The California legislature recently passed three bills meant to address rapidly-developing technologies including the Internet of Things, artificial intelligence (AI), and chatbots.

Internet of Things. At the end of August, California became the first state to promulgate regulations requiring security features for Internet-connected devices. Senate Bill 327 requires that a manufacturer of a connected device equip the device with “reasonable security features” that are (1) appropriate to the nature and function of the device; (2) appropriate to the information it may collect, contain, or transmit; and (3) designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.

The bill specifies that one way a manufacturer can meet this reasonableness standard for a device equipped with a means for authentication outside a local area network is to include a preprogrammed password unique to each device or to include a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time.

The bill defines “connected device” broadly to mean “any device, or other physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address.”

The bill does not apply to any device “the functionality of which is subject to security requirements under federal law.” In addition, entities already regulated by health information privacy laws—namely, the Health Insurance Portability and Accountability Act or California’s health privacy law—are not subject to the bill.

The bill does not provide for a private right of action and may be enforced only by the California attorney general, a city attorney, a county counsel, or a district attorney. Governor Gerry Brown approved the bill September 28, 2018, and it will become effective January 1, 2020.

23 Asilomar AI Principles. Introduced by Assemblyman Kevin Kiley, the Assembly Concurrent Resolution Relative to the 23 Asilomar AI Principles unanimously passed the California Senate and was chaptered on September 7, 2018. The bill expresses the California Assembly’s support for the 23 Asilomar AI Principles as guiding values for the development of artificial intelligence and of related public policy.

The Asilomar AI Principles are a set of 23 principles meant to promote the safe and beneficial development of artificial intelligence. The principles—which cover research issues, ethics and values, and longer-term issues—emerged from a collaboration between AI researchers, economists, legal scholars, ethicists, and philosophers in Asilomar, California in January 2017.

While the resolution does not establish enforceable policies or regulations, it does demonstrate the California Assembly’s recognition of AI’s “rapidly increasing competency across many fields,” AI’s potential to “disrupt many domains previously serviced by human intelligence,” and the idea that AI should be developed “in a manner that ensures security, reliability, and consonance with human values.”

California B.O.T. Act of 2018: Introduced by Senator Robert Hertzberg, the B.O.T. (“Bolstering Online Transparency”) Act would criminalize the use of bots to interact with a California person “with the intent to mislead” that person “about its artificial identity for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election.” (emphasis added).

Importantly, the bill contains an exception for cases in which use of a bot comes with clear, conspicuous, and reasonable disclosures that it is a bot. In other words, use of a bot would not violate the Act so long as the bot clearly alerts California users to the fact that it is not a person. The bill also contains an exception for service providers of online platforms, including web hosting and Internet Service Providers.

The bill passed the California Senate on August 31, 2018, and Governor Brown approved it on September 28, 2018.

Senator Dianne Feinstein (D-CA) has introduced a similar piece of legislation at the federal level, which would (1) direct the Federal Trade Commission to promulgate regulations that, among other things, require social media companies to develop “a process to identify, assess, and verify” bot activity and to disclose any bots on their platforms; (2) prohibit candidates and political parties from using bots; and (3) limit political action committees, corporations, and labor unions from using bots in certain political advertising.