Key takeaways
- AB 853 extends the AI Transparency Act from generative-AI providers to the companies that distribute content: large online platforms, GenAI hosting platforms and capture device manufacturers.
- Large online platforms (over 2,000,000 unique monthly users in California) and GenAI hosting platforms must comply from 1 January 2027; capture device manufacturers from 1 January 2028.
- AB 2713 rewrote the platform duty before it starts: detect provenance data, show users whether it is present, let them inspect it (a link to a third party's website or app is allowed), and don't strip it, including on download.
- The platform duty is multi-standard detection, not single-vendor: a platform need not act on provenance that is not compliant or interoperable with widely adopted specifications from an established standards body.
- AB 853 also moved the original covered-provider duties from 1 January 2026 to 2 August 2026, and SB 1000 has since rewritten them — see the SB 942 page for those.
What AB 853 requires
AB 853 extends California's AI Transparency Act beyond the companies that generate AI content to the companies that distribute it. From 1 January 2027, large online platforms must detect provenance data in the content they carry, show users what it says, and not strip it. GenAI hosting platforms must not knowingly distribute systems that omit the required disclosure. From 1 January 2028, capture device manufacturers must offer provenance at the point of capture.
AB 853 amends the chapter created by SB 942. It also moved the original covered-provider duties from 1 January 2026 to 2 August 2026 — see the California SB 942 guide for those. AB 2713, signed on 30 September 2026, amends the platform section (§ 22757.3.1) again, operative from the same 1 January 2027 date.
Three new parties, three different duties
The most useful thing to establish first is which of these you are — the duties do not overlap, and none of them is the covered-provider duty.
| Who it means | From | |
|---|---|---|
| Large online platform | A public-facing social media platform, file-sharing platform, mass messaging platform or standalone search engine with over 2,000,000 unique monthly users in California. Broadband and telephone services are excluded | 1 Jan 2027 |
| GenAI hosting platform | A platform that makes generative AI systems available for download | 1 Jan 2027 |
| Capture device manufacturer | Makers of devices that capture content — cameras, phones and similar | 1 Jan 2028 |
Note the threshold difference that trips people up: since SB 1000, a covered provider under SB 942 has no user threshold at all; a large online platform under AB 853 is defined at 2,000,000 unique monthly users in California. Different tests, different duties, and a company can be both.
The platform duty, in detail
From 1 January 2027, as amended by AB 2713, a large online platform must:
- detect provenance data in content distributed on the platform;
- show users, in an interface that does so reliably, whether system provenance data or a digital signature identifies the content as generated or substantially altered by generative AI, or as captured by a capture device: whether provenance data is present, the name of the GenAI system or capture device, and whether digital signatures are present;
- let users inspect the system provenance data, in any of three ways: in the platform's own interface, through a link to a website or app that displays it, including one operated by a third party, or as a download; and
- not knowingly strip system provenance data or digital signatures from content that is uploaded, distributed or downloaded, to the extent technically feasible.
A platform does not have to keep, display or offer for download personal information.
The phrase that matters is widely adopted specifications. AB 2713 says a platform need not act on provenance data or signatures that are not compliant or interoperable with widely adopted specifications issued by an established standards-setting body. This is a multi-standard detection obligation, not a single-vendor one. In practice that means C2PA first, because it is the standard with the broadest adoption — and a platform cannot satisfy this duty by integrating one vendor's proprietary detector.
The do-not-strip requirement is the operationally awkward one, and AB 2713 extends it to downloads. Most platforms strip metadata as a side effect of re-encoding on upload; they are not doing it deliberately, which is precisely why it will take engineering work to stop. Preserving a C2PA manifest through a transcode pipeline is a real change, and it is the reason a durable watermark matters here: it is the layer that survives when the manifest does not.
Hosting platforms and capture devices
GenAI hosting platforms — 1 January 2027
A platform that makes generative AI systems available for download must not knowingly make available a system that does not include the latent disclosure a covered provider is required to embed.
“Knowingly” is doing a lot of work in that sentence, and the statute does not define a diligence standard. The practical reading is that a hosting platform needs some means of establishing whether a listed system emits a compliant disclosure, rather than an affirmative duty to test every model.
Capture device manufacturers — 1 January 2028
Device makers must give users the option to include a latent disclosure in content the device captures, and to include provenance data reflecting the device's authenticity.
This is the inverse of the rest of the Act: everywhere else provenance marks content as synthetic, and here it marks content as captured. Both ends of the same problem — and the reason the capture side gets an extra year is that it needs hardware cycles, not a software release.
Dates
- AB 853 signed and chaptered. Source
- Covered-provider duties operative, moved by AB 853 from 1 January 2026.
- AB 2713 signed, rewriting the large online platform duties before they start. SB 1000 signed the same day, rewriting the covered-provider duties. Source
- Large online platform duties (as amended by AB 2713) and GenAI hosting platform duties become operative.
- Capture device manufacturer duties become operative.
What a platform actually needs
The platform duty is a detection-and-display problem, not a marking one. That is a different product from the one a covered provider needs.
| The duty | Tier | How Verda meets it |
|---|---|---|
| Detect provenance compliant with widely adopted standards | Compliance | Read signed C2PA manifests first, and fall back to watermark detection when the manifest has been stripped |
| Show provenance to users and let them inspect it | Provenance | A resolvable record — provider, system, version, timestamp — rather than a bare 'AI-generated' flag. AB 2713 lets a platform link users to a third party's website or app for the inspection step |
| Do not strip provenance or signatures, including on download | Compliance | Preserve manifests through transcode where possible; the embedded watermark survives the cases where that fails |
| Not required by AB 853 | Identity | Optionally resolve to a verified organisation — useful against impersonation, not required by the statute |
Verda writes signed C2PA manifests alongside the watermark and is registered on the C2PA soft-binding algorithm list for image, audio and video.
Common questions
Who counts as a large online platform under AB 853?
A public-facing social media platform, file-sharing platform, mass messaging platform or standalone search engine with over 2,000,000 unique monthly users in California. Broadband internet access and telephone services are excluded.
Is AB 853 a separate law from SB 942?
No. AB 853 amends the chapter SB 942 created. It added duties for large online platforms, GenAI hosting platforms and capture device manufacturers, and moved the covered-provider duties to 2 August 2026. AB 2713 amended the platform duties again in 2026.
What did AB 2713 change for platforms?
AB 2713, signed on 30 September 2026 and operative from 1 January 2027, sets out what a large online platform must show: whether provenance data is present, the name of the GenAI system or capture device, and whether digital signatures are present. Users must be able to inspect the provenance data in the platform's interface, through a link to a website or app (including a third party's), or as a download. The do-not-strip duty now covers downloads, and a platform need not act on provenance that is not compliant or interoperable with widely adopted specifications from an established standards-setting body.
Can a platform comply by using one vendor's detector?
The duty is to detect provenance data, and AB 2713 says a platform need not act on provenance that is not compliant or interoperable with widely adopted specifications from an established standards-setting body. That points at C2PA rather than any single vendor's scheme. A platform needs multi-standard detection.
What if our pipeline strips metadata during transcoding?
That is the substance of the do-not-strip duty, which AB 2713 extends to content users download. Most platforms strip metadata incidentally when re-encoding rather than deliberately. Preserving manifests through transcode is engineering work, and an embedded watermark is what remains readable where preservation fails.
Does this affect me?
Tell us about your platform and we'll walk you through what AB 853 requires and how Verda's detection covers it.