Sections/AI & Privacy
AI & Privacy — state rules, federal deadlines.
AI governance and consumer privacy changes, with operative dates, coverage, and primary sources. This is a selected research inventory, not an exhaustive statement of the law.
50-state index
Source-linkedALAlabamaAKAlaskaAZArizonaARArkansasCACaliforniaCOColoradoCTConnecticutDEDelawareFLFloridaGAGeorgiaHIHawaiiIDIdahoILIllinoisINIndianaIAIowaKSKansasKYKentuckyLALouisianaMEMaineMDMarylandMAMassachusettsMIMichiganMNMinnesotaMSMississippiMOMissouriMTMontanaNENebraskaNVNevadaNHNew HampshireNJNew JerseyNMNew MexicoNYNew YorkNCNorth CarolinaNDNorth DakotaOHOhioOKOklahomaOROregonPAPennsylvaniaRIRhode IslandSCSouth CarolinaSDSouth DakotaTNTennesseeTXTexasUTUtahVTVermontVAVirginiaWAWashingtonWVWest VirginiaWIWisconsinWYWyoming
State laws in forceUpcoming state dutiesState research incomplete / monitor
Federal baseline records appear on every state page. A gray state does not mean there are no applicable laws.
Rules on the books & on the move
Source-linked| Ref | Rule | Status | Jurisdiction | Eff. date |
|---|---|---|---|---|
| CO SB 26-189 | Colorado AI Act replacement — consequential-decision dutiesColorado: SB 26-189 became law and was signed May 14, 2026. It repeals/replaces the 2024 AI regime. Main… | Effective soon | Colorado | 2027-01-01watch |
| DE 85 DEL LAWS C463 | Delaware 2027 privacy coverage and automated-decision amendmentsFrom January 1, 2027, Delaware-targeting persons processing at least 10,000 consumers excluding payment-only processing, or… | Effective soon | Delaware | 2027-01-01watch |
| 2026ch111§2; Minn.Stat.325M.40 | Stop Harms from Addictive Social MediaCovered social media platforms with10,000 or more account holders or at least$1billion worldwide revenues in any of the… | Effective soon | Minnesota | 2027-07-01watch |
| 820 ILCS 42 | Artificial Intelligence Video Interview ActEmployers asking applicants to record video interviews and using AI analysis of those interviews for positions based in… | Enacted | Illinois | 2020-01-01in force |
| NYC Local Law144 (2021); Admin.Code20-870–874 | Automated employment decision tool bias audits and noticesEmployers and employment agencies using covered AEDTs for hiring/promotion screening in New York City; notices apply to… | Enacted | New York | 2023-01-01in force |
| 740 ILCS 14 | Biometric Information Privacy Act (BIPA)Private entities collecting or possessing covered biometric identifiers or biometric information; statutory exclusions apply. | Enacted | Illinois | 2008-10-03in force |
| CA AB 2013 | California AB 2013: GenAI training-data transparencyDevelopers designing, coding, producing, or substantially modifying GenAI systems/services publicly available to… | Enacted | California | 2026-01-01in force |
| CA SB 942 / AB 853 | California AI Transparency Act, SB 942 as amended by AB 853Covered GenAI providers with >1 million monthly visitors/users, publicly accessible in California: free detection tools and… | Enacted | California | 2026-08-02in force |
| CA CCPA RISK | California CCPA risk-assessment regulationsCCPA-covered businesses conducting specified significant-risk processing under §7150(b). This does not cover all small… | Enacted | California | 2026-01-01in force |
| CA CIV 1798.100–199.100 | California Consumer Privacy Act, as amended by CPRAFor-profit businesses doing business in California that satisfy the statutory revenue, consumer-volume, or… | Enacted | California | 2023-01-01in force |
| CA DROP | California Delete Act: DROPRegistered data brokers, subject to exceptions; not every business processing personal data. | Enacted | California | 2026-08-01in force |
| CA SB 243 | California SB 243: companion chatbotsOperators offering companion-chatbot platforms in California: adaptive human-like interaction sustaining a social… | Enacted | California | 2026-01-01in force |
| CA SB 53 | California SB 53: Transparency in Frontier Artificial Intelligence ActFrontier-model developers: training compute >10²⁶ operations, including qualifying modifications. Expanded… | Enacted | California | 2026-01-01in force |
| CO SB 21-190 | Colorado Privacy ActUnverified — Controllers conducting business in Colorado or targeting Colorado residents that satisfy the statute’s…Some details remain Unverified; see the field qualifications. | Enacted | Colorado | Unverified — 2023-07-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| RCW 19.375; HB 1493 (2017) | Commercial biometric identifier enrollment restrictionsNon-government persons enrolling biometric identifiers in a database for the chapter’s narrow commercial purpose, including… | Enacted | Washington | 2017-07-23in force |
| HB2395 (2019); ORS646A.813 | Connected-device reasonable securityManufacturers of connected devices sold or offered for sale in Oregon, subject to the statutory definitions and exclusions. | Enacted | Oregon | 2020-01-01in force |
| CT PA 22-15 | Connecticut Data Privacy Act, base lawUnverified — Persons conducting business in Connecticut or targeting residents meeting the statutory consumer-processing or…Some details remain Unverified; see the field qualifications. | Enacted | Connecticut | Unverified — 2023-07-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| PublicAct23-56 §2 | Consumer health data consent, confidentiality and geofencingPersons doing business in Connecticut or targeting products/services to residents when processing covered consumer health… | Enacted | Connecticut | 2023-07-01in force |
| DE 84 DEL LAWS C197 | Delaware Personal Data Privacy Act, base lawThrough December 31, 2026, persons conducting business in Delaware or targeting residents that in the preceding year… | Enacted | Delaware | 2025-01-01in force |
| 28 CFR 202; 90 FR 1636 | DOJ Data Security Program — countries-of-concern data transactionsU.S. persons engaging in defined covered data transactions involving bulk U.S. sensitive personal data or U.S.… | Enacted | Federal · nationwide scope | 2025-04-08in force |
| PublicChapter588 (2024); HB2091/SB2096 | ELVIS Act voice and likeness protectionsPersons undertaking covered unauthorized name, photograph, voice or likeness uses, including specified dissemination and… | Enacted | Tennessee | 2024-07-01in force |
| HHS 42 CFR PART 2 | Federal 42 CFR Part 2 confidentiality amendmentsFederally assisted substance-use-disorder programs and recipients subject to Part 2. Consent/redisclosure, notices, breach… | Enacted | Federal · nationwide scope | 2026-02-16in force |
| FTC COPPA | Federal COPPA rule amendmentsOperators of child-directed online services, or operators with actual knowledge of collecting personal information from… | Enacted | Federal · nationwide scope | 2026-04-22in force |
| FL CH2023-201 | Florida Digital Bill of RightsMain controller duties apply to for-profit controllers with over $1 billion global gross annual revenue AND at least one… | Enacted | Florida | 2024-07-01in force |
| 16 CFR 682; 69 FR 68690 | FTC Disposal Rule — consumer-report information and recordsPersons within FTC jurisdiction that maintain or otherwise possess consumer information derived from consumer reports for a… | Enacted | Federal · nationwide scope | 2005-06-01in force |
| 16 CFR 313; 65 FR 33646 | FTC GLBA Privacy Rule — original final ruleUnverified — Historical original rule for financial institutions under FTC privacy-rule jurisdiction. Present jurisdiction…Some details remain Unverified; see the field qualifications. | Enacted | Federal · nationwide scope | 2001-07-01in force |
| 16 CFR 318; 89 FR 47028 | FTC Health Breach Notification Rule — 2024 amendmentsForeign and domestic vendors of personal health records, PHR-related entities and third-party service providers maintaining… | Enacted | Federal · nationwide scope | 2024-07-29in force |
| 16 CFR 314; 86 FR 70272 | FTC Safeguards Rule — 2021 security-program amendmentsFinancial institutions within FTC Safeguards Rule jurisdiction that handle covered customer information, including… | Enacted | Federal · nationwide scope | 2023-06-09in force |
| SB226 (2025); UtahCode13-75-101–106 | Generative AI consumer and regulated-service disclosuresPersons using or providing generative AI in covered consumer transactions; individuals in regulated occupations have… | Enacted | Utah | 2025-05-07in force |
| RCW 43.386; SB 6280 (2020) | Government facial recognition services safeguardsWashington state and local government agencies using facial recognition services; existing contracts transition on renewal… | Enacted | Washington | 2021-07-01in force |
| 45 CFR 164 subpart C; 68 FR 8334 | HIPAA Security Rule — original final security standardsFor this original-rule record: HIPAA-covered health plans, health care clearinghouses and health care providers that conduct… | Enacted | Federal · nationwide scope | 2005-04-21in force |
| IL HB 3773 | Illinois HB 3773 / Public Act 103-0804, employment AIEmployers generally with one or more Illinois employees for 20+ weeks in the current/prior year. §2-102(L) prohibits AI uses… | Enacted | Illinois | 2026-01-01in force |
| IN IC 24-15 | Indiana Consumer Data Protection Act, IC 24-15Persons doing business in Indiana or targeting residents, processing 100,000+ consumers annually, or 25,000+ AND >50% gross… | Enacted | Indiana | 2026-01-01in force |
| IA CODE715D | Iowa Consumer Data Protection ActUnverified — Persons conducting business in Iowa or targeting residents that satisfy the statute’s consumer-volume or…Some details remain Unverified; see the field qualifications. | Enacted | Iowa | Unverified — 2025-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| KY KCDPA | Kentucky Consumer Data Protection Act, KRS 367.3611–.3629Persons doing business in Kentucky or targeting residents, processing 100,000+ consumers, or 25,000+ AND >50% gross revenue… | Enacted | Kentucky | 2026-01-01in force |
| MD HB 711 | Maryland HB 711 / 2026 chapter 874: MODPA and geolocation amendmentsMODPA controllers for business-facing provisions. Extends precise geolocation to a person/device/vehicle within 1,750 feet;… | Enacted | Maryland | 2026-07-01in force |
| MD HB 567 | Maryland Online Data Privacy Act: application milestonePersons doing business in Maryland or targeting residents; 35,000+ consumers excluding payment-only processing, or 10,000+… | Enacted | Maryland | 2026-04-01in force |
| MN STAT325M.10–.21 | Minnesota Consumer Data Privacy ActLegal entities doing business in Minnesota or targeting its residents that process at least 100,000 consumers excluding… | Enacted | Minnesota | 2025-07-31in force |
| MT SB384 / MCA30-14-28 | Montana Consumer Data Privacy ActUnverified — Controllers conducting business in Montana or targeting residents that meet the applicable current…Some details remain Unverified; see the field qualifications. | Enacted | Montana | Unverified — 2024-10-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| RCW 19.373; HB 1155 (2023) | My Health My Data ActRegulated entities doing business in Washington or targeting Washington consumers and determining consumer-health-data… | Enacted | Washington | 2024-03-31in force |
| NE RS87-1101–1130 | Nebraska Data Privacy ActUnverified — Persons conducting business in Nebraska or producing goods/services consumed by residents and…Some details remain Unverified; see the field qualifications. | Enacted | Nebraska | Unverified — 2025-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| SB 370 (2023); NRS 603A.400–.550 | Nevada consumer health data privacy lawRegulated entities conducting business in Nevada or targeting Nevada products/services and determining health-data… | Enacted | Nevada | 2024-03-31in force |
| SB220 (2019); NRS603A.300–.360 | Nevada online personal-information sale opt-outCovered commercial online operators collecting Nevada consumers’ information and purposefully doing business in or targeting… | Enacted | Nevada | 2019-10-01in force |
| NH RSA507-H | New Hampshire personal-data privacy lawUnverified — Persons doing business in New Hampshire or targeting residents that satisfy the statute’s consumer-processing…Some details remain Unverified; see the field qualifications. | Enacted | New Hampshire | Unverified — 2025-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| NJ PL2023-C266 | New Jersey Data Privacy ActUnverified — Controllers doing business in New Jersey or targeting its residents that meet the statute’s consumer-processing…Some details remain Unverified; see the field qualifications. | Enacted | New Jersey | Unverified — 2025-01-15 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| OR OCPA UOOM | Oregon Consumer Privacy Act: universal opt-out mechanismsCovered businesses/nonprofits must honor qualifying signals. General threshold: 100,000+ consumers excluding payment-only… | Enacted | Oregon | 2026-01-01in force |
| HB2052 (2023); ORS646A.593 | Oregon data broker registrationBusinesses collecting and selling or licensing brokered personal data of Oregon residents, subject to the act’s… | Enacted | Oregon | 2024-01-01in force |
| OR HB 2008 | Oregon HB 2008 / 2025 chapter 251: children and precise-location restrictionsOCPA controllers: no targeted advertising or consequential profiling where they know/willfully disregard that a consumer is… | Enacted | Oregon | 2026-01-01in force |
| HB24-1130 | Privacy of Biometric Identifiers and DataPersons controlling or processing one or more biometric identifiers, subject to the act’s exceptions; includes specified… | Enacted | Colorado | 2025-07-01in force |
| RI 6-48.1 | Rhode Island Data Transparency and Privacy Protection ActMain controller duties: for-profit businesses targeting/doing business in Rhode Island, 35,000+ customers excluding… | Enacted | Rhode Island | 2026-01-01in force |
| 17 CFR 248.30; 89 FR 47688 | SEC Regulation S-P — incident response and customer-notification amendmentsCovered brokers and dealers, investment companies, SEC-registered investment advisers and transfer agents registered with… | Enacted | Federal · nationwide scope | 2025-12-03in force |
| SHIELD Act; GBL899-aa/899-bb; S5575B (2019) | SHIELD Act private-information security safeguardsPersons or businesses owning or licensing computerized data containing New York residents’ private information;… | Enacted | New York | 2020-03-21in force |
| 1Sp2025ch3 art19§§13–14; Minn.Stat.325M.335 | Social media mental health warning labelCovered social media platforms under Minn.Stat.325M.31–.32: doing business in or targeting Minnesota and having more… | Enacted | Minnesota | 2026-07-01in force |
| TN PC408 / TCA47-18-32 | Tennessee Information Protection ActUnverified — Persons conducting business in Tennessee or targeting residents that meet the revenue AND…Some details remain Unverified; see the field qualifications. | Enacted | Tennessee | Unverified — 2025-07-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| SB2105 (2023); Business&CommerceCodeCh509 | Texas data broker registration and securityCovered data brokers whose principal revenue is from indirect-source personal data and that, over12months, derive more… | Enacted | Texas | 2023-12-01in force |
| TX HB4 / B&C541 | Texas Data Privacy and Security ActPersons conducting business in Texas or producing products/services consumed by residents, processing or selling personal… | Enacted | Texas | 2024-07-01in force |
| TX HB 149 | Texas Responsible Artificial Intelligence Governance Act, HB 149Persons conducting/promoting business in Texas, producing products/services used by Texans, or developing/deploying AI in… | Enacted | Texas | 2026-01-01in force |
| UT CODE13-61 | Utah Consumer Privacy ActUnverified — Controllers/processors conducting business in Utah or targeting residents that meet the revenue AND…Some details remain Unverified; see the field qualifications. | Enacted | Utah | Unverified — 2023-12-31 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| 9VSA2446–2447; Act171 (2018) | Vermont data broker registration and securityBusinesses knowingly collecting and selling or licensing brokered personal information of consumers with whom they lack a… | Enacted | Vermont | 2019-01-01in force |
| VA CODE59.1-575–585 | Virginia Consumer Data Protection ActUnverified — Persons doing business in Virginia or targeting residents that satisfy the consumer-volume or data-sale…Some details remain Unverified; see the field qualifications. | Enacted | Virginia | Unverified — 2023-01-01 (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.)in force |
| CT PA 25-113 | Connecticut PA 25-113 privacy amendments — verification holdUnverified — Current CT AG guidance identifies expanded coverage: 35,000+ consumers excluding payment-only processing, or…Some details remain Unverified; see the field qualifications. | Enacted | Connecticut | Unverifiedmonitor |
| CT PA 26-64 | Connecticut PA 26-64 privacy amendments — verification holdUnverified — CT AG guidance includes precise-geolocation sales restrictions and facial-recognition conditions. Official…Some details remain Unverified; see the field qualifications. | Enacted | Connecticut | Unverifiedmonitor |
| NY RAISE HOLD | New York RAISE Act — verification holdUnverified — New York Senate S6953B official bill history records signed chapter 699 on December 19, 2025. It is an enacted…Some details remain Unverified; see the field qualifications. | Enacted | New York | Unverifiedmonitor |
63 records · no paywallFederal baseline →
Based on 63 tracked records, reviewed Nov 13, 2026. Legal status is separate from the Unverified labels on individual detail fields.
Matrix preview — first 2 of 63 tracked rows
Source-linked| State | Law | Operative / deadline | Detail review |
|---|---|---|---|
| CA | California AB 2013: GenAI training-data transparencyDevelopers designing, coding, producing, or substantially modifying GenAI systems/services publicly available to…Enacted / in force | Operative / deadline2026-01-01 | Detail reviewReviewed |
| CA | California AI Transparency Act, SB 942 as amended by AB 853Covered GenAI providers with >1 million monthly visitors/users, publicly accessible in California: free detection tools and…Enacted / in force | Operative / deadline2026-08-02 | Detail reviewReviewed |
| CA | California Consumer Privacy Act, as amended by CPRADownloadable comparison fields in the matrix edition. | Operative / deadlineLocked | Detail reviewLocked |
| CA | California CCPA risk-assessment regulationsDownloadable comparison fields in the matrix edition. | Operative / deadlineLocked | Detail reviewLocked |
61 more tracked rows, plus a 50-state coverage sheet — one-time $149.View the matrix →
The complete public tracker remains free. The paid file packages comparison fields and edition history.