California has enacted a new law requiring providers of generative artificial intelligence systems to embed hidden digital fingerprints, or provenance data, into AI-generated images, videos, and audio. The California AI Transparency Act, which took effect on August 2, aims to provide a traceable history for synthetic media, allowing users to identify which AI system produced the content and when.
State Sen. Josh Becker authored the original legislation, SB 942, which was later expanded by AB 853. The law applies to "covered providers"—companies with generative AI systems accessible in California that serve more than 1 million monthly users. These providers must embed a "latent disclosure" within AI-generated media, containing information such as the provider's name, the AI system's name and version, the creation or alteration date and time, and a unique identifier, whenever technically feasible.
This embedded information is intended to remain permanent or be extraordinarily difficult to remove. The law focuses these requirements on visual and auditory content, not AI-generated text. Additionally, covered providers must offer users the option to apply a visible label identifying the content as AI-generated.
Detection Tools and Limitations
Under the new law, covered AI providers must also offer a free detection tool. Users can upload or link to content to check if it was created or altered by that specific provider's AI system. These tools will display any found provenance information. However, a tool from one company may not identify media generated by another, and a negative result does not definitively prove human creation.
The law also includes privacy safeguards, generally prohibiting providers from collecting personal user information or retaining submitted content longer than necessary. Violations can result in civil penalties of up to $5,000 per day.
Provenance data acts as a digital history for a file, potentially identifying the source system and modification timeline. The Coalition for Content Provenance and Authenticity (C2PA) has developed standards like Content Credentials for this purpose. While this data can help identify AI-generated content and potentially flag scams, such as voice cloning, it does not verify the truthfulness of the content itself. C2PA emphasizes that provenance data provides evidence of origin and history but cannot confirm accuracy; authentic footage can still be edited out of context.
Future Requirements for Platforms and Devices
Beginning January 1, 2027, the law will extend to large online platforms, including social media services, file-sharing platforms, mass messaging services, and search engines with over 2 million unique monthly users. These platforms will be required to detect compatible provenance data in content they distribute and inform users when such data is available, indicating the AI system or capture device if applicable. Platforms must also not knowingly strip this data if preservation is technically feasible.
Starting January 1, 2028, the law will apply to new phones, cameras, and voice recorders manufactured for sale in California. Manufacturers will need to offer users the option to embed hidden disclosures in captured content, with default embedding required when technically feasible. This could include manufacturer and device model information, along with creation or alteration timestamps.
Rationale and Broader Implications
California lawmakers have expressed concerns about the rapid advancement of AI capabilities, including real-time deepfakes that can impersonate individuals and spread misinformation, particularly in political contexts and financial scams. Generative AI can create convincing fake political ads or mimic trusted individuals, leading to significant financial losses or election interference.
Federal lawmakers are also addressing AI regulation. Proposals like the AI Ads Act and the AI Labeling Act aim to establish disclosure requirements for AI-generated content, but have not yet become law. California's approach embeds identifying information directly into files, which can travel with the content across platforms, provided that websites and editing tools preserve these credentials.
Other states are also implementing AI regulations, often focusing on political content. Colorado requires metadata in certain political deepfakes, Utah mandates tamper-evident digital provenance for synthetic political media, and Louisiana is introducing disclosure rules for AI-generated telephone campaign communications. The European Union's AI Act also includes provisions for detecting generated or manipulated content.
The widespread adoption of a single provenance system by large tech companies, driven by California's law and international regulations, could lead to nationwide benefits even before individual states enact similar measures. However, the effectiveness of these regulations hinges on enforcement and the consistent preservation and display of provenance information by platforms and tools.
Limits of the Law
The California AI Transparency Act has limitations. The absence of provenance data does not guarantee content is human-made; it could originate from smaller AI providers or be from before the law's effective date. Furthermore, some editing software may not preserve embedded information, and processes like screenshots or file compression can strip credentials. C2PA also notes that provenance records can be incomplete, and a lack of credentials does not automatically render content untrustworthy. Crucially, a valid credential does not attest to the truthfulness of the content.
California's new law provides an additional tool for users to scrutinize potentially synthetic media. While digital fingerprints can offer clues about a file's origin, critical evaluation of the source, corroboration with other reliable sources, and awareness of urgency tactics remain essential for discerning truth from falsehood in the digital landscape.