Gov. Gavin Newsom has until end of day Wednesday, September 30, to sign or veto what remains of California’s 2026 AI and privacy docket, and the bill that matters most to small-business marketers is still unsigned. SB 1000 would remove the one-million-monthly-user threshold that currently defines a “covered provider” under the California AI Transparency Act, pulling every generative-AI operator serving California consumers into scope, according to Kelley Drye’s session tracker.

It’s an urgency measure. Signature triggers immediate effect, and Kelley Drye pegs civil penalties at $5,000 per violation per day. SB 1000 drops the earlier manifest-disclosure language but keeps the harder requirement: latent, machine-readable provenance embedded in AI-generated content, the kind of C2PA-style signal that has to be baked in at generation time rather than bolted on before a campaign goes live.

The already-decided pieces reshape the same terrain. On September 16, Newsom signed SB 1050, which requires ad disclosures “substantially similar” to “this performance features a synthetic digital performer” whenever AI-generated human-like figures appear. Venable notes it takes effect January 1, 2027, alongside our earlier coverage of the signed SB 1050 disclosure rules for AI-generated ad performers. On September 27, Newsom signed SB 923, extending CCPA deletion rights to personal information collected “from or about” a consumer, including from third-party sources, per Venable. That reaches directly into the audience-data supply chain small teams rely on for acquisition targeting. The same day, he vetoed AB 1542, which would’ve banned the sale and sharing of sensitive personal information outright.

Anything Newsom doesn’t touch by Tuesday becomes law without his signature. For a fuller rundown of the bills still alive before the deadline, the compliance clock is already running: inventory the AI creative, verify provenance on every asset, and treat January 1, 2027, as a hard deadline rather than a horizon.

Sources

Sources