State privacy legislation

AI ethics and justice concept with judge gavel and digital circuit board, legal tech vector illustration

Key point: On August 11, 2026, the Colorado Attorney General’s Office released draft regulations and a notice of proposed rulemaking to implement the state’s new Automated Decision-Making Technology (ADMT) Act, extending obligations to midstream developers, proposing detailed standards for when AI “materially influences” a decision, what post-adverse-outcome disclosures must contain, and what “meaningful human review” requires. Businesses operating in Colorado should review the draft rules now and consider submitting comments before the October 26, 2026 hearing.

AI Illustration

Key point: Colorado and Connecticut recently enacted laws regulating employers’ use of AI and automated decision-making tools in employment decisions—with notice obligations, anti-discrimination requirements, and civil penalties that will require employers operating in these states to reassess their AI-driven HR practices now. Meanwhile, Illinois paused its rulemaking efforts on the circumstances under which notice of the use of AI is required.

businessman pressing power button. Start or shut down concept.

Key point: In response to the increasing number of state data privacy laws and to address a wave of claims under state wiretap laws, most businesses have spent the last several years posting online privacy notices, consent banners, marketing preference centers, and opt-out mechanisms. But the challenge today is no longer providing consumers with a way to exercise privacy rights. The challenge is to ensure those rights actually work.

Person using smartphone beside laptop with chat icon overlay, representing online messaging, mobile communication, customer support, social media interaction, app notification, and digital connection.

Key Point: Several states have enacted their own ‘mini-TCPA’ laws—state-level variants of the federal Telephone Consumer Protection Act (TCPA) that impose additional restrictions on telemarketing—and the past year has brought notable enforcement and legislative developments at both the federal and state levels.

Colorado State Capitol

Key point: Colorado has repealed and replaced the Colorado AI Act, amid years of skepticism from industry critics.

On May 14, Colorado Governor Jared Polis signed SB 26-189 into law, repealing and replacing the landmark Colorado Artificial Intelligence Act (CAIA), just under two months before it was set to take effect. CAIA was enacted in 2024 with an amended effective date of June 30, 2026.

Key point: The Utah legislature just passed a first-of-its-kind digital identity law that gives residents new rights over what personal information they share when verifying their identity. If your business chooses to participate as a verifier in Utah’s state-endorsed digital ID program—or builds the technology behind it—new consent, purpose-limitation, and loyalty obligations apply starting May 6, 2026.

Customer loyalty program concept in e-commerce for customer engagement. Man holding phone displaying earning points after purchasing online.

Key point: Whether your business runs a retail loyalty program, a restaurant rewards app, a software referral campaign, or an online sweepstakes, these programs often collect customer information, and that can trigger real privacy compliance obligations that are easy to overlook.

The Rules Vary by Program. Privacy Obligations Do Not.

Online promotional activities frequently involve the collection, use, and sharing of consumer personal information, and data privacy laws play an important role across all of them. Examples:

  • A retailer runs a points-based loyalty program which collects purchase history and behavioral data.
  • A company with a household brand name runs a sweepstakes and collects contact information for prize fulfillment.
  • A manufacturer offers mail-in rebates and collects names, addresses, and receipts to provide the rebates.
  • A mobile app runs a referral campaign and collects device identifiers and app usage data.
  • A sports betting app runs an advertising campaign to attract participants and inadvertently collects personal information from middle school kids who like sports.

All these instances trigger compliance obligations—even if the activities feel informal or low-risk.

employee-scaled.jpeg

With three new state privacy laws that took effect on January 1, 2026 (Indiana, Kentucky, and Rhode Island), adding to an extensive list of others, many organizations are discovering that their website privacy practices haven’t kept pace. Even those that updated their websites recently are finding hidden gaps, often due to unnoticed changes in technological tools and files, such as first and third-party cookies, third-party analytics software, and/or third-party scripts, tags, and pixels. A website audit can prevent enforcement issues and potential litigation or arbitration demands.

In October 2023, California passed the Delete Act, which, in addition to requiring data brokers to register with the state, directed Cal Privacy (f/k/a the California Privacy Protection Agency or CPPA) to create a data deletion software tool by January 1, 2026. This deletion software tool, now called the Delete Request and Opt-Out Platform (DROP), allows California residents to submit a single request to require all registered data brokers to 1) delete their personal information, and 2) stop selling or sharing that information through one verified, government‑administered process, rather than contacting hundreds of companies individually.