https://complyroom.comSource-linked AI and privacy rule records. Not legal advice.Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/california/ca-ab2013-training-data/ca-ab2013-training-dataDevelopers designing, coding, producing, or substantially modifying GenAI systems/services publicly available to Californians, including free products; covers releases from January 1, 2022 onward. Limited security, aircraft, and federal national-security/military exclusions. Source: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/california/ca-ai-transparency-ab853/ca-ai-transparency-ab853Covered GenAI providers with >1 million monthly visitors/users, publicly accessible in California: free detection tools and provenance/disclosure duties. Separate platform/hosting duties begin January 1, 2027; capture-device provisions begin January 1, 2028. Source: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/california/ca-ccpa-consolidated/ca-ccpa-consolidatedFor-profit businesses doing business in California that satisfy the statutory revenue, consumer-volume, or sale/share-revenue tests; exclusions apply. The current inflation-adjusted revenue threshold is not established by this row. Provide required collection and privacy notices. Honor applicable access, deletion and correction rights. Honor sale/sharing opt-outs and applicable sensitive-data limits. Source: https://oag.ca.gov/privacy/ccpaFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/california/ca-ccpa-risk-assessments/ca-ccpa-risk-assessmentsCCPA-covered businesses conducting specified significant-risk processing under §7150(b). This does not cover all small businesses or make every ADMT/audit duty operative in 2026. Source: https://cppa.ca.gov/regulations/ccpa_updates.htmlFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/california/ca-drop-delete-act/ca-drop-delete-actRegistered data brokers, subject to exceptions; not every business processing personal data. Source: https://privacy.ca.gov/drop/Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/california/ca-sb243-companion-chatbots/ca-sb243-companion-chatbotsOperators offering companion-chatbot platforms in California: adaptive human-like interaction sustaining a social relationship. Excludes operational/customer-service/productivity bots, certain games, and simple voice assistants. AI disclosures, self-harm protocols, and extra known-minor safeguards apply. Source: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/california/ca-sb53-frontier-ai/ca-sb53-frontier-aiFrontier-model developers: training compute >10²⁶ operations, including qualifying modifications. Expanded safety-framework/reporting duties apply to large frontier developers, with affiliates' combined prior-year gross revenue >$500 million. Other transparency, incident, and employee-protection provisions reach frontier developers more broadly. Source: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/colorado/co-biometric-privacy-2024/co-biometric-privacy-2024Persons controlling or processing one or more biometric identifiers, subject to the act’s exceptions; includes specified restrictions on employers obtaining employee biometric consent. Adopt the required written retention, deletion and security-incident-response policy; make it public except where exempt. Meet the act’s disclosure and consent requirements before collecting a biometric identifier. Observe limits on the reasons an employer may obtain consent to collect an employee’s biometric identifiers. Source: https://leg.colorado.gov/bills/hb24-1130Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/colorado/co-sb26189-ai-consequential-decisions/co-sb26189-ai-consequential-decisionsColorado: SB 26-189 became law and was signed May 14, 2026. It repeals/replaces the 2024 AI regime. Main ADMT/consequential-decision duties begin January 1, 2027; an August 2026 compliance deadline is outdated. The signed act is the primary text. Source: https://leg.colorado.gov/bills/sb26-189Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/connecticut/ct-consumer-health-privacy-2023/ct-consumer-health-privacy-2023Persons doing business in Connecticut or targeting products/services to residents when processing covered consumer health data, without the general CTDPA volume thresholds; §2 entity and data exemptions apply. Permit employee or contractor access to consumer health data only under a contractual or statutory confidentiality duty and use compliant processor arrangements. Do not sell or offer to sell consumer health data without first obtaining consumer consent. Do not use a geofence within1,750feet of a mental-health or reproductive/sexual-health facility for the prohibited health-data identification, tracking, collection or notification purposes. Source: https://www.cga.ct.gov/2023/ACT/PA/PDF/2023PA-00056-R00SB-00003-PA.PDFFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/delaware/de-2027-privacy-amendments/de-2027-privacy-amendmentsFrom January 1, 2027, Delaware-targeting persons processing at least 10,000 consumers excluding payment-only processing, or at least 5,000 AND deriving over 20% of gross revenue from sales, plus covered third parties acquiring data from a controller. Exemptions apply. Apply the revised controller/third-party coverage tests. Provide covered adverse-action notices, data access/correction and technically feasible human review, subject to statutory exceptions. Apply amended notice, controller-duty and assessment provisions. Source: https://delcode.delaware.gov/title6/c012d/index.htmlFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/delaware/de-personal-data-privacy-act/de-personal-data-privacy-actThrough December 31, 2026, persons conducting business in Delaware or targeting residents that in the preceding year processed at least 35,000 consumers excluding payment-only data, or at least 10,000 consumers AND derived over 20% of gross revenue from data sales; statutory exemptions apply. Provide required notices and respond to authenticated consumer-rights requests. Provide sale/targeted-advertising opt-outs, including qualifying opt-out signals from January 1, 2026. Obtain required sensitive-data consent and conduct applicable data-protection assessments. Source: https://delcode.delaware.gov/title6/c012d/index.htmlFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/federal-coppa-amendments/federal-coppa-amendmentsOperators of child-directed online services, or operators with actual knowledge of collecting personal information from children under 13. Certain third-party disclosures require separate parental consent; amended retention/security and personal-information provisions also apply. Source: https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-ruleFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/federal-part2-confidentiality/federal-part2-confidentialityFederally assisted substance-use-disorder programs and recipients subject to Part 2. Consent/redisclosure, notices, breach notification, and enforcement changes. Does not cover every business or health record. Source: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.htmlFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/florida/fl-digital-bill-of-rights/fl-digital-bill-of-rightsMain controller duties apply to for-profit controllers with over $1 billion global gross annual revenue AND at least one specified online-advertising, smart-speaker/virtual-assistant, or large app-store condition. General applicability and exemptions remain in §§501.703–.704; separate sensitive-data-sale provisions can have wider reach. Provide required privacy notices and respond to authenticated consumer requests. Offer applicable sale, targeted-advertising and profiling opt-outs. Conduct required risk assessments and comply with applicable sensitive-data-consent duties. Source: https://laws.flrules.org/2023/201Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/illinois/il-ai-video-interview-act/il-ai-video-interview-actEmployers asking applicants to record video interviews and using AI analysis of those interviews for positions based in Illinois. Before the interview, notify the applicant of AI use, explain how it works and the general characteristics evaluated, and obtain consent. Share videos only with people whose expertise or technology is necessary to evaluate the applicant. On applicant request, delete interviews within 30 days and instruct recipients to delete their copies and backups. Source: https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/illinois/il-biometric-information-privacy-act/il-biometric-information-privacy-actPrivate entities collecting or possessing covered biometric identifiers or biometric information; statutory exclusions apply. Publish and follow a retention/destruction policy: purpose satisfied or three years after the last interaction, whichever comes first. Before collection, give written notice of collection, purpose and retention term, and obtain a written release. Do not sell or profit from biometric information; apply the statutory disclosure and protective-storage restrictions. Source: https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/illinois/il-hb3773-employment-ai/il-hb3773-employment-aiEmployers generally with one or more Illinois employees for 20+ weeks in the current/prior year. §2-102(L) prohibits AI uses producing protected-class discrimination and ZIP-code proxies; employee notice is required, with DHR rules addressing circumstances/timing/means. Cross-tag with /ai-privacy. Source: https://www.ilga.gov/Legislation/publicacts/view/103-0804Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/indiana/in-consumer-data-protection/in-consumer-data-protectionPersons doing business in Indiana or targeting residents, processing 100,000+ consumers annually, or 25,000+ AND >50% gross revenue from personal-data sales. Entity/data exemptions apply; employment/commercial contexts are excluded from the consumer definition. Source: https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/kentucky/ky-consumer-data-protection/ky-consumer-data-protectionPersons doing business in Kentucky or targeting residents, processing 100,000+ consumers, or 25,000+ AND >50% gross revenue from sales. Government, financial/HIPAA entities, nonprofits, higher education, and other exemptions apply. Source: https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspxFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/maryland/md-hb711-geolocation/md-hb711-geolocationMODPA controllers for business-facing provisions. Extends precise geolocation to a person/device/vehicle within 1,750 feet; restricts certain personal-data sales to government units for civil immigration enforcement. Other provisions concern government records/systems. Source: https://mgaleg.maryland.gov/2026RS/Chapters_noln/CH_874_hb0711t.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/maryland/md-online-data-privacy/md-online-data-privacyPersons doing business in Maryland or targeting residents; 35,000+ consumers excluding payment-only processing, or 10,000+ AND >20% gross revenue from sales. Strict minimization/sensitive-data limitations; state-specific exemptions apply. This is a 2026 application milestone, not a newly effective 2026 law. Source: https://mgaleg.maryland.gov/2024rs/chapters_noln/ch_454_hb0567e.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/minnesota/mn-addictive-social-media-2026/mn-addictive-social-media-2026Covered social media platforms with10,000 or more account holders or at least$1billion worldwide revenues in any of the preceding3years; duties concern covered Minnesota account holders and children age15or younger, subject to definitions and exclusions. Estimate age on the statutory usage/time schedule; obtain verifiable parental consent to create or continue a child account and retain consent records. Default child accounts to the most private settings and provide the required parental time-monitoring and limit controls. Do not show addictive interface features or targeted paid commercial advertising to child accounts; meet account-termination deadlines. Source: https://www.revisor.mn.gov/statutes/cite/325M/fullFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/minnesota/mn-consumer-data-privacy/mn-consumer-data-privacyLegal entities doing business in Minnesota or targeting its residents that process at least 100,000 consumers excluding payment-only data, or at least 25,000 consumers AND derive over 25% of gross revenue from data sales. Small-business and institutional exceptions apply; covered higher-education institutions have a separate July 31, 2029 transition. Provide required privacy notices and respond to consumer-rights requests. Provide applicable opt-outs and required information/review rights for consequential profiling. Maintain applicable data inventory, security safeguards and data-protection assessments. Source: https://www.revisor.mn.gov/statutes/cite/325M/fullFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/minnesota/mn-social-media-mental-health-label/mn-social-media-mental-health-labelCovered social media platforms under Minn.Stat.325M.31–.32: doing business in or targeting Minnesota and having more than10,000 monthly active Minnesota account holders; statutory platform exclusions apply. Show the required conspicuous mental-health warning each time a user accesses the covered platform. Keep the warning visible until the user exits or acknowledges the risk and chooses to proceed; do not permit blanket disabling or obscure it in terms. Follow commissioner-developed label guidelines and provide access to mental-health resources, including a national crisis hotline such as988. Source: https://www.revisor.mn.gov/statutes/cite/325M/fullFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/nevada/nv-consumer-health-data/nv-consumer-health-dataRegulated entities conducting business in Nevada or targeting Nevada products/services and determining health-data processing; consumers reside in Nevada or have health data collected there in connection with a requested product or service. Statutory exclusions apply. Publish the required consumer health data privacy policy. Obtain collection/sharing consent except where necessary for the consumer-requested product or service. Obtain a separate valid authorization for a sale of consumer health data. Source: https://www.leg.state.nv.us/NRS/NRS-603A.htmlFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/nevada/nv-online-sale-opt-out/nv-online-sale-opt-outCovered commercial online operators collecting Nevada consumers’ information and purposefully doing business in or targeting Nevada; the current chapter also covers data brokers under later amendments. Statutory financial, health and other exclusions apply. Provide the chapter’s required online privacy notice. Maintain a designated request address and honor verified requests not to sell covered information. Respond to verified opt-out requests within 60 days; a reasonably necessary extension may add up to 30 days with notice. Source: https://www.leg.state.nv.us/Session/80th2019/Bills/SB/SB220_EN.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/new-york/ny-shield-data-security/ny-shield-data-securityPersons or businesses owning or licensing computerized data containing New York residents’ private information; size-appropriate safeguards and statutory deemed-compliance provisions apply. Maintain reasonable administrative safeguards including responsible staff, risk assessment, training and service-provider controls. Maintain reasonable technical safeguards covering network/software risks, attack detection, response and testing. Maintain reasonable physical safeguards and securely dispose of private information when no longer needed for business purposes. Source: https://ag.ny.gov/resources/organizations/data-breach-reporting/shield-actFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/new-york/nyc-automated-employment-decision-tools/nyc-automated-employment-decision-toolsEmployers and employment agencies using covered AEDTs for hiring/promotion screening in New York City; notices apply to covered candidates and employees residing in the city. Official DCWP guidance includes specified NYC-office-linked remote roles. Obtain an independent bias audit no more than one year before covered tool use. Publish the required summary of audit results and the tool’s distribution date before use. Provide required AEDT and qualification/characteristic notices at least ten business days before use. Source: https://legistar.council.nyc.gov/LegislationDetail.aspx?ID=4344524&GUID=B051915D-A9AC-451E-81F8-6596032FA3F9Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/oregon/or-connected-device-security/or-connected-device-securityManufacturers of connected devices sold or offered for sale in Oregon, subject to the statutory definitions and exclusions. Equip a covered device with reasonable security appropriate to its nature, function and collected or transmitted information. Protect the device and its stored information against unauthorized access, destruction, use, modification or disclosure. Where authentication outside a local-area network is possible, use a unique preprogrammed password or require the user to create a new means of authentication before first access. Source: https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2019orLaw0193.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/oregon/or-data-broker-registration/or-data-broker-registrationBusinesses collecting and selling or licensing brokered personal data of Oregon residents, subject to the act’s direct-relationship, FCRA, GLBA and other exclusions. Register with the Department of Consumer and Business Services before engaging in covered data-broker business. Pay the registration fee and renew the registration each calendar year. Submit the required contact information and disclosures about consumer opt-out practices. Source: https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2023orLaw0395.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/oregon/or-hb2008-children-location/or-hb2008-children-locationOCPA controllers: no targeted advertising or consequential profiling where they know/willfully disregard that a consumer is under 16; no selling those minors' data; no selling data locating a person/device within 1,750 feet, subject to specified exclusions. Source: https://www.oregonlegislature.gov/bills_laws/lawsstatutes/2025orLaw0251.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/oregon/or-universal-opt-out/or-universal-opt-outCovered businesses/nonprofits must honor qualifying signals. General threshold: 100,000+ consumers excluding payment-only processing, or 25,000+ AND ≥25% annual gross revenue from sales. Current statute also covers relevant motor-vehicle manufacturers/affiliates irrespective of thresholds. Source: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/rhode-island/ri-data-transparency-privacy/ri-data-transparency-privacyMain controller duties: for-profit businesses targeting/doing business in Rhode Island, 35,000+ customers excluding payment-only processing, or 10,000+ AND >20% gross revenue from sales. Separate §3 commercial website/service disclosures have no numerical threshold and concern collecting, storing and selling PII within the provision's scope. Source: https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htmFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/tennessee/tn-elvis-ai-voice-likeness/tn-elvis-ai-voice-likenessPersons undertaking covered unauthorized name, photograph, voice or likeness uses, including specified dissemination and tools/services primarily intended to produce unauthorized representations; statutory speech, fair-use and other exceptions apply. Obtain authorization for covered commercial uses of another person’s protected name, photograph, voice or likeness. Avoid covered knowing unauthorized publication, distribution or transmission of another person’s voice or likeness. Authorization requirements and statutory exceptions apply to covered technology or services primarily intended to produce unauthorized protected representations. Source: https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=SB2096&GA=113Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/texas/tx-data-broker-registration-security/tx-data-broker-registration-securityCovered data brokers whose principal revenue is from indirect-source personal data and that, over12months, derive more than50% of revenue from processing/transferring such data or derive revenue from doing so for more than50,000 Texas individuals; statutory data/entity exemptions apply. Register with the secretary of state to conduct covered business, pay the statutory $300 fee and renew on the registration anniversary. Post the required conspicuous data-broker notice on a maintained website or mobile app. Maintain a written comprehensive information-security program with administrative, technical and physical safeguards. Source: https://capitol.texas.gov/tlodocs/88R/billtext/html/SB02105F.htmFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/texas/tx-data-privacy-security-act/tx-data-privacy-security-actPersons conducting business in Texas or producing products/services consumed by residents, processing or selling personal data, and not SBA-defined small businesses. Small businesses separately need prior consent for sensitive-data sales; entity/data exemptions apply. Provide required notices and process authenticated rights requests. Offer applicable sale, targeted-advertising and profiling opt-outs. Obtain required sensitive-data consent and conduct required data-protection assessments. Source: https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htmFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/texas/tx-hb149-responsible-ai/tx-hb149-responsible-aiPersons conducting/promoting business in Texas, producing products/services used by Texans, or developing/deploying AI in Texas. Restrictions differ by actor/use. Governmental-AI and healthcare disclosures are specific provisions, not a disclosure rule for every private AI interaction. Source: https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htmFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/us-doj-data-security-2025/us-doj-data-security-2025U.S. persons engaging in defined covered data transactions involving bulk U.S. sensitive personal data or U.S. government-related data and countries of concern or covered persons. Transaction categories, data thresholds, exemptions and licensing rules control; this is not a general ban on all cross-border data flows. Identify covered counterparties, covered data and transactions; avoid prohibited data-brokerage and other prohibited transactions unless authorized. Conduct restricted transactions only when authorized and compliant with the applicable security requirements. Perform applicable due diligence, audits, recordkeeping and reporting, including the phased-in obligations. Source: https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concernFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/us-ftc-disposal-rule/us-ftc-disposal-rulePersons within FTC jurisdiction that maintain or otherwise possess consumer information derived from consumer reports for a business purpose; can include users of consumer reports and service providers. This is not a universal disposal rule for every type of personal information. Take reasonable measures to prevent unauthorized access to or use of covered consumer information in connection with its disposal. Implement and monitor appropriate paper-destruction and electronic-media erasure or destruction practices; the rule’s examples are illustrative rather than exclusive safe harbors. Where using a disposal contractor, perform appropriate due diligence and monitor contractual compliance; preserve retention duties imposed by other law. Source: https://www.federalregister.gov/documents/2004/11/24/04-25937/disposal-of-consumer-report-information-and-recordsFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/us-ftc-health-breach-2024/us-ftc-health-breach-2024Foreign and domestic vendors of personal health records, PHR-related entities and third-party service providers maintaining information of U.S. citizens or residents. Excludes HIPAA-covered entities and other entities to the extent they act as a HIPAA business associate; coverage is not limited by FTC Act jurisdictional tests. Assess unauthorized acquisition or disclosure of unsecured PHR-identifiable health information as a potential breach, including unauthorized access unless rebutted with reliable evidence. Notify affected individuals, the FTC and qualifying media under the rule; third-party service providers notify the PHR vendor or related entity. Follow the amended timing, content and delivery requirements and retain evidence supporting compliance and any delay. Source: https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-ruleFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/us-ftc-safeguards-2021/us-ftc-safeguards-2021Financial institutions within FTC Safeguards Rule jurisdiction that handle covered customer information, including applicable non-bank financial institutions and finders. Institutions maintaining customer information concerning fewer than 5,000 consumers have specified exceptions, not a complete exemption. Designate a qualified individual and maintain a written information-security program based on risk assessment. Implement applicable access controls, encryption or approved compensating controls, multifactor authentication or approved equivalents, testing and secure disposal. Oversee service providers and implement applicable incident-response, reporting and board-governance controls, respecting the limited small-institution exceptions. Source: https://www.federalregister.gov/documents/2021/12/09/2021-25736/standards-for-safeguarding-customer-informationFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/us-hipaa-security-base/us-hipaa-security-baseFor this original-rule record: HIPAA-covered health plans, health care clearinghouses and health care providers that conduct covered electronic transactions, protecting electronic PHI. Small health plans had an additional year. Later direct business-associate duties are not attributed to this 2003 instrument. Implement required administrative, physical and technical safeguards to protect electronic PHI. Perform risk analysis and risk management and apply reasonable and appropriate safeguards, including evaluating addressable implementation specifications. Maintain required security policies, procedures, documentation and business-associate contractual assurances under the original rule. Source: https://www.federalregister.gov/documents/2003/02/20/03-3877/health-insurance-reform-security-standardsFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/federal/us-sec-regulation-sp-2024/us-sec-regulation-sp-2024Covered brokers and dealers, investment companies, SEC-registered investment advisers and transfer agents registered with the SEC or another appropriate regulatory agency. Funding portals follow the applicable requirements through Regulation Crowdfunding. Larger and smaller covered institutions have different compliance periods. Adopt and maintain written incident-response policies to detect, respond to and recover from unauthorized access to or use of customer information. Provide the required customer notices as soon as reasonably practicable and generally within 30 days, subject to the rule’s investigation exceptions and authorized delay provisions. Oversee service providers, safeguard and dispose of covered information, and maintain the required written records. Source: https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-informationFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/utah/ut-generative-ai-consumer-disclosures/ut-generative-ai-consumer-disclosuresPersons using or providing generative AI in covered consumer transactions; individuals in regulated occupations have additional duties for high-risk AI interactions. In a covered consumer interaction, disclose that the person is interacting with generative AI when the consumer unambiguously asks. For regulated services involving high-risk AI interaction, prominently disclose AI use verbally at the start of a verbal interaction and in writing before a written interaction. Comply with regulated-occupation requirements and do not treat generative-AI use as a defense to consumer-protection liability. Source: https://le.utah.gov/~2025/bills/sbillenr/SB0226.pdfFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/vermont/vt-data-broker-registration-security/vt-data-broker-registration-securityBusinesses knowingly collecting and selling or licensing brokered personal information of consumers with whom they lack a direct relationship, subject to statutory exclusions. Under the version in effect through2026, register by January31 following a qualifying year, pay the $100 fee and submit required practice/minor/breach disclosures. Maintain the written comprehensive information-security program required by§2447. Apply appropriate access controls, employee training, encryption and service-provider safeguards required by§2447. Source: https://legislature.vermont.gov/statutes/section/09/062/02430Fri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/washington/wa-biometric-identifiers-commercial/wa-biometric-identifiers-commercialNon-government persons enrolling biometric identifiers in a database for the chapter’s narrow commercial purpose, including third-party marketing unrelated to the initial transaction; security and law-enforcement uses are excluded. Before commercial enrollment, provide notice and consent or a mechanism to prevent subsequent use for a commercial purpose. Restrict disclosures and materially inconsistent uses under RCW 19.375.020. Use reasonable care to secure identifiers and retain them no longer than reasonably necessary under the statute. Source: https://app.leg.wa.gov/RCW/default.aspx?cite=19.375&full=trueFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/washington/wa-government-facial-recognition/wa-government-facial-recognitionWashington state and local government agencies using facial recognition services; existing contracts transition on renewal or extension as provided by the chapter. Before covered deployment, file a notice of intent and develop the required accountability report and public process. Provide meaningful human review of facial-recognition results used in consequential decisions. Meet the chapter’s testing, training and reporting safeguards. Source: https://app.leg.wa.gov/RCW/default.aspx?cite=43.386&full=trueFri, 13 Nov 2026 00:00:00 GMThttps://complyroom.com/ai-privacy/washington/wa-my-health-my-data/wa-my-health-my-dataRegulated entities doing business in Washington or targeting Washington consumers and determining consumer-health-data processing; includes small businesses on their later date. Consumers include Washington residents and people whose health data is collected in Washington; employment context is excluded. Publish a consumer health data privacy policy with the required categories, purposes and sharing disclosures. Obtain collection/sharing consent unless the processing is necessary to provide a consumer-requested product or service. Obtain separate valid authorization before a health-data sale and honor the chapter’s access/deletion rights. Source: https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=trueFri, 13 Nov 2026 00:00:00 GMT