Sections/AI & Privacy
AI & Privacy — state rules, federal deadlines.
AI governance and consumer privacy changes, with operative dates, coverage, and primary sources. This is a selected research inventory, not an exhaustive statement of the law.
50-state index
Source-linkedALAlabamaAKAlaskaAZArizonaARArkansasCACaliforniaCOColoradoCTConnecticutDEDelawareFLFloridaGAGeorgiaHIHawaiiIDIdahoILIllinoisINIndianaIAIowaKSKansasKYKentuckyLALouisianaMEMaineMDMarylandMAMassachusettsMIMichiganMNMinnesotaMSMississippiMOMissouriMTMontanaNENebraskaNVNevadaNHNew HampshireNJNew JerseyNMNew MexicoNYNew YorkNCNorth CarolinaNDNorth DakotaOHOhioOKOklahomaOROregonPAPennsylvaniaRIRhode IslandSCSouth CarolinaSDSouth DakotaTNTennesseeTXTexasUTUtahVTVermontVAVirginiaWAWashingtonWVWest VirginiaWIWisconsinWYWyoming
State laws in forceUpcoming state dutiesState research incomplete / monitor
Federal baseline records appear on every state page. A gray state does not mean there are no applicable laws.
Rules on the books & on the move
Source-linked| Ref | Rule | Status | Operative / deadline |
|---|---|---|---|
| CO SB 26-189 | Colorado AI Act replacement — consequential-decision dutiesColorado · Colorado: SB 26-189 became law and was signed May 14, 2026. It repeals/replaces the 2024 AI regime. Main… | Effective soon | 2027-01-01watch |
| DE 85 DEL LAWS C463 | Delaware 2027 privacy coverage and automated-decision amendmentsDelaware · From January 1, 2027, Delaware-targeting persons processing at least 10,000 consumers excluding payment-only processing, or… | Effective soon | 2027-01-01watch |
| 2026ch111§2; Minn.Stat.325M.40 | Stop Harms from Addictive Social MediaMinnesota · Covered social media platforms with10,000 or more account holders or at least$1billion worldwide revenues in any of the… | Effective soon | 2027-07-01watch |
| 820 ILCS 42 | Artificial Intelligence Video Interview ActIllinois · Employers asking applicants to record video interviews and using AI analysis of those interviews for positions based in… | Enacted | 2020-01-01in force |
| NYC Local Law144 (2021); Admin.Code20-870–874 | Automated employment decision tool bias audits and noticesNew York · Employers and employment agencies using covered AEDTs for hiring/promotion screening in New York City; notices apply to… | Enacted | 2023-01-01in force |
| 740 ILCS 14 | Biometric Information Privacy Act (BIPA)Illinois · Private entities collecting or possessing covered biometric identifiers or biometric information; statutory exclusions apply. | Enacted | 2008-10-03in force |
| CA AB 2013 | California AB 2013: GenAI training-data transparencyCalifornia · Developers designing, coding, producing, or substantially modifying GenAI systems/services publicly available to… | Enacted | 2026-01-01in force |
| CA SB 942 / AB 853 | California AI Transparency Act, SB 942 as amended by AB 853California · Covered GenAI providers with >1 million monthly visitors/users, publicly accessible in California: free detection tools and… | Enacted | 2026-08-02in force |
| CA CCPA RISK | California CCPA risk-assessment regulationsCalifornia · CCPA-covered businesses conducting specified significant-risk processing under §7150(b). This does not cover all small… | Enacted | 2026-01-01in force |
| CA CIV 1798.100–199.100 | California Consumer Privacy Act, as amended by CPRACalifornia · For-profit businesses doing business in California that satisfy the statutory revenue, consumer-volume, or… | Enacted | 2023-01-01in force |
| CA DROP | California Delete Act: DROPCalifornia · Registered data brokers, subject to exceptions; not every business processing personal data. | Enacted | 2026-08-01in force |
| CA SB 243 | California SB 243: companion chatbotsCalifornia · Operators offering companion-chatbot platforms in California: adaptive human-like interaction sustaining a social… | Enacted | 2026-01-01in force |
| CA SB 53 | California SB 53: Transparency in Frontier Artificial Intelligence ActCalifornia · Frontier-model developers: training compute >10²⁶ operations, including qualifying modifications. Expanded… | Enacted | 2026-01-01in force |
| CO SB 21-190 | Colorado Privacy ActColorado · Unverified — Controllers conducting business in Colorado or targeting Colorado residents that satisfy the statute’s…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2023-07-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| RCW 19.375; HB 1493 (2017) | Commercial biometric identifier enrollment restrictionsWashington · Non-government persons enrolling biometric identifiers in a database for the chapter’s narrow commercial purpose, including… | Enacted | 2017-07-23in force |
| HB2395 (2019); ORS646A.813 | Connected-device reasonable securityOregon · Manufacturers of connected devices sold or offered for sale in Oregon, subject to the statutory definitions and exclusions. | Enacted | 2020-01-01in force |
| CT PA 22-15 | Connecticut Data Privacy Act, base lawConnecticut · Unverified — Persons conducting business in Connecticut or targeting residents meeting the statutory consumer-processing or…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2023-07-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| PublicAct23-56 §2 | Consumer health data consent, confidentiality and geofencingConnecticut · Persons doing business in Connecticut or targeting products/services to residents when processing covered consumer health… | Enacted | 2023-07-01in force |
| DE 84 DEL LAWS C197 | Delaware Personal Data Privacy Act, base lawDelaware · Through December 31, 2026, persons conducting business in Delaware or targeting residents that in the preceding year… | Enacted | 2025-01-01in force |
| 28 CFR 202; 90 FR 1636 | DOJ Data Security Program — countries-of-concern data transactionsFederal · nationwide scope · U.S. persons engaging in defined covered data transactions involving bulk U.S. sensitive personal data or U.S.… | Enacted | 2025-04-08in force |
| PublicChapter588 (2024); HB2091/SB2096 | ELVIS Act voice and likeness protectionsTennessee · Persons undertaking covered unauthorized name, photograph, voice or likeness uses, including specified dissemination and… | Enacted | 2024-07-01in force |
| HHS 42 CFR PART 2 | Federal 42 CFR Part 2 confidentiality amendmentsFederal · nationwide scope · Federally assisted substance-use-disorder programs and recipients subject to Part 2. Consent/redisclosure, notices, breach… | Enacted | 2026-02-16in force |
| FTC COPPA | Federal COPPA rule amendmentsFederal · nationwide scope · Operators of child-directed online services, or operators with actual knowledge of collecting personal information from… | Enacted | 2026-04-22in force |
| FL CH2023-201 | Florida Digital Bill of RightsFlorida · Main controller duties apply to for-profit controllers with over $1 billion global gross annual revenue AND at least one… | Enacted | 2024-07-01in force |
| 16 CFR 682; 69 FR 68690 | FTC Disposal Rule — consumer-report information and recordsFederal · nationwide scope · Persons within FTC jurisdiction that maintain or otherwise possess consumer information derived from consumer reports for a… | Enacted | 2005-06-01in force |
| 16 CFR 313; 65 FR 33646 | FTC GLBA Privacy Rule — original final ruleFederal · nationwide scope · Unverified — Historical original rule for financial institutions under FTC privacy-rule jurisdiction. Present jurisdiction…Some details remain Unverified; see the field qualifications. | Enacted | 2001-07-01in force |
| 16 CFR 318; 89 FR 47028 | FTC Health Breach Notification Rule — 2024 amendmentsFederal · nationwide scope · Foreign and domestic vendors of personal health records, PHR-related entities and third-party service providers maintaining… | Enacted | 2024-07-29in force |
| 16 CFR 314; 86 FR 70272 | FTC Safeguards Rule — 2021 security-program amendmentsFederal · nationwide scope · Financial institutions within FTC Safeguards Rule jurisdiction that handle covered customer information, including… | Enacted | 2023-06-09in force |
| SB226 (2025); UtahCode13-75-101–106 | Generative AI consumer and regulated-service disclosuresUtah · Persons using or providing generative AI in covered consumer transactions; individuals in regulated occupations have… | Enacted | 2025-05-07in force |
| RCW 43.386; SB 6280 (2020) | Government facial recognition services safeguardsWashington · Washington state and local government agencies using facial recognition services; existing contracts transition on renewal… | Enacted | 2021-07-01in force |
| 45 CFR 164 subpart C; 68 FR 8334 | HIPAA Security Rule — original final security standardsFederal · nationwide scope · For this original-rule record: HIPAA-covered health plans, health care clearinghouses and health care providers that conduct… | Enacted | 2005-04-21in force |
| IL HB 3773 | Illinois HB 3773 / Public Act 103-0804, employment AIIllinois · Employers generally with one or more Illinois employees for 20+ weeks in the current/prior year. §2-102(L) prohibits AI uses… | Enacted | 2026-01-01in force |
| IN IC 24-15 | Indiana Consumer Data Protection Act, IC 24-15Indiana · Persons doing business in Indiana or targeting residents, processing 100,000+ consumers annually, or 25,000+ AND >50% gross… | Enacted | 2026-01-01in force |
| IA CODE715D | Iowa Consumer Data Protection ActIowa · Unverified — Persons conducting business in Iowa or targeting residents that satisfy the statute’s consumer-volume or…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2025-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| KY KCDPA | Kentucky Consumer Data Protection Act, KRS 367.3611–.3629Kentucky · Persons doing business in Kentucky or targeting residents, processing 100,000+ consumers, or 25,000+ AND >50% gross revenue… | Enacted | 2026-01-01in force |
| MD HB 711 | Maryland HB 711 / 2026 chapter 874: MODPA and geolocation amendmentsMaryland · MODPA controllers for business-facing provisions. Extends precise geolocation to a person/device/vehicle within 1,750 feet;… | Enacted | 2026-07-01in force |
| MD HB 567 | Maryland Online Data Privacy Act: application milestoneMaryland · Persons doing business in Maryland or targeting residents; 35,000+ consumers excluding payment-only processing, or 10,000+… | Enacted | 2026-04-01in force |
| MN STAT325M.10–.21 | Minnesota Consumer Data Privacy ActMinnesota · Legal entities doing business in Minnesota or targeting its residents that process at least 100,000 consumers excluding… | Enacted | 2025-07-31in force |
| MT SB384 / MCA30-14-28 | Montana Consumer Data Privacy ActMontana · Unverified — Controllers conducting business in Montana or targeting residents that meet the applicable current…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2024-10-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| RCW 19.373; HB 1155 (2023) | My Health My Data ActWashington · Regulated entities doing business in Washington or targeting Washington consumers and determining consumer-health-data… | Enacted | 2024-03-31in force |
| NE RS87-1101–1130 | Nebraska Data Privacy ActNebraska · Unverified — Persons conducting business in Nebraska or producing goods/services consumed by residents and…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2025-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| SB 370 (2023); NRS 603A.400–.550 | Nevada consumer health data privacy lawNevada · Regulated entities conducting business in Nevada or targeting Nevada products/services and determining health-data… | Enacted | 2024-03-31in force |
| SB220 (2019); NRS603A.300–.360 | Nevada online personal-information sale opt-outNevada · Covered commercial online operators collecting Nevada consumers’ information and purposefully doing business in or targeting… | Enacted | 2019-10-01in force |
| NH RSA507-H | New Hampshire personal-data privacy lawNew Hampshire · Unverified — Persons doing business in New Hampshire or targeting residents that satisfy the statute’s consumer-processing…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2025-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| NJ PL2023-C266 | New Jersey Data Privacy ActNew Jersey · Unverified — Controllers doing business in New Jersey or targeting its residents that meet the statute’s consumer-processing…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2025-01-15 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| OR OCPA UOOM | Oregon Consumer Privacy Act: universal opt-out mechanismsOregon · Covered businesses/nonprofits must honor qualifying signals. General threshold: 100,000+ consumers excluding payment-only… | Enacted | 2026-01-01in force |
| HB2052 (2023); ORS646A.593 | Oregon data broker registrationOregon · Businesses collecting and selling or licensing brokered personal data of Oregon residents, subject to the act’s… | Enacted | 2024-01-01in force |
| OR HB 2008 | Oregon HB 2008 / 2025 chapter 251: children and precise-location restrictionsOregon · OCPA controllers: no targeted advertising or consequential profiling where they know/willfully disregard that a consumer is… | Enacted | 2026-01-01in force |
| HB24-1130 | Privacy of Biometric Identifiers and DataColorado · Persons controlling or processing one or more biometric identifiers, subject to the act’s exceptions; includes specified… | Enacted | 2025-07-01in force |
| RI 6-48.1 | Rhode Island Data Transparency and Privacy Protection ActRhode Island · Main controller duties: for-profit businesses targeting/doing business in Rhode Island, 35,000+ customers excluding… | Enacted | 2026-01-01in force |
| 17 CFR 248.30; 89 FR 47688 | SEC Regulation S-P — incident response and customer-notification amendmentsFederal · nationwide scope · Covered brokers and dealers, investment companies, SEC-registered investment advisers and transfer agents registered with… | Enacted | 2025-12-03in force |
| SHIELD Act; GBL899-aa/899-bb; S5575B (2019) | SHIELD Act private-information security safeguardsNew York · Persons or businesses owning or licensing computerized data containing New York residents’ private information;… | Enacted | 2020-03-21in force |
| 1Sp2025ch3 art19§§13–14; Minn.Stat.325M.335 | Social media mental health warning labelMinnesota · Covered social media platforms under Minn.Stat.325M.31–.32: doing business in or targeting Minnesota and having more… | Enacted | 2026-07-01in force |
| TN PC408 / TCA47-18-32 | Tennessee Information Protection ActTennessee · Unverified — Persons conducting business in Tennessee or targeting residents that meet the revenue AND…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2025-07-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| SB2105 (2023); Business&CommerceCodeCh509 | Texas data broker registration and securityTexas · Covered data brokers whose principal revenue is from indirect-source personal data and that, over12months, derive more… | Enacted | 2023-12-01in force |
| TX HB4 / B&C541 | Texas Data Privacy and Security ActTexas · Persons conducting business in Texas or producing products/services consumed by residents, processing or selling personal… | Enacted | 2024-07-01in force |
| TX HB 149 | Texas Responsible Artificial Intelligence Governance Act, HB 149Texas · Persons conducting/promoting business in Texas, producing products/services used by Texans, or developing/deploying AI in… | Enacted | 2026-01-01in force |
| UT CODE13-61 | Utah Consumer Privacy ActUtah · Unverified — Controllers/processors conducting business in Utah or targeting residents that meet the revenue AND…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2023-12-31 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| 9VSA2446–2447; Act171 (2018) | Vermont data broker registration and securityVermont · Businesses knowingly collecting and selling or licensing brokered personal information of consumers with whom they lack a… | Enacted | 2019-01-01in force |
| VA CODE59.1-575–585 | Virginia Consumer Data Protection ActVirginia · Unverified — Persons doing business in Virginia or targeting residents that satisfy the consumer-volume or data-sale…Some details remain Unverified; see the field qualifications. | Enacted | Unverified — 2023-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| CT PA 25-113 | Connecticut PA 25-113 privacy amendments — verification holdConnecticut · Unverified — Current CT AG guidance identifies expanded coverage: 35,000+ consumers excluding payment-only processing, or…Some details remain Unverified; see the field qualifications. | Enacted | Unverifiedmonitor |
| CT PA 26-64 | Connecticut PA 26-64 privacy amendments — verification holdConnecticut · Unverified — CT AG guidance includes precise-geolocation sales restrictions and facial-recognition conditions. Official…Some details remain Unverified; see the field qualifications. | Enacted | Unverifiedmonitor |
| NY RAISE HOLD | New York RAISE Act — verification holdNew York · Unverified — New York Senate S6953B official bill history records signed chapter 699 on December 19, 2025. It is an enacted…Some details remain Unverified; see the field qualifications. | Enacted | Unverifiedmonitor |
63 records · no paywallFederal baseline →
Based on 63 tracked records, reviewed Nov 13, 2026. Legal status is separate from the Unverified labels on individual detail fields.
Matrix preview — first 2 of 63 tracked rows
Source-linked| State | Law | Operative / deadline | Detail review |
|---|---|---|---|
| CA | California AB 2013: GenAI training-data transparencyDevelopers designing, coding, producing, or substantially modifying GenAI systems/services publicly available to…Enacted / in force | 2026-01-01 | Reviewed |
| CA | California AI Transparency Act, SB 942 as amended by AB 853Covered GenAI providers with >1 million monthly visitors/users, publicly accessible in California: free detection tools and…Enacted / in force | 2026-08-02 | Reviewed |
| CA | California Consumer Privacy Act, as amended by CPRADownloadable comparison fields in the matrix edition. | Locked | Locked |
| CA | California CCPA risk-assessment regulationsDownloadable comparison fields in the matrix edition. | Locked | Locked |
61 more tracked rows, plus a 50-state coverage sheet — one-time $149.View the matrix →
The complete public tracker remains free. The paid file packages comparison fields and edition history.