California cracks down on AI clones and deepfakes

If you only saw the headlines about California Governor Gavin Newsom vetoing SB 1047, you might think Silicon Valley just dodged a major regulatory bullet. You would be wrong.

While Newsom killed the controversial bill that aimed to prevent catastrophic AI disasters, he quietly signed 18 other AI-focused bills into law. Rather than trying to cage frontier models with speculative kill switches, California decided to regulate every practical way AI touches daily life.

Killing the doomer bill, targeting real mess

Newsom explained his veto of SB 1047 clearly: focusing only on massive, expensive models gives the public a false sense of security, especially when lightweight, open models can be just as dangerous. Speaking with Salesforce CEO Marc Benioff earlier this month, Newsom drew a clear line between hypothetical risks and demonstrable ones, arguing the state should solve what can actually be solved right now.

What can be solved, apparently, is transparency and accountability. Under AB 2013, which takes effect in 2026, generative AI companies must publicly document what data trained their models. They have to detail their data sources, dataset sizes, collection timeframes, and whether copyrighted or licensed material was used.

Another new law, AB 1008, clarifies that existing privacy rules apply directly to generative AI. If a model like ChatGPT leaks your personal information or biometric data, companies are on the hook.

Clones, deepfakes, and automated doctors

Hollywood secured the biggest victory in this bundle. Backed heavily by the SAG-AFTRA union, AB 2602 bans studios from using AI-generated replicas of living performers without their explicit, specific consent. AB 1836 extends those protections to deceased performers, requiring studios to clear digital resurrections with an actor's estate.

Deepfakes and election interference are also under the gun. AB 2655 forces major platforms like X and Meta to take down or label political deepfakes, while AB 2839 targets individuals sharing deceptive political media ahead of votes. AI voice robocalls now require clear disclosure under AB 2905, and SB 942 mandates that tools like OpenAI's DALL-E embed provenance tags inside their output metadata.

Even healthcare got an overhaul. Clinicians must disclose when an AI drafts a message containing patient records under AB 3030, and SB 1120 stops health insurers from fully automating coverage decisions without licensed physician oversight.

Why it matters

We think Newsom's pivot from speculative existential dread to surgical, consumer-level regulation is the smartest regulatory playbook we have seen yet in the US. By skipping the sci-fi scenarios of SB 1047, California built enforceable guardrails around real problems that exist today: wage theft via digital clones, non-consensual deepfakes, and algorithmic bias in healthcare.

For creators and consumers, the value is immediate. Your face, voice, and medical choices get statutory shields instead of vague terms-of-service promises. For performers, it turns SAG-AFTRA's hard-fought strike victories into the permanent law of the world's entertainment capital.

For AI startups and builders, however, compliance just got fractured. AB 2013 alone will force companies to reckon with their data scraping habits by 2026, stripping away the trade-secret excuse around training sets. While tech giants can easily bankroll the compliance lawyers needed for 18 distinct laws, smaller developers now face a minefield of California-specific rules that the rest of the country will almost certainly copy.