California AB 853: what large online platforms must ship by 1 January 2027
The duties AB 853 added for platforms, GenAI hosting services and capture device makers — who is covered, and what detection actually requires.
What AB 853 requires
AB 853 extends California's AI Transparency Act beyond the companies that generate AI content to the companies that distribute it. From 1 January 2027, large online platforms must detect standards-compliant provenance data in the content they carry, display it to users, and not strip it. GenAI hosting platforms must not knowingly distribute systems that omit the required disclosure. From 1 January 2028, capture device manufacturers must offer provenance at the point of capture.
AB 853 amends the chapter created by SB 942. It also moved the original covered-provider duties from 1 January 2026 to 2 August 2026 — see the SB 942 page for those.
Three new parties, three different duties
The most useful thing to establish first is which of these you are — the duties do not overlap, and none of them is the covered-provider duty.
| Party | Who it means | From |
|---|---|---|
| Large online platform | A public-facing social media platform, file-sharing platform, mass messaging platform or standalone search engine with over 2,000,000 unique monthly users in California. Broadband and telephone services are excluded | 1 Jan 2027 |
| GenAI hosting platform | A platform that makes generative AI systems available for download | 1 Jan 2027 |
| Capture device manufacturer | Makers of devices that capture content — cameras, phones and similar | 1 Jan 2028 |
Note the threshold difference that trips people up: a covered provider under SB 942 is measured at 1,000,000 monthly users; a large online platform under AB 853 at 2,000,000 unique monthly users in California. Different tests, different duties, and a company can be both.
The platform duty, in detail
From 1 January 2027, a large online platform must:
- detect whether content distributed on the platform carries provenance data that complies with a widely adopted standard;
- display that provenance to users, in the manner the statute specifies; and
- not strip or remove it.
The phrase that matters is widely adopted standard. This is a multi-standard detection obligation, not a single-vendor one. In practice that means C2PA first, because it is the standard with the broadest adoption — and a platform cannot satisfy this duty by integrating one vendor's proprietary detector.
The third requirement is the operationally awkward one. Most platforms strip metadata as a side effect of re-encoding on upload; they are not doing it deliberately, which is precisely why it will take engineering work to stop. Preserving a C2PA manifest through a transcode pipeline is a real change, and it is the reason a durable watermark matters here: it is the layer that survives when the manifest does not.
Hosting platforms and capture devices
GenAI hosting platforms — 1 January 2027
A platform that makes generative AI systems available for download must not knowingly make available a system that does not include the latent disclosure a covered provider is required to embed.
“Knowingly” is doing a lot of work in that sentence, and the statute does not define a diligence standard. The practical reading is that a hosting platform needs some means of establishing whether a listed system emits a compliant disclosure, rather than an affirmative duty to test every model.
Capture device manufacturers — 1 January 2028
Device makers must give users the option to include a latent disclosure in content the device captures, and to include provenance data reflecting the device's authenticity.
This is the inverse of the rest of the Act: everywhere else provenance marks content as synthetic, and here it marks content as captured. Both ends of the same problem — and the reason the capture side gets an extra year is that it needs hardware cycles, not a software release.
Dates
- AB 853 signed and chaptered. Source
- Covered-provider duties operative, moved by AB 853 from 1 January 2026.
- Large online platform and GenAI hosting platform duties become operative.
- Capture device manufacturer duties become operative.
What a platform actually needs
The platform duty is a detection-and-display problem, not a marking one. That is a different product from the one a covered provider needs.
| The duty | Tier | How Verda meets it |
|---|---|---|
| Detect provenance compliant with widely adopted standards | Compliance | Read signed C2PA manifests first, and fall back to watermark detection when the manifest has been stripped |
| Display provenance to users | Provenance | A resolvable record — provider, system, version, timestamp — rather than a bare 'AI-generated' flag |
| Do not strip or remove provenance | Compliance | Preserve manifests through transcode where possible; the embedded watermark survives the cases where that fails |
| Not required by AB 853 | Identity | Optionally resolve to a verified organisation — useful against impersonation, not required by the statute |
Verda writes signed C2PA manifests alongside the watermark and is registered on the C2PA soft-binding algorithm list for image, audio and video.
Common questions
Who counts as a large online platform under AB 853?
A public-facing social media platform, file-sharing platform, mass messaging platform or standalone search engine with over 2,000,000 unique monthly users in California. Broadband internet access and telephone services are excluded.
Is AB 853 a separate law from SB 942?
No. AB 853 amends the chapter SB 942 created. It added the platform, hosting and capture-device duties, and moved the covered-provider duties to 2 August 2026.
Can a platform comply by using one vendor's detector?
The duty is to detect provenance that complies with a widely adopted standard, which points at C2PA rather than at any single vendor's scheme. A platform needs multi-standard detection; a proprietary-only detector does not satisfy it.
What if our pipeline strips metadata during transcoding?
That is the substance of the “do not strip” duty, and most platforms strip metadata incidentally rather than deliberately. Preserving manifests through transcode is engineering work; an embedded watermark is what remains readable in the cases where preservation fails.
Have a question?
Reach out to us at bd@verda.ai