AI in Law Enforcement

Artificial Intelligence Safety Measures Act

Illinois' SB 315, the Artificial Intelligence Safety Measures Act, regulates developers of frontier AI models (foundation models trained with more than 10^26 operations). All frontier developers must publish a transparency report when deploying a new or substantially modified model and report critical safety incidents within 72 hours. Large frontier developers (over $500 million revenue with affiliates) need a state disclosure statement from January 1, 2027, and from January 1, 2028 a published frontier AI framework and annual independent audits. Large developers face Attorney General penalties up to $1 million, then $3 million. Signed July 6, 2026 (P.A. 104-0538); effective January 1, 2027.

An act relating to data brokers and personal information

Vermont's H.211 (Act 138 of 2026) overhauls Vermont's data broker law, with higher fees and fines, checks before brokers disclose data, and a data broker breach-notice law. Its AI-relevant provision is in the annual registration under 9 V.S.A. § 2446: a data broker must state whether, in the past year, it shared consumers' data with or sold it to a developer of a generative AI ("GenAI") system or model, alongside disclosures about sales to foreign actors, governments and law enforcement. The act defines a GenAI system as an AI system that can generate synthetic text, images, video and audio. These provisions take effect January 1, 2027.

Generative AI Terrorism Risk Assessment Act

The federal H.R. 1736 (Generative AI Terrorism Risk Assessment Act) would require the Secretary of Homeland Security, in consultation with the Director of National Intelligence, to submit an assessment of terrorism threats posed by the use of generative AI within one year after enactment and annually for five years after that. The House passed it by voice vote November 19, 2025; received in the Senate November 20, 2025 and referred to the Homeland Security and Governmental Affairs Committee.

Prohibit Surveillance Price & Wage Setting

Colorado's HB 26-1210 would have banned individualized price and wage setting: using an algorithm that applies statistical modeling, data analytics, AI or similar techniques to surveillance data about a person's characteristics, online behavior or biometrics, as more than a de minimis factor in the price offered to a consumer or the wage offered to a worker. Cost-based, supply-and-demand, public-discount, loyalty and need-based pricing, consumer-report credit refusals, and wages based solely on seniority or hired-for tasks and performance with plain-language disclosure, would have been allowed. Violations would have been deceptive trade practices. Vetoed by the Governor on June 2, 2026.

Data brokers: data collection and deletion.

California's SB 361 expands what data brokers must report when registering with the California Privacy Protection Agency. Registrations must say whether the broker collects data such as account logins, government ID numbers, citizenship or immigration status, union membership, sexual orientation, gender identity or biometric data, and whether in the past year it shared or sold consumers' data to a developer of a generative AI system or model, a foreign actor, governments or law enforcement. Signed October 8, 2025 (Chapter 466); effective January 1, 2026.

Consumer Protection and Labor and Employment - Surveillance-Based Price and Wage Setting - Prohibition

Maryland's HB 148 (2026) would have barred surveillance-based price setting (new Commercial Law section 14-1330) and surveillance-based wage setting (new Labor and Employment section 3-718): using surveillance data with an automated decision system to offer or inform a customized price or wage for an individual or group. It was pre-filed August 14, 2025, introduced January 14, 2026 and referred to Economic Matters, where the last recorded action was a February 10 hearing notice. It died when the 2026 session ended.

Consumer Protection and Labor and Employment - Electronic Shelving Labels and Surveillance-Based Price and Wage Setting - Prohibitions

Maryland's SB 889 (2026, first reader text) would have barred surveillance-based price setting (pricing consumer goods or services based on profiling or processing of consumer or device data), barred food retailers of at least 15,000 square feet from using electronic shelving labels to display prices, and barred employers from surveillance-based wage setting using surveillance data with an automated decision system. It had a Senate Finance hearing set for March 12, 2026 and died when the 2026 session ended.

Law Enforcement – Use of Facial Recognition Technology – Images Captured by Camera Affixed to Dwelling Exterior

Maryland's HB 762 (2026, first reader text) would have added an exception to Criminal Procedure section 2-503 letting law enforcement use facial recognition technology on images captured by a camera affixed to a dwelling's exterior by the dwelling's owner or lawful tenant, to investigate arson, burglary and trespass offenses. It had a House Judiciary hearing set for February 24, 2026 and died when the 2026 session ended.

Relating To Artificial Intelligence.

Hawaii's HB 2152 (2024) would have set up a plan for state use of generative AI: Office of Enterprise Technology Services risk assessments and procurement guidelines, an inventory of high-risk uses by each agency, employee training, a duty to tell people when AI mediates electronic communication, and chief information officer approval before adopting an automated decision system. It was referred to HET/LGO, CPC and FIN on January 24, 2024 and was not enacted.

Surveillance-based price and wage discrimination prohibition

Minnesota's SF 4233 would have prohibited using an automated decision system to set individualized prices for consumers or wages for workers based on surveillance data about them, with listed exceptions, and required anyone using such a system for prices or wages to publish procedures to check and correct the data. The text names no enforcer or penalty. Introduced March 9, 2026 and never left committee.

Acquisition and use of facial recognition technology by government entities prohibited.

Minnesota's HF 3661 would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. Evidence from violations would have been inadmissible, and people could sue for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced February 23, 2026 and referred to Judiciary Finance and Civil Law and it never left committee.

Acquisition and use prohibition of facial recognition technology by government entities

Minnesota's SF 129 (93rd Legislature) would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. People could have sued for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced January 11, 2023 and never left committee.

Eyewitness Identification

Not law: died in committee. Florida's HB 875, the House counterpart of SB 1202, would have amended s. 92.70, F.S., to set eyewitness identification procedures: a recorded description, independent lineup administrators, lineups with the suspect and at least five fillers, limits on show-ups and first-time in-court identifications, and audio and video recording. If facial recognition technology identified a suspect, a lineup could not be held without a basis independent of the technology. It died in the Criminal Justice Subcommittee on March 13, 2026.

Public Records/Artificial Intelligence Transparency Violations

Not law: died in the Senate Judiciary Committee. Florida's SB 1682 (2024) would have made confidential and exempt from public records the information the Department of Legal Affairs receives from notices of violations of a proposed AI transparency section (s. 501.174) or from its investigations, until the investigation is completed or ceases to be active. Its linked bill CS/CS/SB 1680 became Chapter 2024-118, but as enacted it did not create s. 501.174 or this exemption, so none of SB 1682 became law.

Prohibiting surveillance-based price discrimination and surge pricing for retail goods.

Washington's SB 6312, the Senate companion to HB 2481 (2026 session), would have barred non-small businesses selling grocery products from surveillance-based price discrimination (prices set from monitoring or automated analysis of a consumer's personal data) and from surge pricing based on real-time or predicted demand; 'algorithm' is defined to include AI. It would also have barred electronic shelf labels in stores of 15,000 square feet or more until January 1, 2030; violations would be Consumer Protection Act violations. It got no committee action on February 4, 2026 and died at adjournment.

Protecting state and local government systems and data from foreign entities

West Virginia's SB 70 (2026 regular session) would have created the Data Protection Act (new W. Va. Code art. 5-34). State agency officials, employees and contractors would have had to block, on state-owned or state-leased internet-capable devices, social media platforms owned by entities in a foreign country of concern, and could not use applications, software or AI algorithms owned by entities located in such a country. Senate Government Organization reported it do pass on February 6, 2026 and sent it to Judiciary, where it died when the session ended March 14, 2026.

Providing for 4th Amendment Restoration Act

West Virginia's SB 688 (2025 regular session), called the Responsible Use of Facial Recognition Act in its text, would have limited law enforcement use of six listed technologies, including facial recognition, to uses under a warrant based on probable cause, created a facial recognition working group in the Department of Homeland Security to publish a model policy by January 1, 2026, and required agencies to use only U.S.-made facial recognition technology with algorithms tested by NIST. It was sent to Senate Government Organization on March 4, 2025 and went no further.

Protecting state and local government systems and data from foreign entities

West Virginia's SB 694 (2025 regular session) would have created the Data Protection Act (new W. Va. Code art. 5-32). State agency officials, employees and contractors would have had to block, on state-owned or state-leased internet-capable devices, social media platforms owned by entities in a foreign country of concern, and could not use applications, software or AI algorithms owned by entities located in such a country. It was reported do pass but first to Judiciary on March 11, 2025 and went no further.

An Act to implement the recommendations of the special commission on facial recognition technology

Massachusetts' H 4359 (193rd General Court, 2023-2024) would have made it unlawful for law enforcement to use biometric surveillance technology, including facial recognition, absent express legal authorization. The registrar of motor vehicles could use facial recognition to verify identity for licenses, and State Police could run searches for limited purposes such as a judge-authorized warrant for a felony or an emergency. Reported by Judiciary and sent to House Ways and Means on February 12, 2024, it saw no further action and died with the session.

Provides relative to prohibiting surveillance-based price discrimination

Louisiana's HB471 would have made 'surveillance-based price discrimination' an unfair or deceptive trade practice, so that no person could engage in it. It defines surveillance data, behaviors, biometrics and automated decision systems, and exempts cost-justified price differences, certain equal-terms discounts and refusals based on a Fair Credit Reporting Act consumer report. It was considered in House Commerce April 22, 2026 and died. A Senate bill on the same subject, SB362, also died.

Biometric data and license plate readers-regulation.

Wyoming's HB 0181 (2026) would have barred governmental entities from using biometric data to identify or verify people, geolocation data to locate people or vehicles, and automatic license plate reader (ALPR) systems to identify vehicles, with narrow law enforcement exceptions (mostly warrant-based), a seven-day retention limit for data not tied to an investigation, and a civil action for damages or injunctive relief. Received for introduction February 11, 2026; the House did not consider it for introduction on February 13, 2026, so it died.

Eavesdropping, Peeping, and Voyeurism

South Carolina's H. 5394 (2023-24) would have amended Code 16-17-470 (eavesdropping, peeping and voyeurism) to increase penalties and to cover knowingly creating or altering images, audio, video or digital files with a generative adversarial network or other digital technology to make a realistic but false depiction of another person without consent, for sexual arousal or gratification, and knowingly selling or distributing such material without consent. It would also have required destruction of evidence and notice to additional victims. Referred to House Judiciary April 10, 2024; it did not pass.

China AI Threat Assessment Act

The federal H.R. 6909 (China AI Threat Assessment Act) would require the Director of National Intelligence, not later than 180 days after enactment, to submit to Congress a National Intelligence Estimate on AI systems developed or deployed by entities in the People's Republic of China, covering embedded algorithmic bias, training data and model architectures, use for influence operations or surveillance, and recommendations for monitoring and countering malign uses. Introduced December 18, 2025 and referred to the House Permanent Select Committee on Intelligence; no further action.

Relative to licensing requirements for autonomous vehicle testing and establishing an automated and connected vehicle testing and deployment commission.

Vetoed. HB 314 (2017-2018) would have created a New Hampshire autonomous vehicle testing license, requiring at least $10 million in insurance, bond or self-insurance, a $500 annual fee, federal safety-standard compliance and a law enforcement interaction plan; allowed SAE level 5 fully automated vehicles on the road only for licensed testers with an escort vehicle; and set up an automated and connected vehicle testing and deployment commission. Governor Sununu vetoed it on July 2, 2018. The House voted to override (279-66) but the Senate sustained the veto (5-19) on September 13, 2018.

Requires DLPS to establish training program to prepare law enforcement to interact with autonomous vehicles.

New Jersey's A958 would require the Attorney General, consulting the Commissioner of Transportation, to develop or approve a training course on safely interacting with autonomous vehicles in emergency and traffic enforcement situations and make it available to all law enforcement agencies. New officers would have to complete it before permanent appointment.

Establishes Deepfake Technology Unit in DLPS; appropriates $2 million.

New Jersey's A2364 would have the Attorney General, consulting the State Chief Technology Officer, create a Deepfake Technology Unit in the Division of Criminal Justice to give technical help and training to law enforcement, prosecutors and State courts, and would appropriate $2,000,000 to the Department of Law and Public Safety. First Reprint, reported by the Assembly Science, Innovation and Technology Committee on March 4, 2024, with amendments. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.

Establishes Deep Fake Technology Unit in DLPS; appropriates $2 million.

New Jersey's S2545 would have the Attorney General, consulting the Chief Technology Officer of the Office of Information Technology, create a Deep Fake Technology Unit in the Division of Criminal Justice to give technical help and training to law enforcement, prosecutors and State courts, and would appropriate $2 million to the Department of Law and Public Safety. Introduced February 8, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.

Requires DLPS to establish training program to prepare law enforcement to interact with autonomous vehicles.

New Jersey's A3757 would require the Attorney General, consulting the Commissioner of Transportation, to develop or approve a training course for law enforcement officers on safely interacting with autonomous vehicles in emergency and traffic enforcement situations. The Attorney General would have to ensure all officers complete in-service training by December 31, 2020, a date that falls before the bill's introduction, and new officers would complete it before permanent appointment. Introduced February 22, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.

Autonomous vehicles; safety; data

Arizona's SB 1417 (2026) would have amended the autonomous vehicle chapter (A.R.S. 28-9701 et seq.) so that a fully autonomous vehicle could run without a human driver only if its operator submitted a law enforcement interaction plan, a written compliance statement, proof of at least $5,000,000 in liability coverage per occurrence, update notices and quarterly safety reports. It was held in Senate committees with no action and died when the 2026 session ended June 13, 2026.

Law Enforcement Artificial Intelligence Amendments

Utah's SB 205 (2026), Law Enforcement Artificial Intelligence Amendments (second substitute), would have amended the 2025 law on police use of generative AI to require agency policies to cover available oversight or safeguard settings and to require agencies to post their policy publicly. It passed the Senate on February 26, 2026 (20-0-9); the House struck the enacting clause on March 6 and the Senate filed it.

Use of Artificial Intelligence to Detect Firearms

Not law. SB 562 would have banned using artificial intelligence, including with cameras, video recording or live-streaming devices, to detect firearms in public areas in Florida, making it a first-degree misdemeanor. School grounds and the places where a concealed-carry license does not authorize carrying were exempt. It was indefinitely postponed and withdrawn on May 3, 2025 and died in the Criminal Justice Committee.

Technology; Protecting Consumers and Jobs from Predatory Pricing Act; personalized algorithmic pricing; consumer data; food retailers; effective date.

Oklahoma's HB 3959 (2026), as introduced, would have created the Protecting Consumers and Jobs from Predatory Pricing Act. Per its title, it would require disclosure of personalized algorithmic pricing by food retail establishments, bar electronic shelving labels for large food retailers and for personalized or surveillance pricing, and bar use of protected class data in pricing. It was referred to committee February 4, 2026 and died when the session ended May 14, 2026.

Urging Congress To Begin A Discussion Considering The Benefits And Risks Of Artificial Intelligence Technologies.

Hawaii's Senate Concurrent Resolution 179 (H.D. 1) (2023) urges Congress to begin a discussion of the benefits and risks of AI technologies. It states that AI software wrote all of its whereas clauses in seconds when asked to "write an essay explaining the potential dangers of artificial intelligence," which should alert policymakers to the technology's power and dangers. It urges national leaders to evaluate AI in public sector identification technologies, such as law enforcement and military uses, and says universal safety guidelines, such as Asimov's three rules of robotics, should be considered. Adopted in final form April 28, 2023; a concurrent resolution does not change the law.

Provides for a joint legislative committee to study regulations regarding artificial intelligence

Louisiana's HCR 66 is a concurrent resolution, adopted by the House 85-0 on May 9 and the Senate 35-0 on May 29, 2024, that requests the Joint Legislative Committee on Technology and Cybersecurity to study and make recommendations on the use and regulation of artificial intelligence. It cites risks in education, criminal justice evidence, finance, health care and revenue collection, and possible benefits for state government. The committee is to actively solicit data and testimony and report policy recommendations to the legislature annually. A concurrent resolution does not change the law.

Mississippi Fully Autonomous Vehicle Enabling (MS FAVE) Act of 2023; establish to regulate operation of autonomous vehicle on public roads.

Mississippi's MS FAVE Act of 2023 lets fully autonomous vehicles run on public roads without a human driver if the system is engaged and the vehicle will reach a minimal risk condition if it fails, can obey traffic laws, and bears any federally required certification label. Operators must first file a law enforcement interaction plan and proof of insurance with the Department of Public Safety. The engaged system counts as the licensed driver; vehicles are registered and titled as autonomous; on-demand AV networks may operate; and state agencies and local governments cannot ban AVs or add AV-specific taxes, fees or rules. Effective July 1, 2023.

Automated license plate recognition systems.

Vetoed. California's SB 274, the ALPR Data Accountability Act, would have tightened rules for automated license plate recognition (cameras plus computer algorithms that turn plates into searchable data). Public agencies could not have kept data not matching an authorized hot list past 60 days, police could have used it only to locate vehicles or people reasonably suspected of involvement in a public offense, every query would have needed a logged case file number (or AG task force name), and vendor contracts could not give default access to national ALPR databases. Vetoed by Governor Newsom October 1, 2025; veto sustained March 2, 2026.

Law enforcement agencies: artificial intelligence.

California's SB 524 (Penal Code § 13663) requires every law enforcement agency to have a policy that official reports written fully or partly with AI name each AI program used, state "This report was written either fully or in part using artificial intelligence," and carry the preparer's signature verifying the facts. The AI first draft must be kept as long as the report, agencies must keep an audit trail, and vendors may not share or sell agency data except as allowed. Signed October 10, 2025 (Chapter 587); effective January 1, 2026.

Public contracts: automated decision systems: procurement standards.

Vetoed. California's SB 892 (2024) would have required the Department of Technology to adopt regulations setting a procurement standard for automated decision systems (ADS), with risk assessments, risk controls, incident monitoring, prohibited uses, equity and human-oversight reviews and data minimization. From January 1, 2027, state agencies could not have bought ADS until those rules existed, and contracts would have needed risk-assessment and notice-and-appeal clauses. Governor Newsom vetoed it September 20, 2024, saying it would disrupt existing work and create unbudgeted General Fund costs.

Department of Technology: high-risk automated decision systems: inventory.

California's AB 302 required the Department of Technology, by September 1, 2024, to inventory every high-risk automated decision system that state agencies use, develop or procure, or have proposed to, and to report it to two legislative committees by January 1, 2025 and annually after that; the reporting duty becomes inoperative January 1, 2029. High-risk systems assist or replace human decisions with legal or similarly significant effects, such as access to housing, education, employment, credit, health care and criminal justice. It applies only to state agencies. Signed October 13, 2023 (Chapter 800); effective January 1, 2024.

Facial recognition technology, use of match as the sole basis of probable cause or arrest, prohibited

Alabama's SB 56 (Act 2022-420) bars state and local law enforcement agencies from using facial recognition technology match results as the sole basis to establish probable cause in a criminal investigation or to make an arrest; match results may be used for those purposes only together with other lawfully obtained information and evidence. Facial recognition technology is software that, to try to identify an unknown person, generates facial biometric data (a facial template), searches a database of many people's templates linked to identifying information, and returns matches by similarity. Signed April 14, 2022; effective July 1, 2022.

SOS-FACIAL RECOGNITION INFO

Illinois' Public Act 102-0354 (SB 225) bars the Secretary of State from providing facial recognition search services, or photographs obtained in issuing driver's licenses, permits or state identification cards, to any federal, State or local law enforcement agency or other governmental entity for the purpose of enforcing federal immigration laws. The ban does not apply to requests for facial recognition searches or photographs whose purpose relates to criminal activity other than immigration violations. It amends the Illinois Identification Card Act and the Illinois Vehicle Code. Approved and effective August 13, 2021.

Prohibits certain businesses from using dynamic, surveillance, or personalized algorithmic pricing when selling groceries to consumers.

New Jersey's S 3732 would make it an unlawful practice under the Consumer Fraud Act for a retail food store or third-party grocery delivery platform to use dynamic pricing, surveillance pricing or personalized algorithmic pricing when selling groceries, in person or online. Discounts and loyalty benefits based on past purchases would still be allowed. Introduced March 5, 2026 and referred to the Senate Commerce Committee; it has not passed either house.

Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions

New York's A 1045 would bar police agencies, police officers, peace officers and state police members from acquiring, possessing, accessing or using any biometric surveillance system, or information derived from one, in their duties, and let a person sue for equitable or declaratory relief. Mobile fingerprint scanning, DNA index and fingerprint database comparisons are excepted. It would create a 12-member task force reporting between 2029 and 2030. Introduced January 8, 2025 and referred to the Governmental Operations Committee; it has not passed either house.

A bill for an act prohibiting the use of an automated decision-making system to alter the price of a product or service for a specific individual based on surveillance data, and providing civil penalties.

Iowa's HF 2469 would add Code chapter 554J, barring a person from using an automated decision-making system (AI or algorithms making decisions with little or no human intervention) to alter the price of a product or service for a specific individual based on surveillance data. A violation would be an unlawful practice under Code sections 714.16 and chapter 714H (consumer fraud). Four exceptions apply. Introduced and referred to the House Commerce Committee February 16, 2026; it has not passed either chamber.

School Safety Firearm Detection Software Pilot Program; established.

Virginia's HB 1818 (2025 Regular Session) would have created a School Safety Firearm Detection Software Pilot Program under the Public School Security Equipment Grant Act of 2013, awarding grants for AI software that analyzes school security-camera video to detect firearms in two Title 1 schools in each congressional district. Left in House Appropriations on February 4, 2025; it failed.

ICE Out of Our Faces Act

The federal S. 3779 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the Senate Homeland Security and Governmental Affairs Committee; no further action.

SURVEILLANCE-BASED WAGES

Illinois's HB 4987 (104th General Assembly) would create the Surveillance-Based Wage Discrimination Act. A person could not use surveillance data as part of an automated decision system to inform the individualized wage paid to an employee. The bill sets exemptions, Attorney General enforcement, private rights of action and penalties. Re-referred to the House Rules Committee March 27, 2026.

CTA POLICE DEPARTMENT

Illinois's SB 4070 (104th General Assembly) would amend the Metropolitan Transit Authority Act to require the Chicago Transit Authority to set up a CTA Transit Police Department of sworn officers. It would also require a pilot of AI-based weapon-detection scanners at 5 to 10 stations and hubs and a limited facial recognition pilot. Referred to Assignments February 24, 2026.

General Regulatory Provisions -- Generative Artificial Intelligence Models

Rhode Island H 6286 (2023), as introduced on April 19, 2023, would add chapter 6-59 setting operating standards for companies running large-scale generative AI models (at least one billion parameters). Companies would have to watermark or authenticate text output, obtain informed consent before using personal data, run risk assessments and register with the attorney general within 90 days. The text sets no penalties and takes effect September 1, 2023.

ARTIFICIAL INTELLIGENCE SAFETY

Illinois's HB 3506 (104th General Assembly) would create the Artificial Intelligence Safety and Security Protocol Act. As introduced, developers would publish a safety and security protocol, publish risk assessment reports at least every 90 days, and obtain an annual third-party compliance audit, with civil penalties. House Committee Amendment No. 1 narrows this to 'large developers' and adds whistleblower protections. Re-referred to Rules April 11, 2025.

Fully autonomous vehicles; extend repealer on requirement that law enforcement interaction plan be submitted to DPS before operating.

Mississippi's HB 1770 (2026) would amend Section 63-35-7 to extend the repealer on the requirement that a person submit a law enforcement interaction plan to the Department of Public Safety before operating a fully autonomous vehicle without a human driver on public roads, moving the repeal date from July 1, 2026 to July 1, 2029. It died in committee on February 3, 2026.

Biometric Surveillance Act

Illinois's HB 5521 (104th General Assembly) would create the Illinois Biometric Surveillance Act. Law enforcement agencies could not obtain, retain, possess, access, request or use a biometric identification system, including through a third party or another government agency. It would give a private right of action and Attorney General enforcement. Re-referred to the House Rules Committee on March 27, 2026.

POLICE-FACIAL RECOGNITION ACT

Illinois's SB 3564 (104th General Assembly) would create the Facial Recognition Technology in Law Enforcement Act. Law enforcement agencies using facial recognition would have to conduct compliance audits, and the technology could not be used to analyze images of people engaged in constitutionally protected activity (absent reasonable suspicion of a crime), for real or live-time identification, or solely based on beliefs, lawful activities or protected characteristics. Referred to Assignments February 5, 2026.

BIOMETRIC DATA-COMMERCIAL USE

Illinois's HB 2411 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).

BIOMETRIC DATA-COMMERCIAL USE

Illinois's HB 4330 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).

Workplace surveillance tools.

California's AB 1221 (2025-26 Regular Session) would have regulated workplace surveillance tools and employer use of worker data. Employers would have had to give affected workers 30 days' written notice before introducing a tool, and could not use tools incorporating facial, gait or emotion recognition technology, except as specified. Civil penalty $500 per violation. It was held in Assembly Appropriations May 23, 2025 and died under Art. IV, Sec. 10(c) of the Constitution on January 31, 2026.

Companion chatbots: children’s safety.

California's AB 2023 (2025-26 Regular Session) would have required an operator of a companion chatbot to, on or before July 1, 2027, take child-safety steps including an annual risk assessment, and to submit to an independent audit whose report goes to the Attorney General. The Assembly passed it 66-8 on May 26, 2026; it was ordered to the Senate inactive file on August 30, 2026 and was not passed before the session ended.

Use of artificial intelligence-based tools; covered artificial intelligence, disclosure of use.

Virginia's HB 1294 (2026 Regular Session) would amend Code 19.2-11.14 to require police reports to disclose any use of covered artificial intelligence in a criminal investigation, and to require that AI-assisted report drafts be retained. Continued to 2027 in the House Communications, Technology and Innovation Committee on February 2, 2026.

Law-enforcement agencies; use of certain technology & interrogation practices; forensic laboratory.

Virginia's HB 1261 (2026 Regular Session) would direct the Department of Criminal Justice Services to set a framework for law-enforcement use of generative AI, machine learning systems and audiovisual surveillance technologies and for interrogations, with model policies and training. Continued to 2027 in committee on February 2, 2026.

Law enforcement; artificial intelligence inventory, civil action.

Virginia's HB 1295 (2026 Regular Session) would add Code 9.1-116.11, requiring every state and local law-enforcement agency and sheriff's department to inventory the covered AI systems it uses and publish the inventory by November 1 each year. Continued to 2027 in the House committee on February 2, 2026.

Law-enforcement agencies; use of certain technologies and interrogation practices.

Virginia's HB 2433 (2025 Regular Session) would have had the Department of Criminal Justice Services set a framework for law-enforcement use of generative AI, machine learning systems, audiovisual surveillance technologies and interrogations, with model policies by January 1, 2026 and agency policies by July 1, 2026. It also covered forensic laboratory accreditation. Left in committee on February 5, 2025; it failed.

AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.

Tennessee's HB2608 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: SB 2215. Not passed before the session ended in April 2026; last action: Taken off notice for cal in s/c Criminal Justice Subcommittee of Judiciary Committee (March 25, 2026).

AN ACT to amend Tennessee Code Annotated, Title 49, relative to school safety.

Tennessee's SB 814 (114th General Assembly), as introduced, would have required the Department of Education to run a three-year pilot grant program for eligible LEAs (school districts) to buy AI weapons detection systems that identify weapons such as knives and firearms and immediately notify law enforcement and school administration. Companion to HB 933. The Senate Education Committee recommended it with amendments 9-0 on February 19, 2025; last action February 24, 2025; it died with the session.

AN ACT to amend Tennessee Code Annotated, Title 49, relative to school safety.

Tennessee's HB 933 (114th General Assembly), as introduced, would have required the Department of Education to run a three-year pilot grant program for eligible LEAs (school districts) to buy AI weapons detection systems that identify weapons such as knives and firearms and immediately notify law enforcement and school administration. Companion to SB 814. Last action March 18, 2025; the bill died when the General Assembly adjourned in April 2026.

Trade Practices; surveillance based price discrimination and surveillance based wage discrimination; prohibit

Georgia's SB 164 would add Article 37 to Title 10, Chapter 1, prohibiting 'surveillance based price discrimination' and 'surveillance based wage discrimination', meaning use of an automated decision system to set individualized prices or wages based on surveillance data about a consumer or worker. Defined exceptions would apply, such as cost-based price differences. According to its title, it would provide civil penalties and enforcement. The bill was read and referred on February 13, 2025 and died when the session ended.

PRIVACY RIGHTS ACT

Illinois' SB 52 is a general consumer privacy bill. As introduced, the Privacy Rights Act would give consumers rights over their personal information and create a Privacy Protection Agency. Its AI-related parts are narrow: it defines profiling as automated processing of personal information, and directs the Attorney General to adopt rules on access and opt-out rights for automated decision-making technology and on risk assessments. Introduced January 13, 2025; re-referred to Assignments April 11, 2025 and still pending.

Surveillance and Investigatory Technology Amendments

Utah's H.B. 606 (Rep. Ryan D. Wilcox), Surveillance and Investigatory Technology Amendments, would have limited a law enforcement agency's use of surveillance or investigatory technology, defined to include facial recognition systems, biometric surveillance information, and location tracking, with "technology" defined to include AI technology. The limits would start July 1, 2027. The enacting clause was struck and the bill filed as not passed on March 6, 2026.

An Act relative to justice, equity and accountability in law enforcement in the Commonwealth

Massachusetts' 2020 police reform law (Chapter 253 of the Acts of 2020) regulates police use of facial recognition. Under new G.L. c.6 s.220, a law enforcement agency may perform or request a facial recognition search only through a written request to the Registry of Motor Vehicles, State Police or FBI, and only with a court order, except to identify a deceased person or in an emergency. Each search must be documented and reported quarterly to the Executive Office of Public Safety and Security. Section 220 took effect July 1, 2021; a special commission was set up to study government use of facial recognition.

Urging Congress To Begin A Discussion Considering The Benefits And Risks Of Artificial Intelligence Technologies.

Hawaii's Senate Resolution 123 (2023) urges Congress to begin a discussion of the benefits and risks of AI technologies. It states that AI software wrote all of its whereas clauses in seconds when asked to "write an essay explaining the potential dangers of artificial intelligence," which should alert policymakers to the technology's power and dangers. It urges national leaders to evaluate AI in public sector identification technologies, such as law enforcement and military uses, and says universal safety guidelines, such as Asimov's three rules of robotics, should be considered. Adopted by the Senate April 5, 2023; a resolution of one chamber does not change the law.

Appropriation; artificial intelligence; border security

Arizona's SB 1707 (2026) would have appropriated $5,000,000 from the state general fund in fiscal year 2026-2027 to the Department of Public Safety for artificial intelligence relating to border security. The department could distribute the money to local law enforcement agencies to enforce border security using AI. The Senate Appropriations, Transportation and Technology committee passed it 6-4 on February 17, 2026, but it was held awaiting the Committee of the Whole and died when the session ended June 13, 2026.

ALGORITHMIC PRICE TRANSPARENCY

Illinois's HB 4248, as the Senate amended it (Senate Floor Amendment 1), would create the Protection from Surveillance Pricing Act, banning surveillance pricing: customized prices for a consumer or group based on personal data. The House passed an earlier version 78-19 on May 22, 2026; the Senate passed it as amended 41-16 on May 31, 2026. The House has not concurred and re-referred it to the Rules Committee July 1, 2026, so it has not gone to the Governor.

Provides funding to nonprofit organizations to implement smart technology and artificial intelligence systems to enhance security infrastructure.

A 2608 would create the New Jersey Equitable Nonprofit Security and Innovation Grant Program in the Office of Homeland Security and Preparedness. Nonprofits, including places of worship, could get up to $25,000 for smart technology that cuts operating costs and up to $100,000 for AI security systems such as AI-powered surveillance and threat detection. The office would favor groups serving at-risk communities and communities of color, request at least $14 million a year, and have to approve every AI system bought with grant money to make sure it is not unfairly discriminatory. Pending in the Assembly Science, Innovation and Technology Committee.

Prohibits the use of a wage-fixing algorithm in combination with personal or behavioral data to set or recommend wages or compensation

A 9638 would ban 'surveillance wages' in New York: employers could not use a wage-fixing algorithm, or its output, together with a worker's personal or behavioral data (such as financial, purchasing, browsing, biometric or location data, or profiles drawn from them) to set or recommend pay, whether the employer or a third party collects the data. Tools that use only job requirements, performance (not customer reviews), qualifications, labor market conditions or local cost of living are exempt. The Attorney General, the Labor Department and harmed workers could sue for the greater of actual damages or $3,000 per violation, tripled if willful. Pending in the Assembly Labor Committee.

A bill for an act prohibiting personalized algorithmic pricing and surveillance pricing at certain food retail establishments, and providing civil penalties.

Iowa's SF 2278 (as introduced) would add Code chapter 554J for large food retail stores. Such a store using personalized algorithmic pricing based on a particular consumer's data would have to show "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." Stores could not use electronic shelf labels, collect data of minors under 17 or use it for targeted ads or personalized pricing, or use protected class data in pricing. Civil penalty up to $7,500 per violation. Introduced February 11, 2026; it died in committee when the 2026 session ended.

Prohibits algorithmic wage-setting; provides for exceptions; provides for penalties for violation; creates a private right of action.

New York's A 9641 would add Labor Law Article 20-D (§§ 750-755) providing that “no employer shall engage in algorithmic wage-setting,” meaning use of an automated decision system to inform individualized wages based on surveillance data about an employee. Civil penalties up to $10,000 per violation and a private right of action would apply. Referred to the Labor Committee January 21, 2026; it has not passed either chamber. Would take effect on the ninetieth day after it becomes law.

Establishes the "protect our privacy (POP) act" to impose limitations on the use of drones for law enforcement purposes; prohibits the use of drones by law enforcement at concerts, protests, demonstrations, or other actions protected by the first amendment.

New York's A 972, the "protect our privacy (POP) act," would add Civil Rights Law § 52-e: law enforcement data from drones equipped with facial recognition software, or from facial recognition run on drone video or images, including private drones, could not be used in ongoing investigations or prosecutions and would have to be promptly deleted, retroactively. It would also generally bar police drone use except for search and rescue and post-disaster inspection, bar drones at protests and armed drones, and allow suits for the greater of $1,000 per violation or actual damages. Referred to Governmental Operations January 7, 2026; it has not passed either chamber.

Requires experts in professional fields to be consulted when developing and maintaining artificial intelligence technology for use in such fields.

New York's A 9219 would add General Business Law §§ 1710 to 1715. A developer of AI intended for a professional domain regulated under Title Eight of the Education Law would have to show that a licensed professional domain expert with three or more years of experience was directly and substantially involved in design, data and training, validation and ongoing risk assessment, and submit documentation to the Attorney General. Penalties up to $50,000 per violation. Would take effect one year after it becomes law. Referred to Science and Technology November 3, 2025 (and January 7, 2026); it has not passed either chamber.

Relation to the regulation of the use of artificial intelligence and facial recognition technology in criminal investigations

New York's A 7172-B would add subdivision 25 to Executive Law § 837, requiring the division of criminal justice services to promulgate a written protocol for law enforcement agencies using AI and facial recognition technology in criminal investigations. The protocol would cover transparency measures (records of AI outputs, subject to audit), regular independent audits of facial recognition systems with public results, and officer training. Would take effect on the 90th day after it becomes law. On the Assembly floor calendar (Cal. 396, June 3, 2026); it has not passed either chamber.

Prohibits algorithmic wage-setting; provides for exceptions; provides for penalties for violation; creates a private right of action.

New York's S 8872 would add Labor Law Article 20-D (§§ 750-755) stating that no employer shall engage in algorithmic wage-setting, meaning using an automated decision system to inform individualized wages based on surveillance data about an employee. An employer is not deemed in violation if wages rest solely on task-related employee data or differences in labor cost and the employer discloses what data is used before hiring. Civil penalties up to $10,000 per violation; a private right of action. Referred to Labor January 13, 2026.

Prohibits the use of electronic shelving labels, digital shelf display technology, and personalized algorithmic pricing in food retail establishments and drug retail establishments; provides injunctive relief, civil penalties, and a private right of action.

New York's S 8616-B, the Protecting Consumers and Jobs from Discriminatory Pricing Act, would add General Business Law § 349-a-1. Food and drug retail establishments could not use electronic shelving labels or digital shelf displays, could not engage in surveillance pricing (pricing set completely or in part by an algorithm that uses personal data), and could not use protected class data in pricing. The Attorney General could seek penalties up to $10,000 per violation. Passed the Senate May 13, 2026 and, as amended, June 4, 2026 (50-10); on June 5 the Assembly substituted it for A9396-B on its third-reading calendar. No Assembly vote is shown.

Use of facial recognition technology as part of the driver's license and Minnesota identification card application process required.

Minnesota's HF 560 would have required the commissioner of public safety to use facial recognition on every driver's license and Minnesota ID application or renewal to prevent multiple issuances and identification fraud, comparing applicants' faces with state, FBI and other law enforcement databases. A confirmed match would have blocked issuance and been referred to law enforcement. Introduced February 13, 2025 and never left committee.

Provides that surveillance-based price discrimination is an unfair or deceptive trade practice or act. (8/1/26)

Louisiana's SB362 would have made 'surveillance-based price discrimination' an unfair or deceptive trade practice, so that no person could engage in it. The bill defines surveillance data, behaviors and biometrics, mentions automated decision systems, and exempts cost-based price differences, equal-terms discounts and credit refusals based on a Fair Credit Reporting Act report. It was considered in committee April 22, 2026 and died.

An act relating to consumer data privacy and online surveillance

Vermont's H.208 (2025-2026 biennium) would have enacted a consumer data privacy and online surveillance law applying to businesses processing data of at least 25,000 consumers, or 12,500 consumers with over 25 percent of revenue from selling data. Consumers could learn whether their data is used in an AI system and opt out of profiling for automated decisions; sensitive data including biometric and neural data would be limited. It would have taken effect July 1, 2026. It was referred to House Commerce on February 12, 2025 and died.

Law enforcement: facial recognition and other biometric surveillance.

California's AB 1215 added Penal Code § 832.19, which barred law enforcement agencies and officers from installing, activating or using any biometric surveillance system, such as facial recognition, in connection with an officer camera (a body-worn camera or similar device) or its data, including by having another agency or a third party run it for them. Anyone could sue for equitable or declaratory relief. The section was repealed by its own terms on January 1, 2023, so the ban is no longer in effect. Signed October 8, 2019 (Chapter 579); effective January 1, 2020.

Fourth Amendment Restoration Act

West Virginia's HB 2431, the Fourth Amendment Restoration Act (2025 regular session), would have barred law enforcement officers, and anyone acting for law enforcement purposes, from using seven listed technologies, including facial recognition, license plate readers and surveillance drones, unless a warrant based on probable cause authorizes use against a specific person. Knowing and willful use would be a felony. It was sent to House Judiciary on February 17, 2025 and went no further.

An act relating to public safety; ... regulating the use of unmanned aerial vehicles by law enforcement ... (Laws 2020, chapter 82)

Minnesota's Laws 2020, chapter 82 created Minn. Stat. 626.19 on law enforcement use of unmanned aerial vehicles (drones). Drones generally require a warrant, with listed exceptions, and under subdivision 4(b) an agency must not deploy a drone with facial recognition or other biometric-matching technology unless expressly authorized by a warrant. Agencies also may not arm drones or use them to collect data on protests without a warrant, evidence gathered in violation is inadmissible, and agencies must adopt written policies by Feb. 15, 2021. Section 626.19 took effect Aug. 1, 2020.

Establishing minimum requirements for the testing of autonomous vehicles.

Washington's Chapter 182, Laws of 2020 (ESHB 2676) sets minimum rules for testing autonomous vehicles on public roads under the Department of Licensing self-certification pilot program. Testers must carry at least $5 million in umbrella liability insurance (RCW 46.30.050). From October 1, 2021 (RCW 46.92.010), they must give the department contact details, testing locations and vehicle IDs, report collisions and moving violations annually, and notify local police or the State Patrol 14 to 60 days before testing. The department publishes the information and reports to the Legislature.

Implementing recommendations of the autonomous vehicle work group.

Washington's Chapter 193, Laws of 2021 (SSB 5460) implements recommendations of the state autonomous vehicle work group by amending the self-certification testing pilot program in RCW 46.92.010. It defines "autonomous" as a level four or five driving automation system under SAE J3016, and requires testers to give the Department of Licensing contact details, testing jurisdictions, vehicle identification and proof of insurance, file annual collision and violation reports, and notify law enforcement 14 to 60 days before testing. No autonomous vehicle may be tested on public roads until the information is filed. Section 1 takes effect October 1, 2022.

Artificial Intelligence Facial Recognition

Colorado's SB 22-113 sets rules for facial recognition used by state agencies, local governments and state colleges: a notice of intent and public accountability report before use, vendor bias disclosures, testing and meaningful human review for decisions with legal or similarly significant effects, training and records. Police need a warrant or another listed basis for ongoing surveillance, real-time identification or tracking. It barred schools from new facial recognition contracts until July 1, 2025; SB 25-143 (2025) removed that end date. Its task force became the AI Impact Task Force (HB 24-1468), ending September 1, 2027. Signed June 8, 2022 (Chapter 463); effective August 10, 2022.

An Act amending sections 28-101, 28-661, 28-662, 28-663, 28-664, 28-665, 28-666, 28-907, 28-909, 28-941, 28-956, 28-957, 28-957.01, 28-966, 28-2157 and 28-3315, Arizona Revised Statutes; amending title 28, Arizona Revised Statutes, by adding chapter 31; relating to motor vehicles.

Arizona's HB 2813 (Laws 2021, Ch. 117) writes autonomous vehicle rules into Title 28. It defines automated driving system, autonomous and fully autonomous vehicle (SAE level 4 or 5) and related terms. A fully autonomous vehicle may operate without a human driver once the operator gives ADOT a law enforcement interaction plan and a written compliance statement, and the automated driving system is treated as the driver while engaged. It also sets crash-reporting duties for driverless vehicles, allows on-demand autonomous networks and autonomous commercial vehicles, preempts local fees, and provides an ADOT safety enforcement process.

Lower Grocery Prices Act

The federal H.R. 8229 (Lower Grocery Prices Act) would prohibit surveillance-based price setting for food, groceries and agricultural commodities: using an automated decision system to offer or inform a customized price for a specific person or group based on surveillance data. The FTC and state attorneys general could enforce it, and injured people could sue for the greater of actual damages or $3,000 per violation. Introduced April 9, 2026 and referred to the House Energy and Commerce and Judiciary committees; no further action.

Relating To Law Enforcement.

Hawaii's Senate Bill 2049 (2026) would have barred law enforcement agencies and officers from using biometric surveillance technology, meaning software that performs facial recognition or other remote biometric recognition, on any person. Exceptions would have covered reasonable suspicion of a crime, executing a judge-authorized warrant based on probable cause that an unidentified or unconfirmed person in an image committed a crime, and emergencies involving immediate danger of death or serious injury. It was referred to committees January 22, 2026 and not enacted.

AN ACT to amend the Code of West Virginia Code, 1931, as amended, by adding thereto a new chapter, designated §17H-1-1, §17H-1-2, §17H-1-3, §17H-1-4, §17H-1-5, §17H-1-6, §17H-1-7, §17H-1-8, §17H-1-9, §17H-1-10, §17H-1-11, §17H-1-12, §17H-1-13, §17H-1-14, and §17H-1-15, all relating to establishing the Fully Autonomous Vehicle Act; defining terms; providing for construction of the act; providing requirements for the operation of fully autonomous vehicles without a human driver and with a human driver; providing for the operation of on-demand autonomous vehicle networks; providing for the operation of fully autonomous commercial and motor vehicle carriers; providing for the platooning of fully autonomous vehicles; providing for licensing, titling, registration, and insurance requirements of fully autonomous vehicles; providing for control and regulation of fully autonomous vehicles; providing for equipment standards for fully autonomous vehicles; and providing duties following a crash involving fully autonomous vehicles.

West Virginia's Fully Autonomous Vehicle Act (new Chapter 17H) authorizes self-driving vehicles on public roads. A fully autonomous vehicle may run without a human driver if its automated driving system can reach a minimal risk condition on failure, and the operator first files a law enforcement interaction plan with the Division of Highways/DOT and proves insurance or self-insurance to the DMV. The act also covers on-demand autonomous vehicle networks, autonomous commercial vehicles, three-vehicle platooning, crash duties and equipment standards, and bars local governments from banning or separately taxing autonomous vehicles.

An Act To Increase Privacy and Security by Regulating the Use of Facial Surveillance Systems by Departments, Public Employees and Public Officials

Maine's 2021 facial surveillance law (25 MRSA §6001) generally prohibits government departments, public employees and officials from obtaining, using or contracting for facial surveillance systems, defined as automated or semi-automated processes that identify people from facial characteristics. Limited exceptions allow searches for serious crimes with probable cause, missing or deceased persons and BMV fraud, but requests must go through the BMV or State Police, which log them. A facial match alone cannot establish probable cause, and illegally obtained data must be deleted and is inadmissible.

Public postsecondary education: generative artificial intelligence systems: procurement standards: training.

California's community colleges and CSU must, and the University of California is asked to, form a working group that by January 1, 2028 recommends procurement standards and user training for generative AI systems bought for education. Standards must require a documented risk assessment, safeguards against harmful output, no engagement-driven sycophancy, self-harm monitoring with human escalation, incident reporting, data-minimization and retention policies, and disclosure of training data sources. Until standards exist, each systemwide GenAI contract triggers a report to the Legislature within 60 days. Effective January 1, 2027.

An Act to Protect Children from Technology-facilitated Sexual Abuse

Maine's 2026 emergency law closes a gap that kept police from charging AI-generated child sexual abuse material. It redefines child sexual abuse material to include computer-generated images created or modified to appear to depict a minor, defines generative AI or machine learning and 'identifiable child', and makes it a Class B crime to alter an image of an identifiable child into such material or to create obscene child sexual abuse material, including with generative AI. Disseminating or possessing obscene AI-generated material is also criminalized. It took effect on approval, April 16, 2026.

AN ACT TO AMEND THE LAW CONCERNING CRIMINAL OFFENSES RELATED TO POSSESSION OF SEXUALLY EXPLICIT MATERIAL THAT DEPICTS A CHILD; TO INCLUDE A COMPUTER GENERATED IMAGE THAT IS INDISTINGUISHABLE FROM THE IMAGE OF A CHILD; AND FOR OTHER PURPOSES.

Arkansas Act 977 of 2025 brings AI-generated child sexual abuse material under the state's child exploitation laws. "Computer generated" means produced, adapted or modified in whole or part using artificial intelligence; "indistinguishable" means an ordinary person would conclude it shows an actual child (drawings, cartoons and paintings excluded). The pandering, possession, distribution and viewing offenses, and electronic facilitation of child sexual abuse (Class B felony), now cover such images. Law enforcement, interactive computer services and good-faith AI adversarial testing are exempt.

An act relating to governmental structures protecting the public health, safety, and welfare

Vermont's S.124 (Act 166 of 2020) is a public safety act whose Sec. 14 imposes a moratorium on facial recognition technology: until the General Assembly authorizes it by law, a law enforcement officer may not use facial recognition technology or information obtained through it, except as permitted for drones under 20 V.S.A. 4622. Facial recognition covers automated or semi-automated identification of a person from facial characteristics and analysis of a face to infer sentiment, state of mind or dangerousness. The act took effect October 1, 2020; the Governor signed it October 7, 2020. Act 17 of 2021 later allowed use in child sexual exploitation investigations.

Pretrial release: risk assessment tools.

SB 36 regulates algorithmic pretrial risk assessment tools used in release decisions. Each pretrial services agency using one must validate it by January 1, 2021 and at least every 3 years, and publish information about the tool, including validation studies. The Judicial Council must list agencies that meet these requirements, publish annual reports on outcomes and potential bias in pretrial release, and report by July 1, 2022 with recommendations to reduce bias and disparate effects.

Autonomous vehicles.

AB 1777 amended Vehicle Code Section 38750 and added Sections 38751 to 38753. Commencing July 1, 2026, manufacturers of autonomous vehicles that operate without a human operator in the vehicle must maintain a dedicated emergency response telephone line and equip each vehicle with two-way voice communication so emergency officials near the vehicle can reach a remote human operator. Emergency officials may issue emergency geofencing messages, and manufacturers must direct fleets to leave or avoid the area within 2 minutes. Peace officers may issue notices of autonomous vehicle noncompliance for observed Vehicle Code violations, which manufacturers must report to the DMV.

Budget Act of 2025.

Section 239 of AB 102 rewrote Section 11.25 of the Budget Act of 2025. Departments under the Governor using state resources for generative AI projects must complete the state's GenAI risk assessment (SIMM 5305-F) and privacy assessments (SIMM 5310-C) and follow the project delivery lifecycle (SIMM 19H). For IT projects using generative AI, agencies must give project documentation to the Legislature regardless of funding source, and funding requests go through the annual budget. The administration had to report by March 1, 2026 on the state's first GenAI proofs of concept.

Workplace surveillance tools.

AB 1883 added Part 5.8 (commencing with Section 1580) to Division 2 of the Labor Code. With certain exceptions, it prohibits an employer, including public employers, from using a workplace surveillance tool that uses artificial intelligence to, among other things, collect neural data or recognize an individual's emotional state. The Labor Commissioner and public prosecutors may enforce it, with civil penalties of up to $500 per violation. Exemptions apply where use is reasonably necessary to comply with federal law or federal contracts for aircraft, national security, military, or space work.

Prohibits collection of biometric identifier information by public or private entity under certain circumstances.

New Jersey's A3926 would bar public and private entities from collecting, retaining, converting, storing or sharing biometric identifier information unless they post clear, plain-language notice at every common entryway about their use of a biometric surveillance system. Penalties would be $5,000 for a first violation and $10,000 for later ones, with criminal grading for a pattern of violations.

Facial recognition technology; local law-enforcement agencies, etc., authorization of use.

Virginia HB 2031 (2021) prohibited local law-enforcement agencies and campus police departments from purchasing or deploying facial recognition technology unless a statute expressly authorizes it, and required any authorizing statute to keep the data under the agency's exclusive control, confidential and reachable only by warrant. Agencies already using it had to stop on July 1, 2021. Facial recognition technology is defined as an electronic system for enrolling, capturing, extracting, comparing and matching geometric facial data; airports with commercial service are exempt. SB 741 (2022) replaced the ban with an authorization framework.

Autonomous driving systems; Secretary of Transportation to convene work group to study.

Virginia HB 2627 (2025) directs the Secretary of Transportation, with the Secretary of Public Safety and Homeland Security, to convene a work group of VDOT, State Police, DMV, legislators and stakeholders on the operational, technical and legal issues raised by autonomous driving systems, considering federal and other states' rules and AAMVA and AASHTO recommendations. The work group must draft legislation to govern autonomous driving systems, finish meeting by September 1, 2026 and report by November 1, 2026. Effective July 1, 2025.

Relating to Criminal Offenses -- Impersonation and Identity Fraud

Rhode Island's 2026 identity fraud amendment defines a forged digital likeness as a computer- or other electronic system-generated visual representation of an identifiable person, or an audio recording of their voice, made to closely resemble a genuine one, likely to deceive, and created and distributed without consent. Digital forgery, knowingly creating or distributing such a likeness as genuine to facilitate fraud, is now felony identity fraud under 11-49.1-3(a)(8). The act also covers impersonating an entity with intent to defraud. Constitutionally protected activity, law enforcement and providers or developers of the underlying technology are excepted. Effective on passage.

Relating to Criminal Offenses -- Impersonation and Identity Fraud

Rhode Island's 2026 identity fraud amendment defines a forged digital likeness as a computer- or other electronic system-generated visual representation of an identifiable person, or an audio recording of their voice, made to closely resemble a genuine one, likely to deceive, and created and distributed without consent. Digital forgery, knowingly creating or distributing such a likeness as genuine to facilitate fraud, is now felony identity fraud under 11-49.1-3(a)(8). The act also covers impersonating an entity with intent to defraud. Constitutionally protected activity, law enforcement and providers or developers of the underlying technology are excepted. Effective on passage.

Intimate Image Distribution Prohibition

Utah HB 193 (2021) created the offense of unlawful distribution of a counterfeit intimate image. A counterfeit intimate image is any visual depiction, including a computer-generated one, edited, manipulated or altered to depict the likeness of an identifiable person nude or engaged in sexual conduct. Distributing one without the person's consent, knowing or having reason to know it would cause emotional distress or harm, is a crime, with an aggravated offense when the person depicted is a child. Law enforcement and crime-reporting activity is exempt.

Criminal Justice Amendments

Utah HB 366 (2024) is a criminal justice bill whose AI-relevant provisions limit algorithmic decision-making. Courts may not rely solely on an algorithm or a risk assessment tool score when deciding on diversion or determining a sentence (Utah Code 77-18-103). The Administrative Office of the Courts must collect data on risk assessment scores. Other provisions on the sentencing commission chair and escape offenses are unrelated to AI. Effective May 1, 2024.

Public Surveillance Prohibition Amendments

Utah SB 231 (2024) defines biometric surveillance information as analysis of surveillance information using biometric software to identify a person or their location from physical attributes, and bars a government entity from obtaining it without a warrant, subject to listed exceptions. Entities must adopt policies on the use, management and auditing of such information. The act also amends the definition of a facial recognition comparison in the 2021 facial recognition chapter so it excludes biometric surveillance information. Effective May 1, 2024.

Facial recognition technology; authorized uses.

Virginia SB 741 (2022) replaced the 2021 local police ban with a regulated framework. Local police, campus police and the State Police may use facial recognition only for listed authorized uses, with systems approved by the Division of Purchases and Supply and evaluated by NIST at 98 percent true-positive accuracy or better with minimal demographic variation. The State Police publish a model policy, agencies report annually, a match cannot by itself establish probable cause for a warrant, and misuse is a Class 3 misdemeanor. The act states its provisions expire July 1, 2026.

Law-enforcement agencies; surveillance technology reporting.

Virginia HB 1496 (2024) creates an annual inventory of police surveillance technology. Every state and local law-enforcement agency and sheriff's office must give the Department of Criminal Justice Services a list of the surveillance technologies it has procured by November 1 each year. Surveillance technology expressly includes biometric surveillance technology such as facial, voice, iris and gait recognition software and databases, and software that integrates or analyzes surveillance data, including predictive policing software. DCJS shares the lists with the State Crime Commission and the Joint Commission on Technology and Science. Effective July 1, 2024.

Requires the collection of oaths of responsible use from users of certain generative or surveillance advanced artificial intelligence systems by the operators of such systems, and transmission of such oaths to the attorney general.

New York's A 1342 would add General Business Law § 394-cccc requiring operators of generative or surveillance advanced AI systems available to New York residents to make users create an account and affirm, under penalty of perjury, that they will not use the service to cause foreseeable injury, promote illegal activity, spread harmful content or knowingly spread false content meant to mislead the public. Operators would have to send each oath to the Attorney General within thirty days. Referred to Consumer Affairs and Protection January 7, 2026; it has not passed either chamber.

sexual assault kits; victim notification

Arizona HB 2482 (Laws 2023, ch. 154) moves the law enforcement crime victim notification fund to A.R.S. 41-2414 and puts it under the Arizona Criminal Justice Commission, which must use it to expand the state's automated crime victim notification system. The funded software must, among other things, "allow victims to leverage conversational artificial intelligence for bidirectional real-time communication with law enforcement agencies through voice, text messages and emails," with a virtual agent that answers and asks questions based on the victim's questions and responses. The act also set up a temporary sexual assault kit study committee. Approved May 19, 2023.

Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…

New York's S 8004 would add Civil Rights Law § 40-h making it unlawful for an owner, franchisor, franchisee or other operator of a place or provider of public accommodation to use any biometric surveillance system or its information, or let a third party do so on its behalf. Collecting biometric information would require written notice, a stated purpose and term, and a written release. Violators and those who aid or incite them would owe the aggrieved person at least the greater of $1,000 or actual damages per violation, plus attorneys' fees. Referred to Investigations and Government Operations January 7, 2026; it has not passed either chamber.

CRIMES AGAINST CHILDREN – Amends and adds to existing law to provide for the crime of visual representations of the sexual abuse of children and to revise provisions regarding the Internet Crimes Against Children Unit.

Idaho's H 465 (2024) targets AI-generated child sexual abuse material. New section 18-1507C makes it a felony, punishable by up to five years and a $5,000 fine, to knowingly produce, distribute, receive, possess or access an obscene visual depiction of a child in explicit sexual conduct, 'including a video or image created using generative AI or machine learning', and the child depicted need not actually exist. Receiving or possessing five or fewer such images is excused if they were promptly destroyed or reported to police. The act also expands sexual exploitation of a child (18-1507) to material altered to show an identifiable child. Effective July 1, 2024.

CRIMINAL PROCEDURE – Adds to existing law to provide certain requirements and restrictions for pretrial risk assessment tools.

Idaho's H 118 (2019) requires transparency for algorithmic pretrial risk assessment tools, which score factors to estimate a defendant's risk and recommend bail or release conditions. All such tools must be transparent: the documents, data, records and information used to build or validate them, and their ongoing usage and validation policies, are open to public inspection, auditing and testing. A criminal defendant whose case involved a tool may review all calculations and data behind their own risk score, and no builder or user may claim trade secret or other intellectual property protection to block that discovery. Effective July 1, 2019.

Generally revise laws related to privacy and facial recognition technology

Montana's SB 397 (Chapter 781 of 2023), the Facial Recognition for Government Use Act, bars state and local agencies, law enforcement, public employees and officials from using continuous facial surveillance and, with exceptions, from obtaining or using facial recognition technology or contracting vendors for it. The Department of Justice and local police may use it in criminal investigations under restrictions, including a warrant requirement, must tell defendants before trial, and must report use annually. Agencies may use facial verification only under a written use and privacy policy, with notice, vendor retention limits and human review training. People harmed may sue.

Requests a study of the use of facial recognition data by law enforcement

Louisiana's HR 199 is a House resolution, adopted 65-30 on June 10, 2021, that requests the House Committees on Administration of Criminal Justice and on Judiciary to jointly study law enforcement's use of facial recognition data, how it is obtained, and its use in investigations and legal proceedings, taking information from groups including the Department of Justice, police and sheriffs' associations, the ACLU and the NAACP. Their report, due February 1, 2022, was to include search, arrest and conviction statistics and recommendations on legislation to safeguard due process, privacy and civil liberties. As a resolution of one chamber, it does not change the law.

To implement the recommendations of the special commission on facial recognition technology

Massachusetts S1053 would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (judge-authorized felony warrant, emergency, deceased identification, another agency's request). Reported favorably by the Judiciary Committee and referred to Senate Ways and Means September 29, 2025; it has not passed either chamber.

An act relating to consumer data privacy and online surveillance

Vermont's S.71 (Act 145) adds the Vermont Data Privacy and Online Surveillance Act. It covers businesses that in the prior year processed personal data of at least 35,000 Vermonters or sensitive data of at least 3,000, or offered for sale personal data of at least 3,000. Consumers may access, correct, delete and port their data and opt out of targeted ads, sales and profiling for automated decisions with legal or similarly significant effects. Controllers must minimize data, get consent for sensitive data, say whether they use data to train large language models, and assess risky processing and profiling. Attorney General enforcement only. Signed June 16, 2026; effective January 1, 2028.

Law enforcement agencies: facial recognition technology.

California's AB 1814 (2023-24 Regular Session) would add Penal Code section 13661 to bar a law enforcement agency or peace officer from using a facial recognition technology match as the sole basis for probable cause to arrest or search, and bar a judge from granting a warrant application based solely on a match. It passed the Assembly 70-0 but was held under submission in Senate Appropriations on August 15, 2024 and was not passed before the session ended.

Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…

New York's A 6211 (same as S 8004) would add Civil Rights Law § 40-h, making it unlawful for an owner, manager, employee or other agent of a place or provider of public accommodation to use a biometric surveillance system or biometric surveillance information, or to let a third party do so on its behalf. It would also require written notice and consent before collecting biometric information. Referred to the Assembly Governmental Operations Committee in February 2025 and again January 7, 2026; it has not passed either chamber.

Creates the surveillance pricing and online retailing act that would prohibit algorithmic price increases for online purchases.

Rhode Island H 7849 (2026), as introduced on February 27, 2026, would add chapter 6-13.4 barring online retailers from knowingly applying an 'algorithmic price increase': a price above the seller's baseline price set using an algorithm, AI or other data processing system and materially influenced by an individual consumer's personal data. Violations are deceptive trade practices with civil penalties up to $100 per violation. The text says it takes effect upon passage.

ICE Out of Our Faces Act

The federal H.R. 7363 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the House Judiciary and Homeland Security committees (and the Border Security and Enforcement Subcommittee); no further action.

Establishes "Fair Pricing and Transparency Act."

New Jersey's S3952, the Fair Pricing and Transparency Act, would bar retail food stores with 50 or fewer employees from surveillance-based price discrimination, dynamic pricing and personalized pricing of groceries, and require them to post sale prices clearly. Stores of 15,000 square feet or more could not use electronic shelf labels until four years after the effective date. Introduced March 16, 2026.

Requires AG to study law enforcement use of facial recognition technology and issue report with recommendations for Statewide policy.

New Jersey's A759 would require the Attorney General to study law enforcement use of facial recognition technology and report to the Governor and Legislature within six months of the bill's effective date, with recommendations for a statewide policy covering State and local law enforcement agencies.

Prohibits use of biometric surveillance system by business entity under certain circumstances.

New Jersey's S1464 would make it an unlawful practice under the Consumer Fraud Act for a business to use a biometric surveillance system (facial or other remote biometric recognition) on consumers at its premises unless it gives clear and conspicuous notice and has a lawful purpose. Businesses could not sell or profit from the data collected.

Includes communications generated using artificial intelligence in the definition of falsely reporting an incident in the third degree.

New York's A 9185 would amend Penal Law § 240.50 (falsely reporting an incident in the third degree) so that each of its four types of false report, including false reports of crimes, emergencies, offenses to law enforcement, and child or vulnerable-person abuse to central registers, expressly covers reports made "including using artificial intelligence or generative artificial intelligence," as defined in General Business Law § 1700. The offense stays a class A misdemeanor. Would take effect immediately. Introduced October 17, 2025 and referred to the Codes Committee (again January 7, 2026); it has not passed either chamber.

Relating To Consumer Protection.

Hawaii's SB 2036 (2026) would have added a new section to HRS chapter 481B prohibiting any person from engaging in 'surveillance pricing': offering or setting a customized price for a specific consumer or group based wholly or partly on information collected through electronic surveillance technology such as sensors, cameras, device tracking and biometric monitoring. A violation would be an unfair or deceptive practice under HRS 480-2. The Senate committee on LBT deferred it on February 11, 2026; it died.

Requires boards of education and boards of trustees to adopt policy on use of surveillance systems with artificial intelligence capabilities.

New Jersey's A1323, in its first reprint, would require a school district board of education or a charter or renaissance school board of trustees that uses a surveillance system with AI capabilities (video surveillance, x-ray machine or body scanner) to adopt a policy on it. It was reported by the Assembly Science, Innovation and Technology Committee with amendments on February 19, 2026.

Requires AG to study use of artificial intelligence for certain law enforcement purposes and issue report.

New Jersey's A3076 would require the Attorney General to study how law enforcement agencies use AI to generate police reports and report to the Governor and Legislature within six months of the act's effective date, with recommendations for a Statewide policy. The text reviewed is the pre-filed version.

Requires boards of education to adopt policy on use of surveillance systems with artificial intelligence capabilities.

New Jersey's S3883 would require a school district board of education, or charter or renaissance school board of trustees, that uses a surveillance system with artificial intelligence capabilities, including video surveillance, x-ray machines and body scanners, to adopt a policy on it and give it to parents and guardians. Introduced March 12, 2026.

Prohibits use of facial recognition technology on consumer except for legitimate safety purpose.

New Jersey's S3268 would make it an unlawful practice under the Consumer Fraud Act for a person selling goods or services at retail, or at a place of public accommodation, to use a biometric surveillance system (facial or other remote biometric recognition software) on a consumer, except for a legitimate safety purpose. Introduced February 2, 2026.

Establishes Deep Fake Technology Unit in DLPS; appropriates $2 million.

New Jersey's S 2130 (as introduced) would have the Attorney General, consulting the state Chief Technology Officer, establish a Deep Fake Technology Unit in the Division of Criminal Justice to give State and local law enforcement, prosecutors and courts technical assistance, expertise and training on deceptive audio or visual media, including analyzing evidence and giving expert testimony. The unit would issue annual reports beginning one year after it forms, and $2 million would be appropriated from the General Fund. Introduced January 13, 2026 and referred to the Senate Law and Public Safety Committee; it has not passed either house.

Enacts the New York Artificial Intelligence Civil Rights Act establishing protections for individual rights with respect to computational algorithms; establishes protections against the use of algorithms involved in consequential decisions, such as those that impact people's rights, civil…

New York's A 9654 (the New York Artificial Intelligence Civil Rights Act) would bar developers and deployers from using covered algorithms in consequential actions (such as employment, housing, credit, health care, insurance, education, criminal justice and government services) in ways that discriminate or have a disparate impact on protected characteristics. It would require independent audits where harm is plausible. Referred to the Assembly Science and Technology Committee January 21, 2026; it has not passed either house.

Prohibits collection of biometric identifier information by public or private entity under certain circumstances.

New Jersey's S 1463 would bar public and private entities in the State from collecting, retaining, converting, storing or sharing biometric identifier information gathered through biometric surveillance systems (including facial, iris, retina, voice, fingerprint or palm recognition), but would let them collect it if they post clear notice at every common entryway. Violations would carry civil penalties of $5,000 and $10,000, and a pattern of violations would be a crime. Referred to the Senate Law and Public Safety Committee January 13, 2026; it has not passed either house.

Video Surveillance

South Carolina's H 4675 would create the Community Data Protection and Responsible Surveillance Act. State and local law enforcement could not use surveillance systems (automated license plate readers) that store data on third-party servers or use AI to identify or track vehicles by appearance. Data would be kept at most 21 days and searched only with a warrant. Referred to the House Judiciary Committee January 13, 2026; it has not passed either house.

Establishes "Fair Pricing and Transparency Act."

New Jersey's A4742 (Wainstein, Rodriguez, Walker), the Fair Pricing and Transparency Act, would bar retail food stores from using surveillance-based price discrimination, dynamic pricing, or personalized pricing (personalized pricing means prices set using automated systems, AI, machine learning, or algorithms relying on consumer or inferred data) on groceries and other foodstuffs. Retail establishments with more than 50 employees would not be covered. Introduced March 19, 2026 and referred to the Assembly Consumer Affairs Committee; identical Senate bill S3952.

Establishes "Fair Price Protection Act."

New Jersey's Fair Price Protection Act (S 3612) was substituted on June 30, 2026 by A 4085 (Assembly committee substitute for A 4085 and A 4523, third reprint), which became P.L.2026, c.55 on July 23, 2026. It makes surveillance pricing of groceries and other foodstuffs, meaning pricing set in whole or part by an algorithm or automated system using personal data, an unlawful practice under the Consumer Fraud Act, with exceptions. It also sets a one-year moratorium on new electronic shelf labels. Effective August 1, 2027 (first day of the 13th month after enactment); the moratorium section takes effect February 1, 2027.

Eavesdropping, Peeping, and Voyeurism

South Carolina's H 3042 would amend Section 16-17-470 on eavesdropping, peeping and voyeurism. It would add voyeurism by creating, with generative adversarial network techniques or other digital technology, a realistic but false image, audio or video of another person for sexual gratification, and cover selling or distributing such material. It also raises penalties. Introduced January 14, 2025 and referred to the House Judiciary Committee; it has not passed either chamber.

Urging The Leadership Of The Department Of Law Enforcement To Periodically Undergo Training On Crimes Relating To Artificial Intelligence Technology.

Hawaii's House Resolution 48 (2024) would have urged the Director, Deputy Directors and Administrators of the Department of Law Enforcement to complete training on crimes involving artificial intelligence, including deepfakes and related technologies, at least every two years. It was offered March 7 and referred to the House JHA and FIN committees on March 8, 2024, and was never adopted. A resolution does not change the law.

Urging The Leadership Of The Department Of Law Enforcement To Periodically Undergo Training On Crimes Relating To Artificial Intelligence Technology.

Hawaii's House Concurrent Resolution 65 (2024) would have urged the Director, Deputy Directors and Administrators of the Department of Law Enforcement to train on crimes relating to artificial intelligence, including deepfakes, at least every two years. It was referred to House committees on March 8, 2024 and never adopted; it died at the end of the biennium. A resolution does not change the law.

Eyewitness Identification

Not law: died in committee. Florida's SB 1202 would have amended s. 92.70, F.S., on eyewitness identification: officers would have had to record the eyewitness's description in the offense report, use lineups with the suspect and at least five fillers, make efforts to use a lineup instead of a show-up, and record procedures on audio and video. If facial recognition technology identified a suspect, a lineup could not be held unless there was a basis independent of the facial recognition result. It died in Criminal Justice on March 13, 2026.

CONSUMER FRAUD-DIGITAL PRICING

Illinois's SB 3657 (104th General Assembly) would amend the Consumer Fraud and Deceptive Business Practices Act in two ways. Grocery stores offering digital coupons would have to provide a paper copy of equal value on request. A person also could not use surveillance-based price setting, or surveillance data in an automated decision system, to set individualized prices. Re-referred to Assignments March 27, 2026.

Provides that a person may operate a fully autonomous vehicle on the public roads of this state without a human driver provided that the automated driving system is engaged and the vehicle meets certain conditions; defines terms; requires insurance and that such vehicle is registered as a fully…

New York's A 4901-B (same as S 344-B) would add Article 34-E to the Vehicle and Traffic Law, letting a person operate a fully autonomous vehicle (gross vehicle weight rating of 10,000 pounds or less) on public roads without a human driver if the automated driving system is engaged and the vehicle can reach a minimal risk condition after a system failure. Operators would need to file insurance proof and a law enforcement interaction plan, and registration and title would be marked as fully autonomous. Referred to the Transportation Committee; amended and recommitted April 24, 2026. It has not passed either chamber.

STATE GOVT-GENERAL MANDATES

Illinois' Public Act 103-0101 (HB 3902), the Drones as First Responders Act, amends the Freedom from Drone Surveillance Act to let police use drones for search and rescue, infrastructure inspections, demonstrations, dispatched emergency calls and some government-hosted events. Police may not use onboard facial recognition in flight and may run drone data through facial recognition only to counter a terrorist risk found by the Homeland Security Secretary or on reasonable suspicion that swift action is needed to prevent imminent harm, escape or evidence destruction. Drones may not be armed. It revises data retention and adds Attorney General enforcement. Approved and effective June 16, 2023.

AN ACT to amend Tennessee Code Annotated, Title 55, Chapter 30 and Title 55, Chapter 8, relative to autonomous vehicles.

Tennessee's HB 2302 was enacted as its Senate companion, SB 2253 (Public Chapter 726), which the House substituted for it on March 23, 2026. The law amends Tenn. Code § 55-8-202 so a state or local law enforcement agency may adopt a policy for enforcing traffic offenses committed by an automated driving system (ADS). Under such a policy, when a POST-certified or state-commissioned officer finds an ADS committed an offense, the notice or citation goes by first-class mail to the vehicle's registered owner within 20 business days, allows 30 days to pay, and no added costs may be charged without a second notice. Signed April 13, 2026 (Public Chapter 726); effective on signing.

Requesting The Hawaii State Commission On The Status Of Women To Establish A Working Group And Provide A Report To The Legislature On Ways To Strengthen Prevention, Interventions, And Protections For Survivors Of Image-based Sexual Abuse.

Hawaii's House Resolution 85 (H.D. 2, 2026) asks a designee of the Hawaii State Commission on the Status of Women to form a working group, including gender-based violence service providers, survivors, county police, prosecutors, coalitions and the Judiciary, to review laws and policies nationwide for ways to prevent image-based sexual abuse and protect survivors. Its recitals cite AI-generated abuse and sexual deepfakes. A report with any proposed legislation is due 20 days before the 2028 session; the group dissolves December 31, 2027. Adopted by the House April 9, 2026; a resolution of one chamber does not change the law.

Provides that a person may operate a fully autonomous vehicle on the public roads of this state without a human driver provided that the automated driving system is engaged and the vehicle meets certain conditions; defines terms; requires insurance and that such vehicle is registered as a fully…

New York's A 539-B (2023-2024) would have added Vehicle and Traffic Law Article 34-E allowing a person to operate a fully autonomous vehicle (SAE Level 4 or 5) on public roads without a human driver if the automated driving system is engaged, the vehicle can reach a minimal risk condition after a failure, a law enforcement interaction plan is filed and proof of insurance under VTL Article 6 is submitted. A city of five million or more could set local rules for for-hire services. The enacting clause was stricken July 22, 2024; the bill died with the 2023-2024 session.

Law-enforcement agencies & sheriff's dept.; policy on use of covered artificial intelligence syst.

Virginia's HB 1170 (2026 Regular Session) would have required the Department of Criminal Justice Services to set a model policy for law-enforcement use of covered AI systems by October 1, 2026, and local agencies, sheriffs and State Police to adopt policies meeting it by January 1, 2027. It failed: tabled in House committee February 2, 2026.

Establishes Deepfake Technology Unit in DLPS; appropriates $2 million.

New Jersey's A3058 would have the Attorney General, consulting the State Chief Technology Officer, establish a Deepfake Technology Unit in the Division of Criminal Justice to analyze and authenticate evidence, give expert testimony and train law enforcement, prosecutors and courts. It would appropriate $2 million from the General Fund to the Department of Law and Public Safety.

Establishes the "protect our privacy (POP) act" to impose limitations on the use of drones for law enforcement purposes; prohibits the use of drones by law enforcement at concerts, protests, demonstrations, or other actions protected by the first amendment.

New York's S 1096, the protect our privacy (POP) act, would add Civil Rights Law section 52-e. It would prohibit drone use by law enforcement agencies or for law enforcement purposes, with exceptions for search and rescue and examining dangerous areas after natural disasters, bar drones at concerts, protests and other First Amendment activity, and bar armed drones. Data from drones using facial recognition could not be used in investigations or prosecutions and would have to be deleted. Remedies would include suppression and a private action for the greater of $1,000 per violation or actual damages. Referred to Codes January 7, 2026; it has not passed either chamber.

Mississippi Consumer Privacy Protection Act; create.

Mississippi's HB 1051 (2026) would have created the Mississippi Consumer Privacy Protection Act for businesses with over $25 million in revenue that handle personal information of 175,000+ consumers (or 25,000+ with over half of revenue from selling data). Consumers could opt out of profiling used for decisions with legal or similarly significant effects. It was referred to House Judiciary A on January 16, 2026 and died in committee on February 3, 2026.

Prohibits the use of surveillance pricing

New York's A 9349-B would amend General Business Law section 349-a to prohibit surveillance pricing, meaning prices set in whole or part by an algorithm using personal data to offer different prices to different customers for the same goods or services. It would replace the current disclosure requirement with a ban, and bar using personal data to enable it. The Assembly passed it June 4, 2026; the Senate substituted it for S 8623-B and passed it June 4, 2026; as of October 8, 2026 the records show no delivery to or action by the Governor.

Preventing Algorithmic Collusion Act of 2025

The federal S 232 (Preventing Algorithmic Collusion Act of 2025) would make it unlawful to use or distribute a pricing algorithm that uses or was trained with nonpublic competitor data, with federal civil penalties. It would also require audit reports on request and disclosures of algorithmic pricing by companies with $5 million or more in revenue. Read twice and referred to the Senate Judiciary Committee January 23, 2025; it has not passed either house.

SURVEILLANCE-BASED PRICING

Illinois's HB 4985 would create the Surveillance-Based Price Discrimination Act, barring a person from using surveillance data as part of an automated decision system to inform the individualized price charged to a consumer. The Attorney General and aggrieved consumers could sue. Filed February 4, 2026; assigned to the Consumer Protection Committee March 18 and re-referred to the Rules Committee March 27, 2026; it has not passed either house.

AN ACT relating to data privacy.

Kentucky's HB 33, the Kentucky Price Fairness Act (2026 session), would have amended the Kentucky Consumer Data Protection Act (KRS 367.3611 and 367.3617) to bar controllers from 'surveillance pricing', meaning customized price increases based on individualized data, and from setting or displaying a price with an automated-decision system based on such data. The base price would have had to be the same for all consumers. Exceptions: uniform real-time market adjustments, loyalty programs, and verifiable costs. Referred to committee January 13, 2026; died when the session ended.

Stop AI Price Gouging and Wage Fixing Act of 2025

The federal H.R. 4640, the Stop AI Price Gouging and Wage Fixing Act of 2025, would bar a person from surveillance-based price setting (using an automated decision system to set a customized price from surveillance data) and from surveillance-based wage setting, with limited exceptions, and would require data-accuracy, correction and disclosure procedures to be published 180 days before relying on a price exception or using a wage-setting system. The FTC, state attorneys general and, for wages, the EEOC could enforce it; private suits would seek the greater of actual damages or $3,000 per violation. Introduced July 23, 2025; it remains in committee and has not passed either chamber.

Requires boards of education to adopt policy on use of surveillance systems with artificial intelligence capabilities.

New Jersey's A4639 would require a school district board of education, or a charter or renaissance school project board of trustees, that uses a surveillance system with AI capabilities, including a video surveillance system, x-ray machine or body scanner, to adopt a policy on it, distribute it to parents and post signs. Introduced June 25, 2024; second reprint as reported by the Assembly Education Committee with amendments on December 18, 2025. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.

Surveillance-based price setting prohibited.

Not law. Minnesota's HF 3408 would have added Minn. Stat. 325D.141 barring retail food stores from surveillance-based price setting, meaning customized prices based on personal information gathered through electronic surveillance technology such as cameras, device tracking, biometrics and facial recognition. Stores using facial recognition would post entrance signage, and larger stores' electronic shelf labels could change prices only once a day. It never left committee.

Prohibits the use of facial recognition and biometric information as the sole factor in determining the existence of probable cause to place in custody or arrest an individual.

New York's A 1447 would amend the Executive Law (new § 837-z) so that biometric identifying technology, including facial recognition, cannot be the sole factor in determining probable cause to place a person in custody or arrest them. By January 1, 2027, every municipal police department, sheriff's office and the State Police would have to adopt a written policy barring stops, detentions or searches solely motivated by the technology, or the Division of Criminal Justice Services would order a penalty of withheld state funds. Would take effect immediately. Referred to Governmental Operations January 7, 2026; it has not passed either chamber.

Protecting Everyone from Excessive Police Surveillance (PEEPS) Act

West Virginia's HB 4628, the Protecting Everyone from Excessive Police Surveillance (PEEPS) Act (2026 regular session), would have barred government officials from accessing databases of photos, video, license plate, facial recognition or cell site data that reveal locations more than 24 hours old unless there is a warrant, voluntary consent, a reported lost or stolen vehicle, exigent circumstances, or specified traffic, toll and parking uses. Data could be kept no more than 10 days. It was sent to House Judiciary on January 21, 2026 and died when the session ended March 14, 2026.

Prohibit surveillance-based price setting

Minnesota's SF 4199 would have prohibited retail food stores from surveillance-based price setting, meaning customized prices based on personal information gathered through electronic surveillance such as cameras, sensors, biometric data or facial recognition. It would also have required facial recognition signage and limited electronic shelf label price changes. Introduced March 9, 2026 and never left committee.

Prohibiting surveillance-based price discrimination and surge pricing for retail goods.

Washington's HB 2481, the fair pricing and transparency act (2026 session), would have barred non-small businesses selling grocery products from surveillance-based price discrimination (prices set from monitoring or automated analysis of a consumer's personal data) and from surge pricing based on real-time or predicted demand; 'algorithm' is defined to include AI. It would also have barred electronic shelf labels in stores of 15,000 square feet or more until January 1, 2030; violations would be Consumer Protection Act violations. It was heard in House Appropriations on February 5, 2026 and died at adjournment.

Provides for municipal and state police authorities to acquire and to utilize automated license plate readers and identify what data may be collected and in what ways the data can be used.

Rhode Island H 8077 (2026), as introduced on February 27, 2026, would let municipal and state police use automated license plate readers under a new chapter 12-5.3. Readers could scan plates only for listed purposes, could not photograph vehicle occupants or record audio, and captured plate data would be deleted after 21 days except for stated exceptions. The attorney general and aggrieved persons could sue. The text takes effect January 1, 2027.

Internet and E-mail Fraud; the criminal offense of digital identity fraud; establish

SB594 seeks to establish the criminal offense of digital identity fraud in Georgia, providing for criminal and civil penalties, a cause of action and damages, definitions, and repealing conflicting laws.

Criminal Law - Mail and Package Theft (Porch Piracy Act of 2025)

Maryland's HB 210 (2025, the Porch Piracy Act of 2025, third reader) is a mail and package theft bill. It would have made taking mail or a package addressed to someone else a felony (up to 5 years), created penalties for mail theft and arrow-key offenses, and added mail theft under Criminal Law section 3-905.1 to the list of crimes in Criminal Procedure section 2-503(a)(1)(i) that police may investigate using facial recognition technology. It passed the House 137-0 and was referred to Senate Judicial Proceedings March 17, 2025; it died when the session ended.

An Act Concerning Consumer Privacy And Protection.

Connecticut's Public Act 26-64 (SB 4) targets data-driven pricing and surveillance. Businesses that use an automated price setting device fed by personal data (other than to set a discount) and advertise the price online must show "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA" or similar. Retailers and delivery apps may not use surveillance pricing. Data privacy act controllers using facial recognition on premises for security must match only against their own database and post entrance signs. It also requires data brokers to register, bans selling precise geolocation data, and adds genetic-testing consent rules. Signed May 27, 2026; effective October 1, 2026.

Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty.

Virginia's SB 796 (2026 Regular Session) would create the Artificial Intelligence Chatbots and Minors Act. Covered entities would have to implement reasonable systems and processes, try to notify emergency services of imminent risk and report covered incidents to the Attorney General. Passed the Senate 39-1; continued to 2027 in the House on March 2, 2026.

Foreign Adversary AI Risk Assessment and Diplomacy Act

The federal H.R. 7058 (Foreign Adversary AI Risk Assessment and Diplomacy Act), as introduced, would require the Secretary of State to submit to Congress an assessment of risks from foreign adversaries' use of generative AI for malicious activities, first within 180 days after enactment and then annually for three years. Introduced January 14, 2026; the House Foreign Affairs Committee ordered it reported 45-0 on March 26, 2026 (no reported text published yet); it has not passed either chamber.

No Biometric Barriers to Housing Act of 2025

The federal H.R. 3060 (No Biometric Barriers to Housing Act of 2025) would, starting 1 year after enactment, bar owners of covered federally assisted rental housing from using or authorizing facial recognition, physical biometric or remote biometric recognition technology in a unit or its building or grounds for surveillance or any use that adversely affects tenants' fair access to housing. HUD must report within 1 year. Introduced April 29, 2025 and referred to the House Financial Services Committee; no further action.

Provides that a person may operate a fully autonomous vehicle on the public roads of this state without a human driver provided that the automated driving system is engaged and the vehicle meets certain conditions; defines terms; requires insurance and that such vehicle is registered as a fully…

New York's A 3650 would have added Vehicle and Traffic Law Article 34-E allowing a fully autonomous vehicle (SAE level 4 or 5) to operate on public roads without a human driver when its automated driving system is engaged, if it can reach a minimal risk condition, is registered and titled as fully autonomous, and the operator files a law enforcement interaction plan and proof of insurance. The Department of Motor Vehicles would be the exclusive state regulator. Introduced January 29, 2025; enacting clause stricken February 5, 2025.

Prohibits facial recognition technology to be used in connection with an officer camera used by both local and state police including the storage of biometric data.

New York's A 3712 would have added Executive Law §§ 837-x and 236 barring local police, peace officers and State Police from installing, activating or using facial recognition or biometric surveillance systems in connection with an officer camera or data collected by one. A person could sue the agency or officer for equitable or declaratory relief. A mobile fingerprint scanner exception applied. Would have taken effect on the ninetieth day after becoming law and expired five years later. Introduced February 7, 2023; it died at the end of the 2023-2024 session.

AN ACT relating to autonomous vehicles.

Kentucky's HB 7 (2024 Ky. Acts Ch. 176), enacted over the Governor's veto, sets rules for fully autonomous vehicles in KRS Chapter 186. Vehicles with automated driving systems may operate on public highways if they meet the act's requirements, including a law enforcement interaction plan filed with the Transportation Cabinet and State Police, single-limit liability coverage or self-insurance of at least $1,000,000, and titling and registration. Until July 31, 2026, fully autonomous vehicles over 62,000 pounds must carry a credentialed human driver to monitor and intervene. The Transportation Cabinet is the sole regulator and local governments may not add rules.

AN ACT relating to privacy protection.

Kentucky's HB 45 (2024 session) was a privacy bill covering automated license plate readers (data kept no more than 30 days with exceptions, no sale), drone surveillance, deep fakes, identification devices and tracking devices. The deep fake sections would have given a civil action against anyone who willfully and knowingly disseminated a deep fake without written consent and made certain harmful disclosures a Class D felony. The House passed it 96-0 with a committee substitute on February 28, 2024; in the Senate it was reassigned to Transportation March 7, 2024 and died.

AN ACT relating to autonomous vehicles.

Vetoed. Kentucky's HB 135 (2023) would have let fully autonomous vehicles (SAE level 4 or 5) run on Kentucky highways without a human driver if the system could reach a minimal risk condition after a failure and follow traffic laws. Operators would have filed a law enforcement interaction plan with the Transportation Cabinet and State Police and shown $5 million in liability coverage; the owner would have been the operator under traffic laws, public agencies could not ban the vehicles, and only the lead truck in a platoon would have needed a driver. The Governor vetoed it April 10, 2023.

Requires policing agencies to conduct an inventory of, and develop a publicly-available policy for, any artificial intelligence used to aid criminal investigations.

New York's A 9253-A would add Executive Law § 837-ww requiring policing agencies to publish a public disclosure of each “covered AI” used to aid criminal investigations, at least ninety days before using a new product and within 180 days of the effective date for products already in use. Any use in an investigation would have to be noted in the police report, and the Attorney General would issue a model policy. Introduced November 21, 2025; amended and recommitted to the Codes Committee March 17, 2026; it has not passed either chamber.

Criminal Procedure – Facial Recognition Technology – Requirements, Procedures, and Prohibitions

Maryland's HB 338 limits police use of facial recognition technology in criminal investigations to listed serious crimes (crimes of violence, human trafficking, child abuse, hate crimes, weapon crimes, stalking and others), bans live or real-time identification, and allows searches only of license, ID and mugshot photos unless an agreement governs another database. A trained person must verify each result before use; results cannot alone establish probable cause or identity and serve as evidence only for warrants and preliminary hearings. Agencies must audit, post policies and report yearly. Signed May 16, 2024 (Chapter 809; identical to SB 182, Chapter 808); effective October 1, 2024.

Criminal Procedure - Facial Recognition Technology - Requirements, Procedures, and Prohibitions

Maryland's SB 182 limits police use of facial recognition technology in criminal investigations to listed serious crimes (crimes of violence, human trafficking, child abuse, hate crimes, weapon crimes, stalking and others), bans live or real-time identification, and allows searches only of license, ID and mugshot photos unless an agreement governs another database. A trained person must verify each result before use; results cannot alone establish probable cause or identity and serve as evidence only for warrants and preliminary hearings. Agencies must audit, post policies and report yearly. Signed May 16, 2024 (Chapter 808; identical to HB 338, Chapter 809); effective October 1, 2024.

Autonomous vehicles; allowing fully automated vehicles to operate on public roads. Effective date.

Oklahoma's SB 1541 (2022) lets fully autonomous vehicles drive on public roads without a human driver when the automated driving system is engaged and the vehicle can reach a minimal risk condition if the system fails, can obey traffic laws and meets federal safety certification. Before driverless operation, the operator must file a law enforcement interaction plan with the Department of Public Safety and prove at least $1 million of insurance or self-insurance. The vehicle must stay at the scene of a crash and the owner must report it. The automated driving system counts as the licensed driver. Effective November 1, 2022.

An Act advancing the economic development of the commonwealth through comprehensive data privacy

Massachusetts' S 301 would add a new chapter 93M to the General Laws, the Massachusetts Information Privacy and Security Act, a comprehensive data privacy law with defined terms such as consent (which excludes dark patterns), controller, data broker and biometric information. In the captured text, a large data holder's risk assessment would also have to say whether processing relies on an algorithmic process, such as machine learning or AI, and describe its design, input data and outputs. The bill accompanied a study order on December 18, 2025 and did not advance.

Transportation; allow and regulate autonomous vehicles.

Mississippi's SB 2569 (2023), the "Mississippi Fully Autonomous Vehicle Enabling (MS FAVE) Act of 2023," would, per its title, have authorized fully autonomous vehicles (SAE Level 4 or 5) to operate on public roads without a human driver while the automated driving system is engaged and certain conditions are met. This is the Senate-passed version; the House passed it as amended on February 23, 2023, but it died on the calendar on March 10, 2023.

Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions

Not law. S 1033 would have barred New York police officers, peace officers and police agencies, including the State Police, from using biometric surveillance systems such as facial recognition, with exceptions such as lawful DNA comparison, fingerprinting and internal security systems. A 12-member task force would have studied the technology's accuracy, effectiveness and harms, especially to vulnerable groups, and recommended whether and how police could use it. The bill was recommitted and its enacting clause stricken on February 21, 2025, which ends it. The Assembly version, A 1045, has its own page.

Relative to the use of artificial intelligence by state agencies.

New Hampshire's HB 1688 adds RSA chapter 5-D. State agencies may not use AI to classify people in ways that cause unlawful discrimination, use real-time remote biometric identification for public surveillance (except law enforcement with a warrant), or use deepfakes for deceptive or malicious purposes. Irreversible AI decisions need human review, generative AI material not reviewed by a human must be labeled, and users must be told when they interact with AI. Signed July 12, 2024 (Chapter 209); effective July 1, 2024.

Limit government use of AI systems

HB 178 (Chapter 427 of 2025) limits government AI use. State and local government entities and state officers may not use an AI system for cognitive behavioral manipulation, to classify people in ways that cause unlawful discrimination or disparate impact, for a malicious purpose, or to surveil public spaces except to find a missing, endangered or wanted person or as the facial surveillance law allows. AI-produced material published without review by a trained human must be labeled, and public-facing AI interfaces disclosed. Any AI recommendation or decision that could affect a person's rights must be reviewed by a responsible human who can reject or modify it. Effective October 1, 2025.

Establishes the New York artificial intelligence ethics commission.

New York's S 8755 (2023-2024) would have added State Technology Law § 106-c creating a nine-member New York artificial intelligence ethics commission to oversee ethical AI use by state agencies and private entities affecting New York residents. The commission would set ethical guidelines, review AI projects, receive complaints, develop certification and audits, and report annually. The bill would also prohibit nine AI practices, including systematic unfair discrimination and non-consensual surveillance. Referred to Internet and Technology March 7, 2024; it died when the 2023-2024 session ended.

Requires AG to study use of artificial intelligence for certain law enforcement purposes and issue report.

New Jersey's A 5615 would have required the Attorney General to study law enforcement agencies' use of artificial intelligence to generate police reports and report to the Governor and Legislature within six months of the effective date. The report would assess available AI technology, summarize current use statewide and recommend a statewide policy requiring an officer to review any AI-generated report for accuracy and completeness before issuing it. Introduced May 5, 2025 and referred to the Assembly Public Safety and Preparedness Committee; it died in committee when the 2024-2025 session ended.

Requires AG to study law enforcement use of facial recognition technology and issue report with recommendations for Statewide policy.

New Jersey's A5616 would require the Attorney General to study law enforcement use of facial recognition technology and report to the Governor and Legislature within six months of the act's effective date. The report would include recommendations for a Statewide policy. Introduced May 5, 2025. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.

Prohibits use of facial recognition technology on consumer except for legitimate safety purpose.

New Jersey's S 968 (2024-2025 session, as introduced) would make it an unlawful practice under the Consumer Fraud Act for a person selling goods or services at retail, or operating a place of public accommodation, to use a biometric surveillance system (software that performs facial recognition or other remote biometric recognition) on a consumer, except for a legitimate safety purpose. The bill's statement says violations would carry penalties up to $10,000 for a first offense and $20,000 after. Introduced January 9, 2024 and referred to the Senate Commerce Committee; it died when the 2024-2025 session ended.

AN ACT relating to privacy protection.

Kentucky's HB 58 (2026) makes it unlawful for anyone, including the state and local governments, to use automated license plate readers (ALPRs: high-speed cameras plus data processing that turn vehicle and plate images into computer-readable data) except for listed purposes such as parking, secured-area access, public safety and auto theft, law enforcement, commercial vehicle enforcement and tolls. Captured data generally may not be kept over 90 days or sold or shared, with exceptions for police, insurers and lenders. Violations carry fines of $20 to $2,000, up to one year in jail, or both. Signed April 10, 2026 (Acts Ch. 71).

Relating to public safety; and declaring an emergency.

Oregon's 2026 public safety act (Chapter 77, in effect since it was signed on March 31, 2026) sets statewide rules for police use of automated license plate recognition (ALPR): cameras combined with computer algorithms that read plates and vehicle traits. Police may use ALPR only for listed purposes, must delete data not tied to a case or investigation within 30 days, log every search, publish their policies and their vendors' monthly audits, and may share data with non-Oregon agencies only for a specific law enforcement purpose. Vendors may not use, share or sell the data. The act also changes pretrial release and two state grant programs.

Data Privacy - Consumer Data, Public Records, and Message Switching System (Data Privacy Act)

HB711 prohibits the sale of consumer data to governmental units engaged in civil immigration enforcement unless required by law.

Limiting the use of automatic registration plate readers, requiring a search warrant for data from an automatic registration plate reader or security camera, and providing a penalty.

Wisconsin's AB 576 would have banned use of automatic registration plate readers (devices that turn plate images into computer-readable data) except by parking facilities, for access control to enclosed non-public areas, and at weigh stations. It would also have barred law enforcement from using data from private security cameras or plate readers without a warrant, except in an emergency involving danger of death or serious injury. Introduced October 24, 2025 and referred to committee; it failed to pass March 23, 2026.

Surveillance-based price and wage discrimination prohibited.

Not law. Minnesota's HF 4131 would have added Minn. Stat. 325D.141 prohibiting surveillance-based price discrimination and wage discrimination, meaning use of an automated decision system to inform individualized prices or wages from surveillance data about a consumer or worker. Listed cost, group-discount and insurer risk exceptions would apply, and wage-setters would have to disclose the data and how the system uses it. The text has no penalties or enforcer. Introduced March 9, 2026; effective August 1, 2026 if enacted.

Relating to: prohibiting state agencies and local governmental units from using facial recognition technology or data generated from it.

Wisconsin's AB 575 (2025-26) would have created s. 995.80 to prohibit any state agency or local governmental unit from using facial recognition technology, or data generated from it, for any purpose except identifying its own employees for employment-related purposes. It was referred to the Criminal Justice and Public Safety Committee on October 24, 2025 and failed to pass pursuant to Senate Joint Resolution 1 on March 23, 2026.

AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.

Tennessee's SB2215 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: HB 2608. Not passed before the session ended in April 2026; last action: Assigned to General Subcommittee of Senate Judiciary Committee (March 23, 2026).

Prohibits use of biometric surveillance system by business entity under certain circumstances.

New Jersey's A3929 would make it an unlawful practice under the Consumer Fraud Act for a business entity to use a biometric surveillance system, meaning facial or other remote biometric recognition software, on a consumer at its physical premises unless it gives clear notice and uses it for a lawful purpose. Businesses could not sell, share or profit from the information. This describes the bill as introduced (pre-filed text); later amendments, if any, are not reflected.

MS Fully Autonomous Vehicle Enabling Act; extend repealer on law enforcement interaction plan submission to DPS.

Mississippi's SB 2269 keeps in force, until July 1, 2029, the rule that anyone operating a fully autonomous vehicle on public roads without a human driver must first submit a law enforcement interaction plan to the Department of Public Safety. The rule (Code § 63-35-7, from the 2023 MS FAVE Act) was set to be repealed July 1, 2026. The plan covers how to reach a fleet support specialist, how to safely remove and tow the vehicle, and how to tell whether it is in autonomous mode; without one, the Department may order the vehicle off public roads. Approved March 13, 2026 (Chapter 330); effective July 1, 2026.

Concerning the use of facial recognition services.

Washington's Chapter 257, Laws of 2020 (ESSB 6280) governs state and local government use of facial recognition services (chapter 43.386 RCW). Before use, an agency must give notice to its legislative authority and publish an accountability report after public comment and community meetings. Decisions with legal or similarly significant effects require meaningful human review; services must be tested in operational conditions and vendors must allow independent accuracy and bias testing. Ongoing surveillance, real-time identification and persistent tracking need a warrant, exigent circumstances or a court order. The governor vetoed section 10 (a task force). Effective July 1, 2021.

Relates to transparency and safety requirements for developers of artificial intelligence models

New York's S 8828 (Chapter 96 of 2026) is the chapter amendment to the RAISE Act (Chapter 699 of 2025). It repealed and replaced General Business Law Article 44-B and set the effective date at January 1, 2027. Developers of frontier models (over 10^26 training operations) must publish transparency reports when deploying and report critical safety incidents to a Department of Financial Services office within 72 hours. Those with over $500 million in revenue must also publish and follow a frontier AI framework, report internal-use risk assessments, file disclosure statements and pay assessments, and face Attorney General penalties up to $1 million, then $3 million. Signed March 27, 2026.

Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; and provides for the expiration and repeal of certain provisions

New York's S 5609 (same as A 1045) would add Executive Law §§ 837-y and 236 to bar police agencies, police officers, peace officers and the state police from acquiring, possessing, accessing, installing, activating or using biometric surveillance systems (such as facial recognition) or information derived from them. A 12-member task force would study whether to allow police use. Reported from the Senate Internet and Technology Committee and committed to Codes February 25, 2026; it has not passed either chamber.

Relating To Traffic Safety.

Hawaii's HB 1231 (Act 212 of 2025) bars photo red light imaging detector systems and automated speed enforcement systems from using or being equipped with facial recognition software or biometric identification technology. Automated license plate readers and non-biometric technology used to verify vehicle identity or registration or to produce photographic evidence of a violation are exempt. It also requires each county to impose a $5 motor vehicle registration surcharge for the safe routes to school program by December 31, 2025, and revises the mailing rules for speed camera citations. Became Act 212 June 25, 2025; effective on approval.

VEH CD-LICENSE PLATE READERS

Illinois's SB 3320 (103rd General Assembly) would have amended Section 2-130 of the Illinois Vehicle Code on automated license plate readers (ALPR), which use computer algorithms to convert plate images into searchable data. It would have set retention and access limits on ALPR detections held by State law enforcement. Died at Session Sine Die on January 7, 2025.

Prohibits the use of facial recognition and biometric information as the sole factor in determining the existence of probable cause to place in custody or arrest an individual.

New York's A 519 (2023-2024) would have amended the Executive Law (new § 837-y) so that biometric identifying technology, including facial recognition, could not be the sole factor in determining probable cause to place a person in custody or arrest them. By January 1, 2025 every municipal police department, sheriff's office and the State Police would have had to adopt a written policy barring stops, detentions or searches solely motivated by such technology. Referred to Governmental Operations January 9, 2023 and January 3, 2024; it never passed and died at the end of the 2023-2024 session.

Provides that a person may operate a fully autonomous vehicle on the public roads of this state without a human driver provided that the automated driving system is engaged and the vehicle meets certain conditions; defines terms; requires insurance and that such vehicle is registered as a fully…

New York's S 344-B would add Vehicle and Traffic Law Article 34-E allowing a fully autonomous vehicle (10,000 pounds or less gross weight, with two distinct sensing modalities) to operate without a human driver while its automated driving system is engaged. Operators must file a law enforcement interaction plan with the DMV and show proof of insurance or self-insurance, and the owner is liable for traffic violations while the system is engaged. Amended and recommitted to Transportation May 6, 2026; it has not passed either chamber.

Use of Surveillance Technology by Law Enforcement

Colorado's SB26-071, the Surveillance Accountability and Freedom Ensured (SAFE) Act, would have set rules for law enforcement surveillance technology, including facial recognition systems, which could be used only after a warrant or in exigent circumstances with an imminent public-safety threat. The requirements would apply from July 1, 2027. The Senate Judiciary Committee postponed it indefinitely 6-1 on May 6, 2026; it is dead.

Requires the division of criminal justice services to formulate a protocol for the regulation of the use of artificial intelligence and facial recognition technology in criminal investigations; restricts the use of artificial intelligence-generated outputs in court.

New York's A 10625 would have amended Executive Law § 837 to require a standardized written protocol for police use of AI and facial recognition technology in criminal investigations, and added Criminal Procedure Law § 60.77 making AI-generated outputs, including facial recognition results, inadmissible as evidence in criminal or civil proceedings. Referred to the Codes Committee June 20, 2024; it died at the end of the 2023-2024 session.

Provides that a person may operate a fully autonomous vehicle on the public roads of this state without a human driver provided that the automated driving system is engaged and the vehicle meets certain conditions; defines terms; requires insurance and that such vehicle is registered as a fully…

New York's S 1012-B (2023-2024 session) would have added Vehicle and Traffic Law Article 34-E allowing a person to operate a fully autonomous (SAE level 4 or 5) vehicle on public roads without a human driver while its automated driving system is engaged, subject to conditions, a law enforcement interaction plan, proof of insurance and registration as a fully autonomous vehicle. The state would have governed these vehicles exclusively, with any city of five million or more people able to set local for-hire rules. It was referred to the Transportation Committee and last amended March 1, 2024; it did not pass, and the session ended without action.

Prohibits the use of biometric surveillance technology by law enforcement; establishes the biometric surveillance regulation task force; provides for the expiration and repeal of certain provisions.

New York's S 1609 (2023-2024) would have added Executive Law sections 837-x and 236 prohibiting police agencies, officers, peace officers and State Police members from acquiring, possessing, accessing or using a biometric surveillance system, or information derived from one. Exceptions covered mobile fingerprint scanning, the State DNA index and the statewide fingerprint system. It also created a Task Force on the Regulation of Biometric Surveillance. Reported and committed to Codes May 7, 2024, it died when the 2023-2024 session ended.

Requires the collection of oaths of responsible use from users of certain generative or surveillance advanced artificial intelligence systems by the operators of such systems, and transmission of such oaths to the attorney general.

New York's S 8206 (2023-2024) would have added General Business Law section 394-cccc requiring operators of generative or surveillance advanced AI systems accessible to New York residents to require an account and, before account creation, collect from each user an oath under penalty of perjury not to use the system for the four listed harmful purposes. Operators must send each oath to the Attorney General within 30 days. Referred to Internet and Technology January 12, 2024, it died when the 2023-2024 session ended.

Provides relative to the regulation of artificial intelligence (OR +$256,243 GF EX See Note)

Louisiana's HB791, the People's A.I. Act, would have regulated AI chatbot providers: consent before processing personal data or training on chat logs, no selling chat logs, a ban on using chat logs for ads, notices that the user is talking to a chatbot, monthly risk assessments, and treating chatbots as products for liability. The Attorney General or a district attorney could enforce and users could sue. It was referred to House Commerce March 9, 2026 and died.

To implement the recommendations of the special commission on facial recognition technology

Massachusetts H1946 would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (judge-authorized felony warrant, emergency, deceased identification). Referred to the Judiciary Committee February 27, 2025; on October 23, 2025 it accompanied new draft H4640, which was reported favorably and referred to House Ways and Means.

Artificial Intelligence Transparency Amendments

Utah's HB 286 (2026), Artificial Intelligence Transparency Amendments (first substitute), would have enacted the AI Transparency Act: a large frontier AI developer would have to write, implement and publish a public safety plan for catastrophic risks; per the bill's highlighted provisions, developers would also publish child protection plans and risk assessment summaries and report safety incidents to the Office of Artificial Intelligence Policy, with civil penalties and whistleblower protections. It never passed the House; the enacting clause was struck and the bill filed on March 6, 2026.

Addressing artificial intelligence, student discipline, and surveillance in public schools.

Washington's SB 5956 (1st substitute, 2026 session) would have limited AI, automated decision systems (ADS) and surveillance technology in public school discipline. An ADS could not have been the sole or determinative basis for a discipline decision, districts could not have used ADS risk scores or watchlists predicting misconduct or violence, and biometric data could not have been used to infer emotions or other sensitive traits. It passed the Senate 35-13 on February 10, 2026 but was returned to Senate Rules on March 12 and died at adjournment.

Relating to the regulation of automated motor vehicles; creating a criminal offense.

GIITEM subaccount; predictive policing technology

Vetoed. Arizona's SB 1293 (2015) would have appropriated $1,150,000 from the concealed weapons permit fund in fiscal year 2015-2016 to the Department of Administration for block grants to city police agencies for a pilot program to buy and maintain predictive policing technology software: software that generates crime predictions by applying mathematical algorithms and criminal behavior theory to past crime data and recalibrates automatically. It also directed GIITEM border security subaccount money to county sheriffs. The Governor vetoed it April 13, 2015.

Senate Substitute for HB 2313 by Committee on Federal and State Affairs - Prohibiting the use of the artificial intelligence platform DeepSeek and other artificial intelligence platforms controlled by a country of concern on state-owned devices and on any state network and the use of genetic sequencers or operational software used for genetic analysis that is produced in a foreign adversary.

Kansas's Senate Substitute for HB 2313 (2025) bars using state-owned or state-issued devices to access DeepSeek or any AI model controlled, directly or indirectly, by a country of concern (China including Hong Kong, Cuba, Iran, North Korea, Russia, Venezuela; Taiwan excluded). State agency networks must block these platforms and agencies must delete existing accounts; law enforcement and cybersecurity investigations are exempt. It also bars state-funded medical and research facilities from using genetic sequencers or analysis software from a foreign adversary. Approved April 8, 2025; it takes effect on its publication in the statute book.

Disclosure of Intimate Images

South Carolina's H. 3058 (Act No. 37 of 2025) creates the crime of unauthorized disclosure of intimate images (S.C. Code §§ 16-15-330, 16-15-332), covering real images and "digitally forged intimate images" made or substantially modified with machine learning or other computer means, even if labeled as fake. Intentionally sharing one without the person's effective consent is a felony if meant to cause harm or for profit (first offense up to $5,000 and/or 5 years; later offenses up to $10,000 and/or 1 to 10 years) and otherwise a misdemeanor for a first offense. Signed May 12, 2025; effective on approval.

Law-enforcement agencies; use of certain technologies & interrogation practices; forensic lab.

Virginia's HB 1257 (2026 Regular Session) would direct the Department of Criminal Justice Services to set a framework for law-enforcement use of generative AI, machine learning systems and audiovisual surveillance technologies and for interrogations, with model policies and training. Continued to 2027 in committee on February 2, 2026.

Prohibition from using artificial intelligence to dynamically set product prices

Minnesota's SF 3098 (1st engrossment) would add Minn. Stat. 325D.141 prohibiting surveillance-based price discrimination and wage discrimination, meaning individualized prices or wages set with an automated decision system from surveillance data about a consumer or worker, and would require published procedures for data accuracy and challenges. Introduced March 27, 2025; amended and re-referred to Commerce and Consumer Protection March 18, 2026 with no recommendation. It died when the 2026 session adjourned without passing.

SURVEILLANCE DISCRIMINATION

Illinois's SB 2255 (104th General Assembly) would create the Surveillance-Based Price and Wage Discrimination Act. A person could not use surveillance data as part of an automated decision system to inform the individualized price charged to a consumer or the individualized wage paid to an employee. The Attorney General would enforce it. Re-referred to Assignments May 22, 2026.

State Emergency Medical Services Board - Public Access Automated External Defibrillator Program - Revisions

HB276 revises the Public Access Automated External Defibrillator Program by establishing AED coordinator requirements, repealing regional council AED committees, and exempting AEDs in certain law enforcement patrol vehicles. It also sets certification qualifications for grocery stores and restaurants.

Artificial Intelligence Civil Rights Act of 2025

The AI Civil Rights Act would bar companies from developing or using AI-driven 'covered algorithms' in decisions about jobs, education, housing, utilities, health care, credit, insurance, criminal justice, elections, government benefits or public accommodations in a way that causes a disparate impact or otherwise discriminates based on a protected characteristic. Where harm is plausible, an independent auditor must evaluate the algorithm before deployment, and deployers must assess impacts every year, with summaries made public. The FTC would set rules for human alternatives and appeals. Enforced by the FTC, state attorneys general and private lawsuits. Introduced December 2, 2025.

Facial Recognition Act of 2025

The federal H.R. 4695 (Facial Recognition Act of 2025) would let officers use facial recognition with a reference photo database only under a court order lasting no more than 7 days, or narrow emergency exceptions. It would ban face surveillance and use for immigration enforcement, bar a match as the sole basis for probable cause, require NIST accuracy testing and audits, exclude evidence from violations and allow suits for the greater of profits or $50,000 per violation. Introduced July 23, 2025 and referred to the House Judiciary and Science, Space, and Technology committees; no further action.

To implement the recommendations of the special commission on facial recognition technology

Massachusetts H4640, a new draft of H1946, would replace G.L. c. 6, s. 220 to bar law enforcement from using facial recognition and other biometric surveillance except for State Police searches under set conditions (registrar identity checks, judge-authorized felony warrant, emergency, deceased identification, another agency's request). Reported favorably by the Judiciary Committee and referred to House Ways and Means October 23, 2025; it has not passed either chamber.

Law Enforcement - Use of Facial Recognition Technology - Images Captured in Dwelling Interior

Maryland's HB 756 (2026, first reader text) would have added an exception to Criminal Procedure section 2-503 letting law enforcement use facial recognition technology on still or video images captured by a camera inside a dwelling to investigate arson, burglary and trespass offenses. It had a House Judiciary hearing set for February 24, 2026 and died when the 2026 session ended.

Acquisition and use of facial recognition technology by government entities prohibited.

Minnesota's HF 3146 would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. Evidence from violations would have been inadmissible, and people could sue for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced April 7, 2025 and referred to Public Safety Finance and Policy and it never left committee.

Fourth Amendment Restoration Act

West Virginia's HB 4682, the Fourth Amendment Restoration Act (2026 regular session), would have barred law enforcement officers, and anyone acting for law enforcement purposes, from using seven listed technologies, including facial recognition, license plate readers and surveillance drones, unless a warrant based on probable cause authorizes use against a specific person. Knowing and willful use would be a felony. It was sent to House Judiciary on January 21, 2026 and died when the session ended March 14, 2026.

VEH CD-ALPR-RECORD RETENTION

Illinois's SB 3257 (104th General Assembly) would amend Section 2-130 of the Illinois Vehicle Code on automated license plate readers (ALPRs), redefining an ALPR as a camera or system using computer algorithms to convert plate images into searchable data. Law enforcement could retain detection records for 5 years, with archiving after 90 days. Last action: re-referred to Assignments May 22, 2026.

Law Enforcement Usage of Artificial Intelligence

Utah SB 180 (2025) requires each law enforcement agency to have a policy on employees' use of generative AI, covering approved tools, permitted tasks, review of AI output and discipline for violations. A police report or other law enforcement record created wholly or partly with generative AI must carry a disclaimer that it contains AI-generated content, and the author must certify that they read and reviewed it for accuracy. The act defines artificial intelligence and generative AI. Effective May 7, 2025.

An act relating to use of facial recognition technology by law enforcement in cases involving sexual exploitation of children

Vermont's H.195 (Act 17 of 2021) makes a narrow exception to the 2020 moratorium on police facial recognition (Act 166 of 2020, Sec. 14). Law enforcement may use facial recognition technology during a criminal investigation into sexual exploitation of children under 13 V.S.A. chapter 64, but only to search for images, including video, of a victim, potential victim or identified suspect within electronic media legally seized in that investigation. The act took effect on passage; the Governor signed it May 4, 2021.

Requires policing agencies to conduct an inventory of, and develop a publicly-available policy for, any artificial intelligence used to aid criminal investigations.

New York's S 10425 would add Executive Law § 837-ww requiring policing agencies to publish a disclosure for any "covered AI" used to aid criminal investigations, including generative AI used to write police reports, at least 90 days before using a new product. Agencies would have to disclose AI use in filed reports, keep audit trails, and adopt an Attorney General model policy. Referred to Codes May 15, 2026; it has not passed either chamber.