CALIFORNIA LEGISLATURE—
2025–2026 REGULAR SESSION
Assembly Bill
No. 2169
| Introduced by Assembly Member Lowenthal |
February 18, 2026 |
An act to add Chapter 22.2.10 (commencing with Section 22589.10) to Division 8 of the Business and Professions Code, relating to personal information.
LEGISLATIVE COUNSEL'S DIGEST
AB 2169, as introduced, Lowenthal.
Social media platforms: artificial intelligence models.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose to the consumer certain information about that personal information, including the categories of personal information it has collected about that consumer and the specific pieces of personal information it has collected about that consumer.
This bill, the Digital Choice Act, would require a social media company or a person that deploys an artificial intelligence model, defined as a model operator, to allow a consumer to request a copy of the consumer’s personal information, contextual data, and social graph and would require the social media company or
model operator to respond to that request within five business days in a format that is, among other things, portable to the extent technically feasible. The bill would define “contextual data” to mean information provided by a user to an artificial intelligence model and any context or derivative data associated with the user’s interactions with the artificial intelligence model, as specified, and any model-generated or inferred data linked to or generated from those interactions. The bill would define “social graph” to mean data that represents a person’s connections and interactions within a social media platform, as specified.
This bill would require, among other things, a social media company to implement a transparent, third-party-accessible interoperability interface that allows a user to choose to share a covered user’s social graph or user-selected parts of the social graph to a social media platform designated by the user and enable a third party to, with
the user’s permission, access a social graph created by the user and be notified when a new or updated social graph is available, as prescribed. The bill would require a model operator to implement a third-party-accessible interoperability interface to allow a user to share the user’s contextual data directly with other artificial intelligence models as the user designates and enable those artificial intelligence models to be notified when new or updated data is available, as prescribed.
This bill would authorize the Attorney General to adopt specified regulations, as provided, and require the Attorney General to enforce the bill’s provisions by bringing an administrative action, as specified.
The people of the State of California do enact as follows:
SECTION 1.
Chapter 22.2.10 (commencing with Section 22589.10) is added to Division 8 of the Business and Professions Code, to read:CHAPTER 22.2.10. Digital Choice
22589.10.
This chapter shall be known as the Digital Choice Act.22589.11.
For purposes of this chapter:(a) “Artificial intelligence model” has the meaning defined in Section 22757.11.
(b) “Business” has the meaning defined in Section 1798.140 of the Civil Code.
(c) “Consumer” has the meaning defined in Section 1798.140 of the Civil Code.
(d) (1) “Contextual data” means information provided by a user to an artificial intelligence model and any context or derivative data associated with the user’s interactions with the artificial intelligence model, including prompts, conversational histories, files, preferences, metadata,
and any model-generated or inferred data linked to or generated from those interactions.
(2) “Contextual data” does not include a model operator’s trade secrets.
(e) (1) “Model operator” means a person that deploys an artificial intelligence model, including under license or contract.
(2) “Model operator” does not include a person that interacts with artificial intelligence models solely through application programming interfaces, licensed services, prompting, or fine tuning.
(f) “Open protocol” means a publicly available set of rules that enables interoperability and data exchange between social media platforms or model operators by providing a common data infrastructure by which multiple social media platforms or model operators
can access a user’s personal information that is free from licensing fees and patent restrictions.
(g) “Personal information” means any information that identifies or describes an individual.
(h) (1) “Social graph” means data that represents a person’s connections and interactions within a social media platform, including all of the following:
(A) The person’s social connections with other users
(B) Content created by the person.
(C) The person’s responses to other users’ content, including comments, reactions, mentions, reposts, shares, and other responses.
(D) Other users’ responses to the person’s
content.
(E) Metadata associated with any of the items described in subparagraphs (A) to (D), inclusive.
(F) Relational references sufficient to maintain the associations among data elements in the items described in subparagraphs (A) to (E), inclusive.
(2) “Social graph” does not include another user’s or an entity’s content and responses that have been designated private by those users and entities, including private messages.
(i) “Social media company” has the meaning defined in Section 22675.
(j) “Social media platform” has the meaning defined in Section 22675 of the Business and Professions Code.
22589.12.
(a) A social media company or model operator shall allow a consumer to request a copy of the consumer’s personal information, contextual data, and social graph.(b) If a consumer requests a copy of the consumer’s personal information, contextual data, and social graph pursuant to subdivision (a), a social media company or model operator shall provide, within five business days, the consumer’s personal information, contextual data, and social graph in a format that is all of the following:
(1) Portable to the extent technically feasible.
(2) Readily usable to the extent practicable.
(3) In a form that allows the consumer to transmit the data to another social media platform or model operator without impediment if the social media platform or model operator processes the data by automated means.
22589.13.
(a) A social media company shall implement a transparent, third-party-accessible interoperability interface that allows a user to choose to do both of the following:(1) Share a covered user’s social graph or user-selected parts of the social graph to a social media platform designated by the user.
(2) Enable a third party to, with the user’s permission, access social graph created by the user and be notified when a new or updated social graph is available.
(b) A model operator shall implement a third-party-accessible interoperability interface to allow a user to share the user’s contextual data directly with
other artificial intelligence models as the user designates and enable those artificial intelligence models to be notified when new or updated data is available.
(c) To comply with subdivisions (a) and (b), a social media company or model operator shall do all of the following:
(1) Utilize an open protocol.
(2) Facilitate and maintain interoperability and continuous, real-time data sharing with other social media platforms or artificial intelligence models through an interoperability interface based on reasonable terms that do not discriminate.
(3) Disclose to other social media companies or model operators complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.
(d) A social media company or model operator shall reasonably secure a user’s personal information, contextual data, or social graph obtained through an interoperability interface.
(e) A business that accesses an interoperability interface shall take reasonable steps to meet platform integrity standards, including data security, data privacy, and abuse-mitigation practices necessary to preserve user protections and secure any data it acquires, processes, or transmits.
(f) A social media company, model operator, or other controller shall not share or receive a user’s personal information, contextual data, or social graph through the interoperability interface without the user’s consent.
(g) A social media company or model operator shall adopt an accessible,
prominent, and persistent method for users to give consent for data sharing with other social media platforms or model operators through the interoperability interface.
(h) This section does not require a social media company to do any of the following:
(1) Provide access to either of the following:
(A) Inferences, analyses, or derived data that the social media company has generated internally about a user.
(B) Proprietary algorithms, ranking systems, or other internal operating mechanisms.
(2) Transmit personal information, contextual data, or a social graph that is stored or structured in a proprietary format and with respect to that personal information, contextual data, or social
graph, both of the following apply:
(A) An open, industry standard format is not reasonably available.
(B) Transmitting the personal information, contextual data, or social graph would disclose information described in paragraph (1).
(i) A business that uses an artificial intelligence model provided by a model operator to provide an application or a service to a consumer shall promptly transmit a consumer’s request to the model operator with sufficient information for the model operator to execute the request and communicate about the request with the consumer.
22589.14.
(a) The Attorney General may adopt regulations to identify specific open protocols that the Attorney General has determined, after an assessment, meet the definition of “open protocol” listed in Section 22589.11.(b) If a social media company uses an open protocol that the Attorney General identifies under subdivision (a), the social media company shall be entitled to a rebuttable presumption that the social media company provides access on reasonable terms that do not discriminate.
22589.15.
(a) The Attorney General shall enforce this chapter.(b) A social media company or model operator that violates this chapter shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation.
(c) In a proceeding brought pursuant to this chapter, the Attorney General may petition for appropriate injunctive relief.