less likely to pursue AI tool providers based on the potential for downstream misuse, but it does not affect the liability of businesses that actually use AI to create or disseminate fake reviews. On the same day it vacated the Rytr order, the FTC sent warning letters to companies regarding potential violations of the Consumer Reviews and Testimonials Rule (see Consumer Reviews and Testimonials Rule).

In July 2026, as directed by Executive Order 14365, the FTC issued a proposed policy statement on the application of Section 5 to AI systems. The proposed statement takes the position that AI companies that steer their systems’ outputs toward undisclosed objectives, rather than the objectives users set or reasonably expect, are likely to deceive consumers, and that state laws requiring such alterations may be preempted (FTC, Proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems (July 1, 2026)). The proposed statement is directed principally at AI developers rather than advertisers, but it confirms that the FTC views the deception framework as fully applicable to AI outputs.

The FTC has not adopted any rule or guidance requiring disclosure solely because GenAI was used to create or edit advertising content.

Endorsement Guides

The FTC’s Guides Concerning the Use of Endorsements and Testimonials in Advertising (Endorsement Guides) were most recently revised in 2023 (16 C.F.R. Part 255; 88 Fed. Reg. 48092 (July 26, 2023)). The Endorsement Guides are administrative interpretations of Section 5 rather than binding rules, but practices inconsistent with them may result in enforcement action (16 C.F.R. § 255.0(a)). The earlier article noted that the FTC treats fictional customer testimonials as inconsistent with the Endorsement Guides. The provisions most relevant to AI-generated influencer content are:

• Endorsers. An endorser is the party whose opinions, beliefs, findings, or experience a message appears to reflect, and it “could be or appear to be an individual, group, or institution” (16 C.F.R. § 255.0(b)). In announcing the 2023 revisions, the FTC explained that the definition reaches virtual influencers (FTC: Federal Trade Commission Announces Updated Advertising Guides to Combat Deceptive Reviews and Endorsements (June 29, 2023)).
• Honest opinions and experience. Endorsements must reflect the honest opinions, findings, beliefs, or experience of the endorser, and an endorsement may not convey any representation that would be deceptive if made directly by the advertiser (16 C.F.R. § 255.1(a)).
• Distortion. An endorsement may not be presented out of context or reworded in a way that distorts the endorser’s opinion or experience (16 C.F.R. § 255.1(b)).
• Current views. An advertiser may use an endorsement of an expert or celebrity only so long as it has good reason to believe that the endorser continues to subscribe to the views presented (16 C.F.R. § 255.1(b)).
• Bona fide use. If an advertisement represents that the endorser uses the product, the endorser must have been a bona fide user at the time of the endorsement, and the advertiser may continue running the advertisement only while it has good reason to believe the endorser remains a bona fide user (16 C.F.R. § 255.1(c)).
• Liability. Advertisers are liable for misleading or unsubstantiated statements made through endorsements and for failing to disclose unexpected material connections, and should provide guidance to endorsers, monitor compliance, and remedy non-compliance (16 C.F.R. § 255.1(d)). Endorsers may be liable for representations they know or should know to be deceptive, including falsely representing that they personally used a product (16 C.F.R. § 255.1(e)). Advertising agencies, public relations firms, and other intermediaries may be liable for their roles in creating or disseminating deceptive endorsements (16 C.F.R. § 255.1(f)).
• Images of other people. Using an image or likeness of someone other than the actual endorser is deceptive if it misrepresents a material attribute of the endorser (16 C.F.R. § 255.1(g)).
• Performance claims. Consumer endorsements about product performance must be supported by adequate substantiation, and consumer endorsements themselves are not competent and reliable scientific evidence (16 C.F.R. § 255.2(a)).
• Material connections. A connection between the endorser and the seller that might materially affect the weight or credibility of the endorsement, and that the audience would not reasonably expect, must be disclosed clearly and conspicuously (16 C.F.R. § 255.5(a)). In social media and other interactive media, the disclosure should be unavoidable (16 C.F.R. § 255.0(f)). A disclosure that appears only on an influencer’s profile page is not clear and conspicuous (16 C.F.R. § 255.0(g)(9)).

For FTC staff guidance on influencer disclosures, see FTC, Disclosures 101 for Social Media Influencers (Nov. 2019) and FTC, FTC’s Endorsement Guides: What People Are Asking (2023).

Consumer Reviews and Testimonials Rule

The FTC’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials took effect on October 21, 2024 (16 C.F.R. Part 465; 89 Fed. Reg. 68034 (Aug. 22, 2024)). The rule prohibits businesses from writing, creating, or selling consumer reviews, consumer testimonials, or celebrity testimonials that materially misrepresent:

• That the reviewer or testimonialist exists.
• That the reviewer or testimonialist used or otherwise had experience with the product.
• The reviewer’s or testimonialist’s experience with the product.

(16 C.F.R. § 465.2(a).) The rule also prohibits businesses from purchasing such reviews or disseminating such testimonials when they knew or should have known of the misrepresentation (16 C.F.R. § 465.2(b)). The rule’s text does not mention AI, but in announcing the rule the FTC specifically identified AI-generated fake reviews as within its scope (FTC: Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials (Aug. 14, 2024)).

Because it is a trade regulation rule, violations may result in civil penalties where the violator had actual knowledge, or knowledge fairly implied, that the conduct was prohibited by the rule (15 U.S.C. § 45(m)(1)(A)). Whether a particular influencer statement is a consumer testimonial or celebrity testimonial under the rule’s definitions requires case-by-case analysis (16 C.F.R. § 465.1). The rule is a meaningful addition to the framework discussed in the earlier article because it gives the FTC a direct civil penalty remedy for fabricated testimonials, including those generated by AI or delivered through a synthetic persona.

Impersonation Rule

The FTC’s Trade Regulation Rule on Impersonation of Government and Businesses took effect on April 1, 2024 (16 C.F.R. Part 461; 89 Fed. Reg. 15017 (Mar. 1, 2024)). The rule prohibits impersonating government entities, businesses, and their officials, and misrepresenting affiliation with or endorsement by them, but it does not reach impersonation of private individuals.

In 2024, the FTC proposed extending the rule to impersonation of individuals and adding means-and-instrumentalities liability that could reach providers of AI tools (89 Fed. Reg. 15072 (Mar. 1, 2024)). The FTC later decided not to proceed with the means-and-instrumentalities proposal. It held an informal hearing on the individual-impersonation proposal in January 2025 but, as of October 2026, had not finalized it. In October 2026, the FTC separately issued an advance notice of proposed rulemaking asking whether the rule should address platform advertising tools used in impersonation scams (FTC, Rule on Impersonation of Government and Businesses, Advance Notice of Proposed Rulemaking (Oct. 1, 2026)).

Even if the individual-impersonation provision is finalized, it would principally address unauthorized impersonation, such as deepfake celebrity endorsements, rather than an influencer-approved digital replica.

State UDAP Laws

UDAP statutes are in force in all states and the District of Columbia, provide broad prohibitions against unfair or deceptive conduct, and sometimes exceed federal standards. Many direct courts to be guided by FTC and federal court interpretations of Section 5 (see, for example, Mass. Gen. Laws ch. 93A, § 2(b); Fla. Stat. § 501.204(2)).

Utah has clarified that it is not a defense to a violation of a statute enforced by its Division of Consumer Protection that GenAI made the violative statement, undertook the violative act, or was used in furtherance of the violation. This provision, enacted in 2025, is codified at Utah Code § 13-77-102.

State attorneys general have long pursued fabricated endorsements and false authenticity signals under their general consumer protection authority. For example, in 2013 the New York Attorney General announced settlements with 19 companies following an investigation into fake online reviews, and in 2019 the New York Attorney General reached a settlement with Devumi LLC over its sale of fake social media followers and engagement, some of which used accounts copying real people’s profiles (see N.Y. Gen. Bus. Law §§ 349 to 350). These are traditional deception matters rather than AI-specific precedent, but they apply by analogy to AI-generated reviews and personas.

State AI Disclosure Laws

Several states have enacted AI-specific disclosure requirements relevant to influencer marketing.

New York Synthetic Performer Law

New York requires advertisements that include a synthetic performer to disclose that fact conspicuously (N.Y. Gen. Bus. Law § 396-b (signed Dec. 11, 2025; effective June 9, 2026)). A synthetic performer is a digitally created asset, generated or modified by AI or a software algorithm, that is intended to create the impression of a human performer who is not an identifiable real person. The disclosure obligation applies to persons who produce or create advertisements, and only where they have actual knowledge that a synthetic performer is used. The law includes exceptions, including for audio-only advertisements and certain uses in connection with expressive works, and does not apply to media outlets that merely carry advertising. Civil penalties are $1,000 for a first violation and $5,000 for each subsequent violation.

The New York law is the first state law to require disclosure of AI-generated performers in advertising and is directly relevant to brands that use fully synthetic influencers in campaigns reaching New York audiences.

California BOT Act

It is unlawful to use a bot to communicate or interact online with a person in California with the intent to mislead the person about its artificial identity in order to incentivize a purchase or sale of goods or services, unless the bot’s nature is clearly and conspicuously disclosed. A bot is an automated online account where all or substantially all of the actions or posts are not the result of a person (Cal. Bus. & Prof. Code §§ 17940 to 17943).

Utah GenAI Consumer Protection Law

Utah requires a supplier that uses GenAI to interact with an individual in connection with a consumer transaction to disclose that the individual is interacting with GenAI rather than a human, if the individual clearly and unambiguously asks. Individuals providing services in certain regulated occupations must prominently disclose GenAI use at the outset of high-risk AI interactions, such as those involving sensitive personal information or personalized financial, legal, medical, or mental health advice. The law provides a safe harbor for compliant disclosures (Utah Code §§ 13-77-101 to 13-77-106).

California AI Transparency Act

California requires providers of GenAI systems with more than one million monthly users to offer free AI detection tools and to include provenance disclosures in AI-generated image, video, and audio content (Cal. Bus. & Prof. Code § 22757 et seq.). The Act became operative on August 2, 2026, after AB 853 (2025) delayed its original January 1, 2026 operative date. AB 853 also adds provenance-related obligations for large online platforms and other entities beginning in 2027. The law regulates AI providers and platforms rather than advertisers, but AI-generated campaign assets may carry machine-readable provenance data that platforms can detect and label.

Federal Challenges to State AI Laws

These laws operate against an unsettled federal backdrop. Executive Order 14365 directs the Attorney General to establish an AI Litigation Task Force to challenge state AI laws deemed inconsistent with a minimally burdensome national AI policy framework, directs the Secretary of Commerce to identify such laws, and directs the FTC to issue the policy statement discussed above (Exec. Order No. 14365, Ensuring a National Policy Framework for Artificial Intelligence, 90 Fed. Reg. 58499 (Dec. 16, 2025)). The order does not itself invalidate any state law. Organizations should comply with state disclosure laws as enacted while monitoring for preemption challenges.

Rights of Publicity and Digital Replica Laws

State statutory and common law rights of publicity are the most relevant protections against unauthorized use of a person’s identity, but there is no federal right of publicity and state laws vary considerably. These laws restrict the unauthorized commercial use of a person’s name, likeness, or voice (see, for example, Cal. Civ. Code § 3344; N.Y. Civ. Rights Law §§ 50 to 51). Courts have long applied them to imitations that evoke a person’s identity without using the person’s actual image or voice (see, for example, Midler v. Ford Motor Co., 849 F.2d 460 (9th Cir. 1988) (deliberate imitation of a singer’s distinctive voice in a commercial)).

These protections are now being tested against AI voice cloning. In Lehrman v. Lovo, Inc., voice actors sued an AI voice company for creating and selling clones of their voices. The court dismissed the plaintiffs’ federal trademark claims and most of their copyright claims but allowed their claims under New York’s right of publicity statute, New York consumer protection law, and breach of contract to proceed (Lehrman v. Lovo, Inc., No. 1:23-cv-08269, 2025 WL 1902547 (S.D.N.Y. July 10, 2025)). The decision suggests that, at least for now, state publicity and consumer protection laws are more effective than federal intellectual property law against unauthorized AI voice replicas.

Several states have also enacted laws that specifically address digital replicas, including:

• Tennessee. The ELVIS Act extends publicity protection to an individual’s voice, including simulations of it, and creates liability for distributing technology whose primary purpose is producing a particular individual’s likeness or voice, with knowledge that the use is unauthorized (Ensuring Likeness, Voice, and Image Security (ELVIS) Act of 2024, 2024 Tenn. Pub. Acts ch. 588 (codified at Tenn. Code Ann. § 47-25-1101 et seq.) (eff. July 1, 2024)).
• California. Contract provisions permitting a digital replica of an individual’s voice or likeness in place of work the individual would otherwise have performed in person may be unenforceable where they lack a reasonably specific description of the intended uses and the individual was not represented by counsel or a labor union (Cal. Lab. Code § 927 (applicable to performances fixed on or after Jan. 1, 2025)). Commentators disagree whether a reasonably specific description or representation alone is sufficient to preserve a provision, so agreements should satisfy both. California also requires consent for digital replicas of deceased personalities in audiovisual works and sound recordings (Cal. Civ. Code § 3344.1).
• New York. New York imposes comparable limits on digital replica contract provisions (N.Y. Gen. Oblig. Law § 5-302 (applicable to contracts entered into or modified on or after Jan. 1, 2025)). New York also requires consent before a deceased performer’s digital replica is used. In December 2025, New York broadened that protection to cover digital replicas used in audiovisual works, sound recordings, and live musical performances (N.Y. Civ. Rights Law § 50-f (as amended Dec. 11, 2025)).
• Illinois. Illinois amended its Right of Publicity Act in 2024 to address unauthorized digital replicas (765 ILCS 1075) and enacted the Digital Voice and Likeness Protection Act, which limits the enforceability of digital replica contract provisions (815 ILCS 550/1 et seq.).
• Other states. Utah, Arkansas, Montana, and Washington have also enacted legislation addressing AI-generated digital replicas of a person’s voice or likeness.

An influencer whose replica is used without authorization may also have a federal false endorsement claim under the Lanham Act (15 U.S.C. § 1125(a)(1)(A); Waits v. Frito-Lay, Inc., 978 F.2d 1093 (9th Cir. 1992)).

The No FAKES Act, which would create a licensable federal right in a person’s voice and visual likeness in digital replicas, was reintroduced in the 119th Congress as the NO FAKES Act of 2026, which adds a counter-notification process to its notice-and-takedown regime and would preserve state digital replica laws in existence as of January 2, 2025. The Senate Judiciary Committee approved the bill in June 2026, and as of October 2026 it remains pending on the Senate calendar (S. 4591, 119th Cong. (2026)). The TAKE IT DOWN Act, enacted in May 2025, addresses nonconsensual intimate imagery, including AI-generated imagery, rather than advertising (Pub. L. No. 119-12 (2025)).

These laws generally protect an individual’s control over their identity. They do not resolve whether consumers are being misled, which remains the central question under advertising law.

Platform Policies

Major social media platforms require creators to label realistic AI-generated or materially altered content. For example:

• YouTube requires creators to disclose realistic altered or synthetic content, but does not require disclosure where GenAI is used only for productivity tasks such as drafting scripts or captions.
• TikTok requires creators to label AI-generated content that contains realistic images, audio, or video.
• Meta applies “AI info” labels and requires disclosure of photorealistic video or realistic-sounding audio that was digitally created or altered.

These requirements are contractual terms rather than legal mandates, but noncompliance can result in content removal or account penalties. Platform policies change frequently and should be checked for each campaign.

International Laws

The EU AI Act has extraterritorial reach and may apply to organizations outside the EU that produce AI system output used, or intended to be used, in the EU (Regulation (EU) 2024/1689 (EU AI Act)). Its transparency obligations require deployers of AI systems that generate or manipulate deepfake image, audio, or video content to disclose that the content has been artificially generated or manipulated (Article 50(4), EU AI Act).

Article 50 has applied since August 2, 2026 (Article 113, EU AI Act). The Digital Omnibus on AI, adopted in 2026, deferred the EU AI Act’s high-risk system obligations but did not defer Article 50, except for a grace period until December 2, 2026 for the Article 50(2) marking obligations of GenAI systems placed on the market before August 2, 2026. Campaigns that reach EU audiences and include AI replicas of real people, or synthetic content that could be mistaken for authentic, should account for these labeling requirements.

Applying the Framework

The legal significance of AI in influencer marketing depends less on whether AI was used than on what the AI does. Under federal advertising law, the key questions are whether AI creates or simulates a real person’s statements or experience, creates a fictional persona, or materially alters a product demonstration, and whether consumers would understand the advertisement differently if they knew. Separately, state, platform, and foreign rules may require AI disclosure regardless of the deception analysis.

Conclusion 

In the first article in this series, “AI, Influencers, and Liability: What Marketing Agencies Need to Know Before Deploying AI Tools,” we explained that the key legal question for brands and agencies is not simply whether AI is being used in influencer marketing, but how it is being used. The developments discussed in this article reinforce that point. Federal law still does not require disclosure solely because AI was used, and the FTC has signaled that it will apply existing deception and substantiation principles to AI rather than create AI-specific obligations. Those principles apply fully to AI-generated content: endorsements must reflect genuine opinions and experiences, claims must be substantiated, and the Consumer Reviews and Testimonials Rule now gives the FTC a civil penalty remedy for fabricated testimonials, including those generated by AI.

At the same time, AI-specific obligations are emerging outside federal advertising law. New York now requires disclosure of synthetic performers in advertising, states continue to expand protections for digital replicas, platforms require labels for realistic AI content, and the EU AI Act’s deepfake disclosure requirements now apply. These rules operate against an unsettled federal backdrop, including Executive Order 14365’s challenge to state AI laws and the pending NO FAKES Act, so the requirements that apply to a given campaign may continue to shift.

Brands and agencies should comply with state disclosure laws as enacted, track platform and international requirements by campaign and audience, address AI use and digital replica rights expressly in influencer agreements, and monitor federal preemption efforts. Those that evaluate AI based on what it does, rather than simply whether it was used, will be better positioned to use GenAI effectively while minimizing legal and reputational risk.

Our next article, “AI-Assisted, Replicated, and Synthetic Influencers: Legal Risks and When to Disclose AI,” takes a closer look at each of the three ways AI is used in influencer marketing and offers a practical framework for deciding when AI use should be disclosed.

For further information and assistance, contact Lindsay Gehman or Saachi Gorinstein.

To view a PDF version of this article, please click here.

The 2026 California legislative season lacked the blockbuster land use legislation that made headlines in 2025, but still delivered a number of meaningful changes for housing developers. This post focuses on key bills signed by the Governor affecting entitlement, permitting, financing, and subdivision of residential and mixed-use projects in California, in four general categories:

• Reducing uncertainty in project approvals and post-entitlement processing
• New streamlined development pathways
• Density Bonus Law limitations and expansions
• Extending the lives of subdivision maps, and reducing appeals

Reducing Uncertainty in Project Approvals and Post-entitlement Processing

SB 1014 (Grayson) [Earlier Disclosure of Required Improvements]

SB 1014 will provide housing developers with earlier information regarding potential improvement requirements and limit imposition of new requirements at the post-entitlement stage.

An applicant for a housing development project may request a preliminary estimate of required onsite and offsite improvements with an SB 330 preliminary application or, if no preliminary application is submitted, with the development application. Within 30 business days, the local agency must provide: (1) a good faith list of the types of improvements that may be required; and (2) for improvements the agency would construct or install, a good faith estimate of the cost. The estimate is informational and nonbinding and need not include improvements required under CEQA or by another public agency or utility. An applicant may also request a list of potential improvements from another public agency or utility within 30 days of submitting its application; that agency or utility must respond within 30 business days.

At the post-entitlement stage, within 30 business days after deeming a permit application complete, the permitting jurisdiction must provide a list of all onsite and offsite improvements required in connection with that permit and generally may not later require an improvement omitted from the list. Exceptions apply where the improvement is necessary to address a specific adverse health or safety impact supported by substantial evidence, is reasonably related to a requested change in the permitted work, or is required under CEQA for a discretionary post-entitlement permit.

AB 1621 (Wilson) [Post-entitlement Phase Permit Processing]

AB 1621 strengthens the statutory protections governing post-entitlement permitting for housing development projects by limiting repeated building permit review, restricting when review deadlines may be tolled, constraining changes to approved plans during building inspection, and expanding applicants’ remedies for agency noncompliance.

The bill also provides that a local agency’s violation of specified post-entitlement permitting requirements constitutes a disapproval under the Housing Accountability Act (HAA), meaning that a developer could pursue HAA remedies against the agency, while a state agency violation would result in the permit being deemed approved and related reviews deemed complete. Key changes include:

• A local or state agency may not require or request more than two plan check and specification reviews in connection with a building permit application. After two reviews, the agency may deny an application that does not comply with applicable permit standards, and the applicant may make additional submittals. The two-review limitation does not apply to other post-entitlement phase permits.
• Statutory review deadlines will be tolled only where federal or state law requires review by another independent public agency before the permitting agency may act, and the agency must notify the applicant within three business days after tolling begins and after the deadline resumes.
• An agency may not require or request a deviation from an approved building plan during building inspection unless it makes written findings, supported by substantial evidence, that either a reasonable person could not interpret the approved plan as compliant with the applicable building permit standards, or the deviation is necessary to address a specific, adverse impact on public health or safety.
• If the applicant appeals an incomplete determination, a noncompliance determination, or a denial, the deadline for the agency’s final written determination on appeal is shortened from 60 to 30 business days for projects with 25 units or fewer, and from 90 to 45 business days for projects with 26 units or more. If an appeal is denied, a decision is not made within the applicable deadline, or the required appeal process is not provided, the applicant may seek a writ of mandate to compel approval.

New Streamlined Development Pathways

AB 1751 (Quirk-Silva, Wicks) [Missing Middle Townhome Ownership Act]

AB 1751 creates a ministerial approval and subdivision process for qualifying townhome development projects, including projects on certain underutilized sites zoned for single-family use, and limits application of local objective standards that would physically preclude a project from meeting the law’s density threshold.

A qualifying “townhome development project” must:

• consist entirely of townhomes (single-family units of no more than three stories that either share a common wall on one or two sides or are separated from neighboring units by no more than the minimum fire separation distance);
• contain no more than 150 units;
• have an average townhome size of no more than 1,750 net habitable square feet; and
• achieve at least 75% of the applicable density specified in Housing Element Law, which varies depending on location and ranges from 10 to 30 units per acre.

For projects with 11 or more units, at least 10% of the units must be affordable to lower income households for at least 45 years, unless a higher local inclusionary requirement applies.

The new law also requires ministerial approval of tentative and final maps for qualifying townhome projects. The subdivision pathway is limited to sites zoned for multifamily residential use or underutilized sites zoned exclusively for single-family residential development (generally, sites with no permanent residential structure other than one that is abandoned and uninhabitable). Anti-displacement, environmental, historic-resource, infrastructure, and other site restrictions apply to this pathway. Newly created parcels generally must be at least 600 square feet and must be served by an existing community water system and municipal sewer system.

Local agencies may continue to apply objective general plan, zoning, subdivision, and design standards that do not conflict with the statute, but may not apply standards that physically preclude a project meeting the statute’s density threshold, impose requirements solely because a project uses the new process, or require enclosed or covered parking. A local agency may disapprove a qualifying project or deny its map only on written findings, based on a preponderance of the evidence, of a specific, adverse impact on public health and safety that cannot feasibly be mitigated. Approvals are not subject to CEQA.

Local agencies also may not require formation of a homeowners’ association except as required by the Davis-Stirling Act. Unless the local agency authorizes otherwise by ordinance or map condition, lots created under the new law generally may not be sold, leased, or financed separately until they contain a completed residential unit.

The new law does not apply in San Francisco.

AB 2074 (Haney) [Regional Transit Hub Districts and Downtown Housing]

AB 2074 establishes minimum height, FAR, and density standards for qualifying projects in regional transit hub districts, together with a ministerial approval pathway and the ability to layer applicable Density Bonus Law (DBL) benefits onto those standards.

The new law requires each “major transit city”—a city with at least 400,000 residents and at least two transit-oriented development stops—to designate at least one regional transit hub district by July 1, 2027. The total required district area depends on city population, ranging from 0.5 to1.5 square miles. Each district must be a contiguous area of at least 0.25 square miles and contain at least one transit-oriented development stop. If a major transit city does not comply, an equivalent area in a uniform radius around the city’s highest-ridership transit-oriented development stop will be deemed a regional transit hub district.

Within a regional transit hub district, a city must make a “downtown housing development” an allowable use and:

• may not set a maximum height below 150 feet, an FAR below 6, or a maximum density below 200 units/acre;
• must allow a maximum height of at least 450 feet, an FAR of at least 12, and no maximum density limit, each on at least 25% of the total aggregate district area; and
• may apply other objective zoning, subdivision, and design review standards consistent with those requirements.

A “downtown housing development” must meet specified requirements, including a minimum density of 60 units/acre, affordability, labor and site-eligibility requirements, restrictions on demolition of individually landmarked property, and an average unit-size cap of 1,750 net habitable square feet. Such projects would be eligible for streamlined ministerial approval under SB 35/SB 423 (while being exempt from many of that legislation’s requirements), and may qualify for DBL benefits using the bill’s requirements as the base density.

Designating a district is not a “project” under CEQA, and other cities may opt in by designating their own regional transit hub districts. The new law is enforceable by the California Department of Housing and Community Development, which may refer violations to the Attorney General. It also directs the California Housing Finance Agency to study a potential state construction loan program and report to the Legislature by March 1, 2028.

Density Bonus Law Limitations and Expansions

SB 1383 (Arreguín) [Density Bonus Concessions and Local Labor Standards]

Adopted in response to developers in Berkeley using DBL to obtain concessions for relief from locally adopted labor requirements, SB 1383 will prevent the use of DBL incentives or concessions to modify certain local labor standards. The DBL defines an incentive or concession to include specified reductions in site development standards or modifications of zoning or architectural requirements, as well as other regulatory incentives or concessions that result in identifiable and actual cost reductions, and developers are entitled to a certain number of incentives or concessions depending on the percentage and level of below-market rate units included in a project.

For a building over 85 feet in height above grade, SB 1383 provides that a reduction, modification, or other regulatory incentive or concession may not include or relate to a “labor standard,” as defined in Labor Code section 1205, adopted by the local government. For purposes of this restriction, the applicable labor standards are those that do not exceed the requirements of SB 35/SB 423 (Government Code section 65913.4(a)(8)), as those requirements existed on December 31, 2025.  Generally, these provisions require payment of prevailing wages and compliance with skilled and trained workforce requirements.

AB 2433 (Alvarez) [Density Bonus Law Amendments]

AB 2433 makes several changes to the DBL, including changes to when local agencies must apply the law, how a density bonus may be calculated, and how qualifying projects may use DBL benefits. Among the principal changes:

• A local agency would be required to comply with DBL when an applicant submits an application for a housing development that the local agency determines meets at least one of the statutory eligibility criteria, rather than only when an applicant affirmatively seeks a density bonus. When a density bonus application is deemed complete, the local agency must also determine that the project is eligible for a density bonus, in addition to determining the amount of the bonus and the other matters already required under DBL.
• An applicant may elect to provide a base density study, which the local agency must accept if it includes all applicable objective development standards, and may elect to receive the density bonus as a percentage increase in maximum floor area ratio (FAR) rather than an increase in residential density.
• A project that includes for-sale affordable units would receive two additional incentives or concessions.
• DBL benefits may be applied throughout a housing development. Density bonus units may be provided outside the areas containing the lower income units, and incentives, concessions, waivers, and reductions of development standards may be applied outside the areas containing housing units, subject to specified requirements.
• For the additional “super” density bonus made available by AB 1287, the bill removes the existing limitation that the resulting housing development not restrict more than 50% of the total units to moderate, lower, or very low income households. It also allows more deeply affordable units to be substituted for less deeply affordable units (e.g., substituting very low income units for moderate units) to satisfy the applicable unit percentage.
• The bill expands on existing language stating that a grant of a density bonus, incentive, or concession does not require a general plan amendment, local coastal plan amendment, zoning change, or other discretionary approval. It clarifies that any of these DBL-related actions, or the grant of a waiver or reduction in development standards, is not itself discretionary and does not independently require environmental review under CEQA.

Subdivision Map Act Protections

SB 1169 (Grayson) [Longer Tentative Map Terms]

Under existing law, an approved or conditionally approved tentative map generally expires 24 months after approval or conditional approval, subject to an additional period prescribed by local ordinance of up to 24 months. SB 1169 extends those periods to 48 months and up to an additional 36 months, respectively. These timelines also apply to any approved or conditionally approved tentative map that has not expired as of December 31, 2026. The new law does not change the other extension provisions in Government Code section 66452.6, including extensions associated with certain phased final maps and extensions granted upon application of the subdivider.

SB 677 (Wiener) [Limits on Third-Party Subdivision Appeals]

SB 677 limits administrative appeals of specified subdivision decisions for qualifying housing development projects. An interested person may not file an appeal under specified provisions of the Subdivision Map Act or a local subdivision ordinance if the decision relates to a map that is part of a housing development project and the project site is located in a qualifying urban area, meets specified infill criteria, will be served by a public water system and municipal sewer system, and is not located on specified sensitive lands. The restriction would not apply to appeals filed by an applicant or subdivider, certain tenants in residential conversion projects, an advisory agency otherwise authorized to appeal, or a public agency or public official acting within the course and scope of their employment.

The Coblentz Real Estate Team has extensive experience with the state’s latest housing laws and can help to navigate the laws’ complexities and opportunities. Please contact us for additional information and any questions related to the impact of these bills on land use and real estate development.

By Fred W. Alvarez, Hannah L. Jones, Daniel M. Bruggebrew, Allison Moser, Hannah Withers, Stacey Zartler, and Maya Mercado

California’s 2026 legislative session has come to a close, and the Governor has signed a number of new employment measures that will affect California employers in 2027 and beyond. The new laws address a range of workplace issues, including AI and automation, pay practices and reporting, leaves of absence, discrimination and harassment, and workplace safety.

This update highlights the significant employment laws enacted during the recently concluded legislative session, explains their practical implications, and identifies steps employers should consider taking now. Our focus is not simply on what changed, but on what employers need to know and do to prepare for the year ahead.

AI, Automation & the Workplace

New Law	What Employers Need to Know	What Employers Should Do
SB 947 – Revised No Robo Boss Act	Beginning July 1, 2027, employers may not rely solely on an Automated Decision System (“ADS”) to make disciplinary or termination decisions in employment. If an ADS is the primary basis for the decision, a human must independently corroborate the decision using the same data relied upon by the ADS. Employers must also notify the employee in writing of the use of the ADS when communicating the decision and provide certain information about the ADS-based decision. Upon request, the employer must provide the employee with a “meaningful, objective description” of the data used by the ADS.	Employers should identify any ADS used in discipline or termination decisions and establish a human-review process that satisfies the new requirements. Employers should also work with vendors now to understand what data their systems use to make decisions and ensure they are prepared to provide employees with the required information about an ADS-based decision.
SB 951 – WARN Notice Updates for Layoffs Resulting from AI	California WARN notices are required when a mass layoff is caused, in whole or substantial part, by AI or other automated technology. The WARN notice must include additional information about the use of the technology, including the job functions being automated. These new requirements take effect on January 1, 2027.	When planning a potentially covered mass layoff, employers should identify early whether AI or automation is the cause of the employment actions. HR should coordinate with business and technology teams to understand and document the role of the technology and ensure that any required WARN notice includes the necessary information.
AB 1883 – AI Workplace Surveillance	Beginning January 1, 2027, employers may not use workplace surveillance tools that use AI to recognize, infer, or predict an employee’s emotional state or that collect neural data.	Employers should inventory workplace surveillance and monitoring technologies, including tools provided by third-party vendors, and determine whether any features analyze employees’ emotional states or collect neural data.

 

Pay Practices & Pay Data Reporting

New Law	What Employers Need to Know	What Employers Should Do
AB 1697 – “Anti-TRAP” Updates	California’s “anti-TRAP” law, AB 692, took effect on January 1, 2026, restricting employers’ use of training and retention repayment provisions and other “stay-or-pay” arrangements. AB 1697 gives employers additional time—until January 1, 2027—to bring existing agreements into compliance. AB 1697 also makes an important substantive change: it removes the requirement that certain bonus repayment agreements be entered into at the “outset of employment” to be enforceable, potentially expanding the exception to cover retention bonuses and other discretionary bonuses offered later in employment.	Employers should use the additional compliance period to identify existing agreements and arrangements that require employees to repay bonuses, training costs, or other amounts if they leave employment, and determine whether they comply with the amended law. Employers considering new retention or discretionary bonus programs should also evaluate whether the expanded bonus exception provides additional flexibility in structuring repayment provisions.
SB 1237 – Increased Penalty for Pay Data Reporting Violations	For 2027, the penalty for repeated failure to submit required pay data reports increases from $250 to $1,000 per employee. Beginning in 2027, employers must also report employees using the 23 Standard Occupational Classification (SOC) major groups, rather than the EEO-1 job categories previously used for California pay data reporting.	Employers subject to California’s pay data reporting requirements should update their reporting processes to use the new SOC classifications and begin mapping employees to the appropriate categories well before the filing deadline. Given the significant increase in penalties, employers should also confirm responsibility and timelines for collecting, reviewing, and submitting required pay data.

 

Leaves of Absence

New Law	What Employers Need to Know	What Employers Should Do
SB 1149 – Expanded Bereavement Leave for a “Designated Person”	Beginning January 1, 2027, employees may now take up to five days of protected bereavement leave following the death of a “designated person,” which is added to the list of qualifying family relationships. Employers may limit employees to one designated person in a 12-month period.	Employers should update bereavement-leave policies and leave procedures to include designated persons and train HR personnel and managers on the expanded eligibility requirements. Employers that limit employees to one designated person per 12-month period should also establish a process for tracking those designations.

Discrimination, Harassment & Workplace Training

New Law	What Employers Need to Know	What Employers Should Do
AB 1803 – Anti-hate Speech Training	Beginning January 1, 2028, employers must incorporate anti-hate speech training and education into California’s required sexual-harassment prevention training.	Employers should update their sexual-harassment prevention training materials to incorporate the new anti-hate speech requirements before the January 1, 2028 effective date.

Workplace Safety

New Law	What Employers Need to Know	What Employers Should Do
AB 1961 – Workplace Violence Restraining Orders	Beginning January 1, 2027, employers may seek workplace violence restraining orders in broader circumstances. Previously, an employer was required to identify a specific employee who faced a credible threat of violence and name that employee as a protected party. Under the new law, employers may seek an order protecting the workforce more broadly without identifying a specific employee as the target of the threat.	Employers should consider pursuing workplace violence restraining orders when threats are directed at the workplace or workforce generally, even if no individual employee has been specifically targeted.

 

The Coblentz Employment team is available to answer any questions you may have about the impact of these regulations.

By Scott Hall and Phillip Wiese

The much-discussed California Invasion of Privacy Act (CIPA) amendment, SB 690, has been signed by Governor Gavin Newsom and will take effect January 1, 2027, relieving some pressure businesses face from the flood of litigation, arbitration, and demand letters relating to the use of analytics or marketing technology on their websites.

Under the new law, private plaintiffs can no longer assert claims under the CIPA pen register and trap and trace provisions, Cal. Penal Code § 638.51. Instead, only the California Attorney General may bring those claims. Additionally, the law is retroactive and applies to any claim filed on or after January 1, 2025. Plaintiffs used this provision to allege that the use of common website analytics tools constituted a pen register or trap and trace device on their computer and, thus, they were entitled to $5,000 statutory damages per violation.

However, the law will not prevent all CIPA or cookie-based claims going forward. Plaintiffs often paired pen register claims with CIPA wiretapping claims under Cal. Penal Code § 631, which may still be brought by private plaintiffs, and plaintiffs are also pivoting to allege claims under other state and federal laws, including the Electronic Communications Privacy Act, the California Computer Data Access and Fraud Act, consumer protection laws, and others.

Going forward, companies should remain vigilant about cookie and pixel use on their websites and continue to mitigate risks from those technologies by conducting regular audits and reviews of the specific technology they use. Companies should also confirm that any cookies, pixels, or other third-party analytics tools on their websites are used and operating as described in their privacy disclosures.

The Coblentz Data Privacy and Cybersecurity team is experienced in handling CIPA claims based on these analytics technologies and advising clients on the best practices for their use to navigate the changing legal landscape. Please reach out to Scott Hall or Phillip Wiese for further information or assistance.