Board flags geofencing, AI and cross-border data risks in pending state bills affecting hearing aids and patient data

The board reviewed multiple bills moving through the California Legislature that board staff said could affect hearing aid data, advertising, and use of generative AI in consumer interfaces.

Maria Lorenzo, legislative and regulatory analyst, summarized three priority measures. AB 45 would bar geofencing and third‑party sharing of personal data to target in-person health care locations for certain purposes; staff noted the text may be broad and could unintentionally cover location data collected by hearing devices. “The language may be broad in that it may interfere with maybe location collection from hearing aid devices,” Lorenzo said.

Board members, including hearing aid dispenser Todd Borges and others, asked specific questions: if an app records where a user has been to switch programs automatically, does that information become protected health information when shared with a manufacturer? Borges said some devices and apps can “remember where you've been” and apply automatic program changes; another member noted many manufacturers are foreign-based and asked how cross-border data storage would interact with proposed restrictions.

Lorenzo also highlighted AB 485 (license denial for firms found to have unpaid wages) and AB 641 (authority to delay renewal or CPD deadlines during declared state emergencies). Board members discussed the practical effect of AB 641, noting prior pandemic waivers were executed at the DCA level and that the bill would give boards limited authority to delay deadlines but not to waive requirements.

Several bills on artificial intelligence and automated messaging were discussed. Lorenzo pointed to recent proposals that would require businesses to identify automated agents and to restrict using personal data for targeted advertising. Board members raised practical questions: do vendor bots that handle appointment scheduling or troubleshooting create liability for licensees if consumers believe they are interacting with a licensed professional?

Why it matters: Board staff said the intersection of device telemetry (geolocation, environment sensing), manufacturer data practices, and potential new statutory limits on cross-border data flows could impose compliance burdens on licensees and raise liability questions for dispensers who use manufacturer apps and cloud services.

Next steps: Staff recommended the board continue monitoring the bills, consider outreach to manufacturers about data storage and telemetry practices, and bring further analysis or draft comment language to a future meeting if the bills advance.

Ending: No formal position or vote was taken at this meeting. Staff will continue to track relevant legislation and notify licensees as appropriate.