California’s AI Transparency Act (CATA): Building Provenance Into AI-Generated Content

California’s AI Transparency Act (CATA) takes a distinctly technical approach to one of generative AI’s most difficult problems: how can people know where digital content came from and whether AI created or altered it?

California is building a content-provenance framework that extends beyond visible AI labels. The Act requires covered generative AI providers to embed latent disclosures in qualifying images, video, and audio and make free disclosure verification tools available to users. The framework also assigns responsibilities to large online platforms, GenAI hosting platforms, and capture device manufacturers. SB 1000 (2026) substantially revised the provider requirements, removed the provider user threshold, and eliminated the requirement to offer users an optional manifest disclosure.

The result is more than a labeling law. It is an emerging architecture for establishing the authenticity, origin, and modification history of digital content.

The Act excludes any product, service, website, or application that provides exclusively non-user-generated videogames. The word “exclusively” matters: a service offering additional functionality should not assume that the exemption removes the entire service from scope. SB 1000 narrowed the previous exemption by removing its references to television, streaming, movies, and interactive experiences.

• Before January 1, 2029, the chapter also does not apply to a GenAI system designed primarily to function as assistive technology. That term concerns technology and services that increase, maintain, or improve the functional capabilities of individuals with disabilities. Providers may not falsely claim that their systems qualify. 

See Cal. Bus. & Prof. Code §§ 22757.1(b), 22757.3(d), and 22757.5

When Does the California AI Transparency Act Take Effect?

The California AI Transparency Act is codified at California Business and Professions Code §§ 22757–22757.6. It originated with SB 942 (2024) and was substantially expanded by AB 853 (2025).  AB 2713 (2026) revised the large-online-platform requirements, while SB 1000 (2026) revised provider coverage, verification tools, latent disclosures, licensing, exemptions, and enforcement.

The chapter became operative on August 2, 2026. SB 1000 (2026) took effect immediately upon enactment on September 30, 2026, as an urgency statute. The separate operative dates for online platforms, hosting platforms, and capture device manufacturers remain important. GenAI systems designed primarily to function as assistive technology are temporarily exempt before January 1, 2029.

The obligations do not all begin at the same time:

Covered GenAI providers must create provenance information, large online platforms must preserve and expose it, GenAI hosting platforms must avoid distributing noncompliant systems, and future capture devices must be capable of establishing provenance for captured content.

The statute treats provenance disclosure as an ecosystem problem.

Who Is Subject To The California AI Transparency Act?

The Act does not regulate a single actor or impose a uniform set of obligations across the AI ecosystem. Instead, it identifies four categories of regulated entities—covered providers, large online platforms, GenAI hosting platforms, and capture device manufacturers—and assigns each a different role in creating, preserving, or surfacing provenance information. The applicable requirements also come online at different times, with obligations beginning in 2026, 2027, and 2028 depending on the regulated entity. Understanding which category an organization falls into is therefore the first step in determining what the Act requires.

What is a “Covered Provider”?

The Act begins with a broad definition of artificial intelligence. This is the same technology-neutral formulation increasingly used across California’s AI legislation. As discussed in my article California Defines AI: AB 2885 and Its Impact, the definition focuses on AI systems, autonomy, inference, inputs, objectives, and outputs rather than on a particular technology such as machine learning, large language models, or generative AI. It is also broader than generative AI: AI outputs can include predictions, recommendations, classifications, decisions, generated content, and actions affecting physical or virtual environments. See, Cal. Bus. & Prof. Code § 22757.1(a).

The AI Transparency Act then narrows that broader concept by defining a “generative artificial intelligence system” or “GenAI system” as AI that can generate derived synthetic content—including text, images, video, and audio—that emulates the structure and characteristics of its training data. See, Cal. Bus. & Prof. Code § 22757.1(g).

A “covered provider” is a person that creates, codes, or otherwise produces a GenAI system publicly accessible within California. See, Cal. Bus. & Prof. Code § 22757.1(e).

• SB 1000 removed the previous requirement that the system have more than one million monthly visitors or users. Provider size is therefore no longer the threshold for this definition.

The definitions therefore operate as a narrowing sequence:

Artificial Intelligence → Generative AI System → Covered Provider

Coverage turns on producing a GenAI system publicly accessible within California, subject to the Act’s exemptions. The central provider disclosure requirements concern images, video, and audio, rather than text.

What is a Large Online Platform?

A “large online platform” is generally a public-facing social media platform, file-sharing platform, mass messaging platform, or stand-alone search engine that distributes content to users who did not create or collaborate in creating that content and that exceeded 2 million unique monthly users during the preceding 12 months. Broadband internet access services and telecommunications services are expressly excluded. See, Cal. Bus. & Prof. Code § 22757.1(i).

What is a GenAI Hosting Platform?

A “GenAI hosting platform” is an internet website or application that makes the source code or model weights of a GenAI system available for download by a California resident, regardless of whether the terms of use require compensation. See, Cal. Bus. & Prof. Code § 22757.1(h).

What is a Capture Device Manufacturer?

A “capture device” is broadly defined as a device capable of recording photographs, audio, or video content, including video and still cameras, mobile phones with built-in cameras or microphones, and voice recorders. A “capture device manufacturer” is a person that produces a capture device for sale in California, although the definition excludes a person exclusively engaged in assembling the device. See, Cal. Bus. & Prof. Code § 22757.1(c)-(d).

The California AI Transparency Act’s Verification and Disclosure Framework

The Core Concept: Content Provenance Transparency

Understanding the Act requires understanding provenance data.

“Provenance data” means information about digital content’s origin and modification history in a format compliant or interoperable with widely adopted specifications adopted by an established standards-setting body. See Cal. Bus. & Prof. Code § 22757.1(n).

“System provenance data” is provenance data that is not reasonably capable of being associated with a particular user and contains information about the type of device, system, or service used to generate content, or information concerning content authenticity. See Cal. Bus. & Prof. Code § 22757.1(o).

• SB 1000 removed the separate definition of “personal provenance data.” Privacy protections now refer directly to “personal information,” incorporating the CCPA definition. The relevant distinction is therefore between system provenance information and information that identifies or can reasonably be linked to a consumer or household.

Importantly, the Act does not create its own definition of “personal information.” Instead, it expressly incorporates the definition in the California Consumer Privacy Act (CCPA.) Under the CCPA, personal information broadly includes information that “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly,” with a particular consumer or household. As discussed in my article When Everything Is “Personal”: GDPR vs. CCPA, this definition extends well beyond obvious identifiers such as names and email addresses and can encompass device identifiers, IP addresses, browsing activity, geolocation, inferences, and other information capable of being linked directly or indirectly to a consumer or household. See, Cal. Bus. & Prof. Code § 22757.1(m).

California is simultaneously trying to make the history of content more transparent without unnecessarily making the identity of the person creating that content more transparent.

Obligations of Covered Providers

Covered providers must make a free disclosure verification tool available, include qualifying latent disclosures to the extent technically feasible, and follow compliance procedures when licensing their systems to third parties. SB 1000 removed the requirement to offer an optional manifest disclosure. The provider framework now centers on latent provenance and verification, with safeguards governing personal information processed through verification tools. Cal. Bus. & Prof. Code §§ 22757.2–22757.3.

(1) Covered Providers Must Offer a Free Disclosure Verification Tool: A covered provider must make a free tool available that lets users assess whether its GenAI system created or altered image, video, or audio content, except through a minor modification. The tool must output detected system provenance data, accept uploaded content or URLs, and support technology such as an API for access without visiting the provider’s website.

• The tool must generally be publicly accessible. Providers may impose reasonable access limitations to address demonstrable security or integrity risks or prevent malicious misuse.
• A provider may direct users to a third-party tool if it complies with the statutory requirements, works with the provider’s latent disclosures, and is clearly and conspicuously accessible through the GenAI system’s interface.

Privacy Safeguards:

• The tool generally must not output detected personal information. An exception permits output where the person concerned expressly consents to including specified PI through a clear, conspicuous, plain-language notice. The notice must identify what PI may be output and explain that exported provenance becomes part of the file’s permanent digital footprint and cannot be retracted from copies already circulating.
• Providers must not collect, use, retain, sell, share, or otherwise make available PI derived from tool users or processed content beyond what is strictly necessary to comply with the chapter. A separate exception permits collecting, retaining, or using PI solely to communicate with a user who opts into contact. Access to the GenAI system or verification tool cannot depend on providing PI beyond what is strictly necessary for statutory compliance.

See, Cal. Bus & Prof. Code § 22757.2(a)(3), (c)–(d)

Providers must collect efficacy feedback and incorporate relevant feedback into efforts to improve the tool. See, Cal. Bus. & Prof. Code § 22757.2.

Practice Tip: Review both the tool and its supporting data flows. Address access restrictions, third-party integrations, API behavior, PI outputs, consent notices, necessity limits, and opted-in communications.

(2) Covered Providers Must Include Latent Disclosures: To the extent technically feasible, covered providers must include a latent disclosure in image, video, or audio content created or altered by their systems, except through minor modification.

The disclosure must convey, directly or through a permanent website:

• The provider’s name.
• The GenAI system’s name and version.
• The creation or alteration date and time.
• A unique identifier.
• Whether the system created or altered the content.
• Beginning January 1, 2029, whether the system is designed primarily as assistive technology.

The disclosure must be permanent or extraordinarily difficult to remove or tamper with, compatible with the provider’s verification tool, and compliant or interoperable with widely recognized industry standards.

Minor modifications include brightness, contrast, or color changes; sharpening; saturation; resizing; scaling; cropping; format conversion; and audio denoising or background-noise removal. See Cal. Bus. & Prof. Code §§ 22757.1(l) and 22757.3(a).

NOTE: SB 1000 removed the requirement that covered GenAI providers offer users the option to include a manifest (visible) disclosure. Providers can still offer visible labels voluntarily.

(3) Covered Providers Must Preserve Disclosure Capabilities When Licensing GenAI Systems: When licensing a GenAI system, a covered provider must notify the licensee of its obligations under the chapter. See, Cal. Bus. & Prof. Code § 22757.3(b)(1).

If the provider knows an identifiable licensee modified the system so it no longer complies, the provider must act within 72 hours of discovery. It may terminate the licensee’s authorization or notify the licensee of the noncompliance and the applicable Attorney General reporting requirement.

A licensee receiving notice must bring the system into compliance or cease using or making it available, including copies or modified versions, and report its action to the provider within 96 hours after receiving notice. The provider must report to the Attorney General if no report arrives or the report indicates that neither corrective action occurred.

The statute does not require providers to monitor, investigate, or inquire into licensees’ use or modification of their systems. See Cal. Bus. & Prof. Code § 22757.3(b)–(c).

Practice Tip: Licensing procedures should document the initial notice, assign responsibility for known noncompliance, and support the separate 72-hour provider and 96-hour licensee deadlines.

Licensing the Model Does Not Eliminate the Obligation to Provide Latent Disclosures.

Obligations of Large Online Platforms

Beginning January 1, 2027, large online platforms must detect, surface and preserve qualifying provenance information. These requirements were introduced by AB 853 (2025) and revised by AB 2713 (2026). See, Cal. Bus. & Prof. Code § 22757.3.1.

The Act imposes three principal obligations on these platforms.

(1) Detect and Surface Provenance Information: A platform must detect provenance data embedded in, attached to, or otherwise associated with content it distributes. Its user interface must reliably indicate whether system provenance data or a digital signature identifies the content as generated or substantially altered by a GenAI system, or captured by a capture device.

The interface must clearly and conspicuously provide information sufficient to identify the content’s authenticity, origin or modification history, including:

• Whether provenance data is associated with the content.
• The name of the GenAI system or capture device that created or substantially altered it, if applicable.
• Whether digital signatures are associated with the content.

See, Cal. Bus. & Prof. Code § 22757.3.1(a)(1)-(2).

(2) Make System Provenance Data Accessible: Platforms must allow users to inspect associated system provenance data in an easily accessible manner. They may display it directly, link to a website or application displaying it, or allow users to download provenance data.

The download option is subject to applicable federal copyright laws and requires a format that prevents the data from being easily embedded in, attached to, or associated with unrelated content.

Privacy Safeguard: The detection, interface and inspection obligations in subsection (a) do not require a large online platform to maintain, display or allow users to download personal information. This provision limits what the provenance requirements demand; it does not itself prohibit personal-information processing. See Cal. Bus. & Prof. Code § 22757.3.1(b).

See, Cal. Bus. & Prof. Code § 22757.3.1(a)(3).

Large online platforms serve as the bridge between machine-readable provenance information and the people encountering the content.

(3) Preserve Provenance Data and Digital Signatures: To the extent technically feasible, platforms must not knowingly strip system provenance data or digital signatures from content uploaded to, distributed on, or downloaded from the platform. See, Cal. Bus. & Prof. Code § 22757.3.1(c).

Standards Limitation: These requirements are subject to § 22757.3.1(d), which excludes action concerning provenance data or digital signatures that are not compliant or interoperable with widely adopted specifications issued by an established standards-setting body.

Practice Tip: Review how provenance enters, moves through and leaves the platform, including downloads. Check associated provenance and signatures, user access, privacy safeguards and the format of downloadable provenance data.

(3) Obligations of GenAI Hosting Platforms

The Act separately regulates GenAI hosting platforms, which should be treated as a distinct regulated category rather than folded into the obligations applicable to large online platforms.

Beginning January 1, 2027, a GenAI hosting platform must not knowingly make available a GenAI system that does not maintain the manifest- and latent-disclosure capabilities required by § 22757.3. See, Cal. Bus. & Prof. Code § 22757.3.2.

• SB 1000 removed the manifest-disclosure requirement from § 22757.3, although § 22757.3.2 continues to reference manifest and latent capabilities under that section. The hosting provision therefore retains language that should be read alongside the revised provider requirements.

This provision extends the Act beyond consumer-facing AI services to the infrastructure through which GenAI systems themselves can be distributed. In particular, it addresses the availability of downloadable source code and model weights, making GenAI hosting platforms another point in the provenance chain through which California seeks to preserve required disclosure capabilities.

(4) Obligations of Capture Device Manufacturers

Beginning January 1, 2028, the California AI Transparency Act extends its provenance framework beyond AI-generated content to the devices used to create photographs, audio, and video in the first place. For capture devices first produced for sale in California on or after that date, manufacturers must build provenance capabilities directly into the devices. See, Cal. Bus. & Prof. Code § 22757.3.3.

Obligations apply only to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body. See, Cal. Bus. & Prof. Code § 22757.3.3(b). This technical-standards limitation is important. The statute is not prescribing one particular authentication technology. Instead, it ties compliance to the development and adoption of interoperable provenance standards. C2PA is an important example of the type of interoperable content-provenance standard relevant to the Act’s broader technical ecosystem, although the statute does not lock compliance to a single named technical standard. (See, resources section for more on C2PA)

(1) Capture Device Manufacturers Must Offer Users a Latent Disclosure Option: For covered devices, manufacturers must give users the option to include a latent disclosure in content captured by the device. The disclosure must convey:

• the name of the capture device manufacturer;
• the name and version number of the capture device that created or altered the content; and
• the time and date of the content’s creation or alteration.

See, Cal. Bus. & Prof. Code § 22757.3.3(a)(1).

(2) Capture Device Manufacturers Must Embed Latent Disclosures by Default: The Act goes one step further than merely requiring manufacturers to make provenance functionality available. Covered capture devices must embed latent disclosures in captured content by default. See, Cal. Bus. & Prof. Code § 22757.3.3(a)(2).

Practice Tip: Think beyond AI labeling. The capture-device provisions show that California’s framework is evolving toward a broader digital-content authenticity infrastructure. The relevant question is increasingly not just “Was this content generated by AI?” but “Can we establish where this content came from?” Organizations should consider provenance across the entire content lifecycle: GenAI systems can embed provenance identifying synthetically generated or altered content, disclosure verification tools can verify that provenance, capture devices can establish provenance at the point of capture, and large online platforms can preserve and surface that information as content is distributed.

Enforcement: $5,000 Per Violation—and Each Day Can Count Separately

Violations are subject to a $5,000 civil penalty per violation.

Actions may be brought by:

• the California Attorney General;
• a city attorney; or
• a county counsel.

A prevailing plaintiff is also entitled to reasonable attorney's costs and fees.

Critically, each day that a covered provider, large online platform, or capture device manufacturer remains in violation constitutes a separate violation.

That provision can make continuing noncompliance significantly more consequential than the $5,000 headline figure initially suggests.

• SB 1000 also addresses actions filed before its effective date: an action cannot be maintained if the alleged conduct does not violate the chapter on and after that date.

A separate provision imposes a $50,000 civil penalty per violation for falsely representing that a GenAI system is designed primarily as assistive technology. Each day counts separately. Enforcement is available to the Attorney General, a city attorney, or county counsel, with reasonable attorney’s costs and fees for a prevailing plaintiff. This special penalty provision is repealed January 1, 2029. See Cal. Bus. & Prof. Code §§ 22757.4(c)–(d) and 22757.4.1.

The statute does not create a general private right of action.

See Cal. Bus. & Prof. Code § 22757.4.

Conclusion: From AI Labeling to Digital Content Authenticity

The California AI Transparency Act establishes a framework for verifying digital content’s origin and modification history. Following SB 1000, the provider requirements center on latent disclosures and disclosure verification tools. Covered providers no longer have to offer users an optional manifest disclosure, and the former one-million-user threshold no longer limits provider coverage.

The Bigger Picture: California Is Regulating the Content Lifecycle

The framework extends across the content lifecycle. GenAI providers create provenance information and make it verifiable; large online platforms preserve and surface qualifying provenance; hosting platforms address the distribution of noncompliant systems; and capture device manufacturers will establish provenance at the point of capture. Privacy safeguards accompany these transparency obligations, particularly where verification tools process personal information.

Compliance Considerations

Organizations should first identify which regulated categories apply to their activities, then assess the relevant requirements and operative dates.

• Covered GenAI providers: Assess whether their systems are publicly accessible within California and whether an exemption applies. Identify qualifying image, video, and audio outputs, distinguish minor modifications, and review latent disclosures for the required information, technical feasibility, durability, interoperability, and compatibility with verification tools.
• Disclosure verification tools: Review public access, upload and URL functionality, API support, and any third-party verification arrangement. Apply the statutory limits on PI processing, evaluate any consent-based PI output, and establish appropriate feedback and opted-in communication processes.
• Third-party licensing: Provide notice of licensees’ obligations and establish procedures for responding to known modifications that make a system noncompliant. Account for the provider’s 72-hour response deadline, the notified licensee’s 96-hour response deadline, and applicable reporting to the Attorney General. The statute does not impose a general duty to monitor licensees.
• Large online platforms: Prepare for the January 1, 2027 requirements by examining how qualifying provenance enters, moves through, and leaves the platform. Review detection, user-facing indicators, inspection and download options, and preservation during uploading, processing, distribution, and downloading. Account for the standards limitation and the provision clarifying that these duties do not require maintaining, displaying, or enabling downloads of PI.
• GenAI hosting platforms: Prepare for the January 1, 2027 restrictions on knowingly making noncompliant systems available. Review the hosting provision’s reference to disclosure capabilities alongside SB 1000’s removal of the provider manifest-disclosure requirement.
• Capture device manufacturers: Plan for the January 1, 2028 requirements applicable to devices first produced for sale in California on or after that date. Assess the hardware, firmware, metadata, and user controls needed to support the required latent-disclosure option and default embedding, subject to technical feasibility and applicable specifications.
• Exemptions and enforcement: Document any reliance on the exemption for exclusively non-user-generated videogames or the temporary exemption for GenAI systems designed primarily as assistive technology. Prepare for the latter exemption to end on January 1, 2029. Account for daily violations and the separate temporary penalty for false assistive-technology claims.

Practice Tip: Map provenance across the full content lifecycle. Identify where information is created, verified, transformed, displayed, downloaded, or lost, and assign responsibility for each applicable obligation. Review that map as products, distribution arrangements, and technical standards change.

The Act’s effectiveness will depend on whether provenance remains usable after content leaves its source. California is assigning responsibilities across that journey so that people and systems can examine where digital content came from and how it changed.

Additional Resources

Legal Authorities

• California AI Transparency Act — Cal. Bus. & Prof. Code §§ 22757–22757.6 — Current codified provisions establishing California’s framework for GenAI disclosures, provenance, disclosure verification tools, online platforms, GenAI hosting platforms, capture devices, and enforcement.
• SB 942 (2024) — California AI Transparency Act — The legislation that originally enacted the California AI Transparency Act.
• AB 853 (2025–2026) — Legislation expanding and revising the Act, including its provenance framework and obligations applicable to large online platforms, GenAI hosting platforms, and capture device manufacturers.
• AB 2713 (2026) — California AI Transparency Act: System Provenance Data — Amends Cal. Bus. & Prof. Code § 22757.3.1 concerning large online platforms’ provenance interfaces, inspection and download options, privacy safeguards, preservation duties and technical standards.
• SB 1000 (2026) — Revises provider coverage, provenance definitions, verification tools, latent disclosures, licensing procedures, exemptions, and enforcement. Enacted as an urgency statute effective September 30, 2026.
• California Consumer Privacy Act — Cal. Civ. Code § 1798.140 — Relevant because CATA incorporates the CCPA definition of “personal information” for its privacy safeguards.

Technical Standards & Guidance

• Coalition for Content Provenance and Authenticity (C2PA) — Industry initiative developing open technical standards for establishing and verifying the origin and history of digital content.
• C2PA Specifications — Technical specifications for interoperable content provenance and authenticity, useful for understanding the standards ecosystem relevant to the Act’s references to widely adopted provenance specifications.
• Content Credentials — Resources explaining how provenance and authenticity information can be attached to digital content and made available to people encountering that content.

From The de la Torre Review

• California Defines AI: AB 2885 and Its Impact — Explains California’s technology-neutral definition of artificial intelligence and provides context for the AI definition used by the Transparency Act.
• When Everything Is “Personal”: GDPR vs. CCPA — Explains the CCPA’s broad concept of personal information, relevant to CATA’s verification-tool safeguards and its distinction between system provenance information and information reasonably linkable to a consumer or household.