Home / AI Policy and Regulation Resources / Data Privacy & Consumer Protection

Data Privacy & Consumer Protection

Data Privacy and Consumer Protection Regulations

Several states have adopted data privacy laws designed to protect consumers where personal data is used in automated decision making. While specifics vary by state, these laws often feature both a right for consumers to opt out of automated processing of data for opt out of the processing of the personal data for purposes of targeted advertising or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. They also often feature a requirement that businesses conduct data protection impact assessments for AI systems that process personal data and present heightened risks of harm, including automated decision-making tools that produce legal or similarly significant effects on consumers. (For an example of a law featuring both these common features, see the Connecticut Data Privacy Act.)

Other state laws aim to protect consumers within specific industries such as healthcare (see, e.g., California’s AB 3030), mental health care (see Nevada Revised Statutes Chapter 629), insurance (see Colorado SB21-169), and real estate (see South Carolina’s S.C. Code Ann. § 40-57-820 and Texas’s SB 815).

StateStatuteLinkEffective Date
CaliforniaArtificial Intelligence in Health Care ServicesCal. Gov. Code § Section 1339.75; AB 30301/1/25
CaliforniaAI Healthcare Utilization LawSB 11201/1/25
CaliforniaAI Call Disclosures LawAB 29051/1/25
CaliforniaCalifornia Bot ActCal. Bus. & Prof. Code § 17940 –179437/1/19
CaliforniaCalifornia Consumer Privacy ActAB 10081/1/24
CaliforniaDigital Identity Theft ActSB 9811/1/25
ColoradoColorado Protecting Consumers from Unfair Discrimination in Insurance Practices7/6/21
ColoradoColorado Privacy Act7/1/23
ConnecticutConnecticut Data Privacy ActConn. Gen. Stat. § 42-515 et seq.7/1/23
DelawareDelaware Personal Data Privacy ActDel. Code tit. 6, § 12D-101 et seq.1/1/25
FloridaFlorida Digital Bill of RightsSB 2627/1/24
IllinoisIllinois Automated Decision Tools ActHB 51161/1/26
IndianaIndiana Consumer Data Protection ActInd. Code. §24-15-11/1/26
KentuckyKentucky Consumer Data Protection ActKy. Rev. Stat. § 367.3611 et seq.1/1/26
MaineCommunications with Consumers via AI10 MRSA c. 2399/24/25
MarylandMaryland Online Data Privacy ActMd. Code Ann. § 14-4601 et seq.10/1/25
MinnesotaMinnesota Consumer Data Privacy ActMinn. Stat. § 325O.01 et seq.7/31/25
MinnesotaProhibiting Social Media Manipulation ActSF 40977/1/25
MontanaMontana Consumer Data Privacy ActMontana Code Ann. § 30-14-2801 et seq.10/1/24
NebraskaNebraska Data Privacy ActLB 10741/1/26
NevadaGeneral AI Chatbots and Mental Health ServicesNev. Rev. Stat. Chapter 4337/1/25
NevadaAI for Mental and Behavioral Health CareNev. Rev. Stat. Chapter 6297/1/25
NevadaAI for School CounselingChapter 391 of NRS 7/1/25
New HampshireNew Hampshire Privacy ActN.H. Rev. Stat. § 507-H:81/1/25
New JerseyNew Jersey Data Privacy ActN.J. Rev. Stat. § 56:8-166.4 et. seq.1/15/25
New YorkArtificial Intelligence Companion ModelsNew York General Business Law Article 4711/5/25
OregonOregon Consumer Privacy ActSB 619 7/1/24
Rhode IslandRhode Island Data Transparency and Privacy Protection ActR.I. Gen. Law § 6-48.1-1 et seq.1/1/26
South CarolinaReal Estate AI Responsibility LawS.C. Code Ann. § 40-57-8205/21/24
TennesseeTennessee Information Protection ActTenn. Code. Ann. § 47-18-33017/1/25
TexasArtificial Intelligence in Electronic Health RecordSB 11889/1/25
TexasTexas Data Privacy and Security ActTex. Bus & Com. Code § 541.051(b)(5)(C)7/1/24
TexasUse of Automated Decision System for Adverse DeterminationsSB 8159/1/25
TexasFinancial Abuse Using Artificially Generated Media or PhishingSB 23739/1/25
UtahAI Applications Related to Mental HealthUtah Code § 13-72a-1015/7/25
UtahArtificial Intelligence Consumer Protection AmendmentsUtah Code § 13-75-101 to 106; Utah Code § 13-75-1025/7/25
VirginiaHospital / Nursing Home Virtual Assistant LawVa. Code Ann. § 32.1-1277/1/21
VirginiaVirginia Consumer Data Protection ActVa. Code Ann. § 59.1-577A(A)(5)7/1/23