US State AI and Privacy Laws: Map and Guide

Alabama

Privacy law

• Alabama Personal Data Protection Act (HB 351) Takes effect May 1, 2027 Covers: Persons doing business in Alabama or targeting its residents that control or process data of more than 25,000 consumers, or derive more than 25% of gross revenue from selling personal data regardless of consumer count. Businesses with fewer than 500 employees and nonprofits with fewer than 100 employees are exempt if they do not sell personal data.

California

AI laws

• Companion chatbot safeguards SB 243 (Stats. 2025, ch. 677). In force since January 1, 2026 Must tell users the bot is AI at the start and at least every three hours, keep and publish a suicide and self-harm response protocol, and avoid engagement-maximizing reward tricks. Annual reports to the Office of Suicide Prevention begin 2027-07-01. Covers: Operators that make a companion chatbot platform available to users in California; customer-service bots and some game or voice-assistant bots are excluded.
• Frontier AI transparency SB 53 (Stats. 2025, ch. 138). In force since January 1, 2026 Large developers publish a frontier AI safety framework and transparency reports, report critical safety incidents to the state Office of Emergency Services, and protect whistleblowers. Covers: Developers who train a frontier model (more than 10 to the 26th operations); the heaviest duties fall on 'large' developers with over $500 million in annual revenue including affiliates.
• AI Transparency Act (provenance), as amended 2026 SB 942 (2024), AB 853 (2025), SB 1000 and AB 2713 (Stats. 2026, ch. 861 and 856). In force since August 2, 2026 Generative AI providers must offer a free tool to check whether content came from their system and embed hidden provenance disclosures in AI image, video and audio. Large online platforms must surface and avoid stripping provenance data from 2027-01-01. Covers: Developers of publicly accessible generative AI systems (SB 1000 removes the earlier 1,000,000-monthly-user floor), plus large online platforms and capture-device makers under AB 2713 on later dates.
• Children's companion chatbot protections ('Adam's Law') SB 1119 (Stats. 2026, ch. 190). Takes effect July 1, 2027 Must work out user age, run and document an annual child-safety risk assessment, publish a child-safety policy, apply default limits and crisis protocols for minors, bar sale of children's data and targeted ads, and obtain independent child-safety audits (first due 2029). Covers: Operators that make a companion chatbot available to users in California (workplace-only and school-only bots excluded); audit duty exempt until 2032 for operators under $500 million prior-year revenue.
• Automated decision systems in employment SB 947 (Stats. 2026, ch. 859). Takes effect July 1, 2027 Employers may not rely only on an automated decision system for discipline, termination or deactivation: a human must independently corroborate the output, the worker gets a written notice, and may request 12 months of the data used. Covers: Employers of workers (employees and contractors), including labor contractors and most public employers.
• AI-caused layoffs notice SB 951 (Stats. 2026, ch. 860). Enacted. Dates vary, so check the source. Employers must give advance written notice when AI or automation will cause a mass layoff, relocation or termination, and notify the state when they stop hiring for an occupation because of AI. Covers: Employers operating covered establishments (the Cal-WARN size of 75 or more employees); some duties only for employers with over 100 workers.
• Health care AI and clinical decision tools AB 1979 (Stats. 2026, ch. 854) and SB 503 (Stats. 2026, ch. 857). Enacted. Dates vary, so check the source. AB 1979: clinicians keep independent professional judgment, AI may not do licensed clinical functions on its own, and consumer health chatbots are treated as health care providers under California's medical-privacy law. SB 503: identify and reduce biased impacts, with deployer reporting from 2027 and audits from 2030. Covers: Health facilities, clinics and physician offices using AI clinical decision support; businesses offering a consumer health chatbot (AB 1979); developers and deployers of clinical AI (SB 503).
• Disclosure of synthetic performers in ads SB 1050 (Stats. 2026, ch. 246). Enacted. Dates vary, so check the source. Ads must clearly disclose that the performer is synthetic; platforms must take down a covered ad after a court order. Covers: Anyone creating and publishing video or audio-visual ads that prominently feature an AI-generated performer; ad platforms must act on court orders.
• Automated decisionmaking technology rules under the CCPA CPPA regulations (OAL approved 2025-09-22). In force since January 1, 2026 The regulations add notice, access and opt-out rights for consumers around automated decisionmaking technology and require risk assessments; some obligations have later compliance dates. Covers: Businesses covered by the California Consumer Privacy Act that use automated decisionmaking technology for significant decisions; also covers risk assessments and cybersecurity audits.

Privacy law

• California Consumer Privacy Act (as amended by the CPRA) In force since January 1, 2020 Covers: For-profit businesses that do business in California and meet any one test: annual gross revenue above $25 million, adjusted for inflation; buy, sell or share personal information of 100,000 or more consumers or households; or earn 50% or more of annual revenue from selling or sharing personal information.

California signed several more AI bills in September 2026, so check the Governor's announcements for the full list.

Colorado

AI laws

• Automated decision-making technology (replaces the 2024 AI Act) SB 26-189 (2026 ch. 131). Takes effect January 1, 2027 Developers must give deployers technical documentation from 2027-01-01. Deployers must notify people, explain adverse outcomes, allow correction of data and provide human review. Covers: Developers and deployers of automated decision-making technology that is used to materially influence consequential decisions (education, employment, housing, lending, insurance, health care, essential government services).

Privacy law

• Colorado Privacy Act In force since July 1, 2023 Covers: Controllers that do business in Colorado or target Colorado residents and either process personal data of 100,000 or more Colorado consumers in a calendar year, or derive revenue or discounts from selling personal data and process data of 25,000 or more consumers.

SB 26-189 repealed and replaced the 2024 Colorado AI Act (SB 24-205). See our Colorado guide for details.

Connecticut

AI laws

• Frontier AI developer safety duties SB 5, Public Act 26-15, sec. 2. In force since October 1, 2026 Safety framework and catastrophic-risk duties, plus whistleblower protection for employees who report risks. Covers: Developers doing business in Connecticut who train foundation models above 10 to the 26th operations; the largest duties apply to those with over $500 million in annual revenue including affiliates.
• AI companion safeguards SB 5, Public Act 26-15, secs. 4-6. Takes effect January 1, 2027 Must run a protocol to detect and respond to suicide, self-harm or violence risk, give crisis referrals, and add extra restrictions when the user is known or suspected to be under 18. Covers: Operators that provide an AI companion to users in Connecticut.
• Automated employment-related decision technology SB 5, Public Act 26-15, secs. 7-12. In force since October 1, 2026 Developers must give deployers the information needed to comply; deployers must give applicants and employees written notice before the decision is made. These duties apply to technology deployed on or after 2027-10-01. Covers: Developers and deployers doing business in Connecticut of technology that is a substantial factor in hiring, promotion, discipline, discharge or similar decisions.
• AI content provenance disclosures SB 5, Public Act 26-15, sec. 15. In force since October 1, 2026 Providers must handle provenance data and disclosures for generated or materially altered content. Covers: Providers of publicly accessible generative AI systems (images, audio, video) with more than one million users per month.
• AI subscription terms disclosure SB 5, Public Act 26-15, sec. 1. In force since October 1, 2026 Must give written notice of key terms and any usage limits before starting or renewing a subscription. Covers: Businesses that offer an AI product to Connecticut consumers on a paid subscription.

Privacy law

• Connecticut Data Privacy Act In force since July 1, 2023 Covers: Persons doing business in Connecticut or targeting its residents that, in the preceding calendar year, controlled or processed personal data of at least 35,000 consumers (excluding payment-only processing), OR processed any sensitive data, OR offered personal data for sale. Before 2026-07-01 the tests were 100,000 consumers, or 25,000 consumers plus over 25% of revenue from data sales.

Delaware

Privacy law

• Delaware Personal Data Privacy Act In force since January 1, 2025 Covers: Persons doing business in Delaware or targeting its residents that, in the prior calendar year, controlled or processed personal data of at least 35,000 consumers, or at least 10,000 consumers while deriving over 20% of gross revenue from selling personal data. From 2027-01-01 the tests become 10,000 consumers, or 5,000 consumers with over 20% of revenue from sales, or being a third party that acquires personal data from a controller.

Florida

Privacy law

• Florida Digital Bill of Rights In force since July 1, 2024 Covers: Narrow: for-profit controllers doing business in Florida with over $1 billion in global gross annual revenue that also derive 50% or more of revenue from online ad sales, or operate a consumer smart speaker with voice command, or operate an app store with at least 250,000 apps. Some sections (e.g. sale of sensitive data) reach other businesses.

Idaho

AI laws

• Conversational AI Safety Act S 1297 (2026 ch. 249). Takes effect July 1, 2027 Must disclose AI status where people could be misled, keep a suicide-response protocol, avoid claiming to give professional mental-health care, and add extra protections for minors. Covers: Operators that develop and offer a public-facing conversational AI service; business-only, internal and narrow-topic tools are excluded.

Illinois

AI laws

• AI in employment decisions (Human Rights Act amendment) HB 3773 (Public Act 103-0804). In force since January 1, 2026 Employers may not use AI that has the effect of discriminating against protected classes or use ZIP codes as a proxy, and must notify employees when they use AI for employment decisions. Covers: Employers in Illinois.
• Artificial Intelligence Safety Measures Act SB 315 (Public Act 104-0538). Takes effect January 1, 2027 Must publish and update a frontier AI framework, publish transparency reports before deploying new models, report critical safety incidents, undergo annual independent audits, and protect whistleblowers. Covers: Large frontier AI developers.
• Wellness and Oversight for Psychological Resources Act HB 1806 (Public Act 104-0054). In force since August 1, 2025 Therapy may be offered only by licensed professionals; licensed professionals may use AI only for administrative or supplementary support and not for independent therapeutic decisions. Covers: Anyone offering therapy or psychotherapy to the public in Illinois, including through AI.

Indiana

Privacy law

• Indiana Consumer Data Protection Act In force since January 1, 2026 Covers: Persons doing business in Indiana or targeting Indiana residents that, in a calendar year, control or process personal data of at least 100,000 Indiana consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data.

Iowa

AI laws

• Conversational AI services SF 2417 (Iowa Acts 2026, ch. 1068). Takes effect July 1, 2027 Must disclose AI status, keep a suicide and self-harm protocol, avoid implying licensed mental-health services, and add protections for minor account holders. Covers: Operators that develop and offer a public-facing conversational AI service; business customer-service, internal and narrow-topic tools are excluded.

Privacy law

• Iowa Consumer Data Protection Act In force since January 1, 2025 Covers: Persons doing business in Iowa or targeting Iowa residents that, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. Exempts government, financial institutions, HIPAA entities, nonprofits and colleges.

Kentucky

Privacy law

• Kentucky Consumer Data Protection Act In force since January 1, 2026 Covers: Persons doing business in Kentucky or targeting its residents that, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data.

Louisiana

Privacy law

• Louisiana Data Privacy Act (SB 386, Act 502) Takes effect January 1, 2027 Covers: Persons doing business in Louisiana that have annual gross revenue above $25 million, OR annually buy/receive/sell/share personal information of 75,000 or more consumers, households or devices, OR derive 50% or more of annual revenue from selling personal information (CCPA-style tests, any one suffices).

Maryland

Privacy law

• Maryland Online Data Privacy Act In force since October 1, 2025 Covers: Persons doing business in Maryland or targeting its residents that, in the preceding calendar year, controlled or processed personal data of at least 35,000 consumers (excluding payment-only processing), or at least 10,000 consumers while deriving over 20% of gross revenue from selling personal data.

Minnesota

Privacy law

• Minnesota Consumer Data Privacy Act In force since July 31, 2025 Covers: Legal entities doing business in Minnesota or targeting its residents that, in a calendar year, control or process personal data of 100,000 or more consumers, or derive over 25% of gross revenue from selling personal data while processing data of 25,000 or more consumers. Small-business exemption applies except for selling sensitive data.

Montana

Privacy law

• Montana Consumer Data Privacy Act In force since October 1, 2024 Covers: Persons doing business in Montana or targeting its residents that control or process personal data of at least 25,000 consumers, or at least 15,000 consumers while deriving over 25% of gross revenue from selling personal data. Certain sections (30-14-2811, -2818, -2819, e.g. minors protections) apply with no numeric threshold.

Nebraska

AI laws

• Conversational Artificial Intelligence Safety Act (part of LB 525) LB 525. Takes effect July 1, 2027 Must disclose AI status, adopt a suicide and self-harm protocol, avoid claiming to be a mental-health professional, and apply minor protections. Covers: Persons who make a public-facing conversational AI service available; business-only, customer-service and internal tools are excluded.

Privacy law

• Nebraska Data Privacy Act In force since January 1, 2025 Covers: No numeric threshold. Applies to a person doing business in Nebraska or making products or services consumed by Nebraska residents, who processes or sells personal data and is not a small business under the federal Small Business Act (as of 2024-01-01); small businesses must get consent before selling sensitive data.

Nevada

AI laws

• AI and mental or behavioral health care AB 406 (2025). In force since July 1, 2025 AI systems may not be marketed or programmed to act as providers of mental or behavioral health care; providers may use AI only for limited non-clinical tasks. Covers: AI providers and providers of mental or behavioral health care in Nevada, and public schools.

New Hampshire

Privacy law

• New Hampshire Privacy Act In force since January 1, 2025 Covers: Persons doing business in New Hampshire or targeting its residents that, in a one-year period, controlled or processed personal data of at least 35,000 unique consumers, or at least 10,000 unique consumers while deriving over 25% of gross revenue from selling personal data.

New Jersey

Privacy law

• New Jersey Data Privacy Act In force since January 15, 2025 Covers: Controllers doing business in New Jersey or targeting its residents that, in a calendar year, control or process personal data of at least 100,000 consumers (excluding payment-only processing), or at least 25,000 consumers while deriving revenue or discounts from selling personal data.

New York

AI laws

• RAISE Act (frontier AI safety) S6953-B, Chapter 699 of 2025, with 2026 chapter amendment. Enacted. Dates vary, so check the source. Written safety protocols, publication, and critical-incident reporting. Covers: Developers of frontier models; the chapter amendment (March 2026) is reported to narrow coverage to large developers.

New York City's Local Law 144 requires bias audits and notices for automated hiring tools used on candidates in the city. It is a city rule, not state law.

Oklahoma

Privacy law

• Oklahoma Consumer Data Privacy Act (SB 546) Takes effect January 1, 2027 Covers: Controllers and processors doing business in Oklahoma or targeting its residents that, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. Attorney General enforces; no private right of action.

Oregon

AI laws

• AI companion notice and self-harm protocol SB 1546 (Oregon Laws 2026, ch. 85). Enacted. Dates vary, so check the source. Must give a clear notice that users are talking to AI, run and publish an evidence-based suicide and self-harm protocol, add minor-specific limits, and publish an annual report of crisis referrals. Covers: Operators that control or make an AI companion or companion platform available to Oregon users; customer-service, education, productivity and similar software is excluded.

Privacy law

• Oregon Consumer Privacy Act In force since July 1, 2024 Covers: Persons doing business in Oregon or providing products or services to Oregon residents that, in a calendar year, control or process personal data of 100,000 or more consumers, or 25,000 or more consumers while deriving 25% or more of annual gross revenue from selling personal data. Also covers motor vehicle manufacturers and affiliates handling vehicle-use data regardless of those thresholds.

Rhode Island

Privacy law

• Rhode Island Data Transparency and Privacy Protection Act In force since January 1, 2026 Covers: For-profit entities doing business in Rhode Island or targeting its residents that, in the preceding calendar year, controlled or processed personal data of at least 35,000 customers (excluding payment-only processing), or at least 10,000 customers while deriving over 20% of gross revenue from selling personal data. Some disclosure duties (section 6-48.1-3) also apply to any commercial website or internet service provider that sells customer data.

Tennessee

Privacy law

• Tennessee Information Protection Act In force since July 1, 2025 Covers: Persons doing business in Tennessee or targeting its residents with more than $25 million in revenue AND either control or process personal information of at least 175,000 consumers in a calendar year, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal information.

Texas

AI laws

• Texas Responsible Artificial Intelligence Governance Act HB 149 (89th Leg.). In force since January 1, 2026 Bans developing or deploying AI with intent to manipulate people toward self-harm or crime, to unlawfully discriminate, to infringe constitutional rights, or to produce certain sexual content involving minors; government and health care disclosure duties; amends the biometric and privacy laws. Covers: Developers and deployers of AI systems in Texas; some disclosure duties fall only on government agencies and health care providers.

Privacy law

• Texas Data Privacy and Security Act In force since July 1, 2024 Covers: No numeric threshold. Applies to anyone who does business in Texas or makes products or services consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the U.S. SBA; small businesses must still get consent before selling sensitive data.

Utah

AI laws

• Generative AI disclosure in consumer transactions SB 226 (2025), repeal date extended by SB 332 to 2027-07-01. In force since May 7, 2025 Must disclose generative AI use when asked, and up front in high-risk or regulated-occupation interactions; safe harbor for compliant disclosures. Covers: Businesses using generative AI in consumer transactions and regulated services in Utah.
• Mental health chatbots HB 452 (2025). In force since May 7, 2025 Must make required disclosures to users, may not misuse personal information, and must keep policies that earn a rebuttable presumption of compliance. Covers: Suppliers of mental health chatbots that use AI to Utah users.
• Digital content provenance and counterfeit intimate images HB 276 (2026). Takes effect January 1, 2027 Large platforms must detect, disclose and keep provenance data; capture-device makers and AI providers must add latent disclosures to content. Covers: Large online platforms, capture-device makers and providers of generative AI.

Privacy law

• Utah Consumer Privacy Act In force since December 31, 2023 Covers: Controllers or processors that do business in Utah or target Utah residents, have annual revenue of $25 million or more, and either process personal data of 100,000 or more consumers or derive over 50% of gross revenue from selling personal data while processing data of 25,000 or more consumers.

Vermont

Privacy law

• Vermont Data Privacy and Online Surveillance Act (S.71, Act 145) Takes effect January 1, 2028 Covers: Persons doing business in Vermont or targeting its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers, or sensitive data of at least 3,000 consumers, or offered personal data of at least 3,000 consumers for sale. Separate applicability rules cover consumer health data.

Virginia

Privacy law

• Virginia Consumer Data Protection Act In force since January 1, 2023 Covers: Persons doing business in Virginia or targeting Virginia residents that, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. Exempts government bodies, financial institutions, HIPAA entities, nonprofits and colleges.

Virginia's governor vetoed a high-risk AI bill, HB 2094, in 2025.

Washington

AI laws

• AI companion chatbots HB 2225 (Laws of 2026, ch. 168). Takes effect January 1, 2027 Regulates AI companion chatbots, including disclosure and safety duties for users and minors. Covers: Operators of AI companion chatbots serving Washington users.
• Informing users when content is made or changed by AI HB 1170 (Laws of 2026, ch. 167). Takes effect February 1, 2027 Requires users to be informed when content is developed or modified by artificial intelligence. Covers: Providers covered by the bill that generate or modify content with AI.

Other states

Alaska, Arizona, Arkansas, District of Columbia, Georgia, Hawaii, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, New Mexico, North Carolina, North Dakota, Ohio, Pennsylvania, South Carolina, South Dakota, West Virginia, Wisconsin and Wyoming: we have not confirmed a comprehensive privacy law or an AI law of the kind listed here. That doesn't mean nothing applies. Consumer protection, employment and sector laws still reach AI and data use, and a law may exist that we have not yet confirmed. Laws in the states your customers live in can apply to you too.