The intersection of data privacy and AI regulation is a fast-growing area of state law. Bills address how AI systems collect, process, and store personal data — with requirements for consent, data minimization, purpose limitation, and the right to opt out of AI profiling.
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
New York's A 8158 (the "New York privacy act") would add General Business Law Article 42-A (§§ 1200-1207). Among other consumer rights, people could opt out of "profiling in furtherance of decisions that produce legal or similarly significant effects" (such as lending, housing, insurance, employment and health care), and controllers would have to run data protection assessments for profiling that presents a reasonably foreseeable risk of unfair treatment or unlawful disparate impact. Only the Attorney General could enforce it, with penalties of up to $20,000 per violation. Introduced May 2, 2025 and referred to Consumer Affairs and Protection (again January 7, 2026); not passed.
South Carolina Social Media Regulation Act
South Carolina's H. 3431 (Act No. 96 of 2026) adds an Age-Appropriate Code Design chapter (S.C. Code Title 39, Chapter 80) for online services, including AI-based ones, meeting revenue or data thresholds and reasonably likely to be accessed by minors. They must use reasonable care to prevent listed harms to minors, offer tools to turn off features like infinite scroll and autoplay, let users opt out of personalized recommendation systems (the default for known minors), minimize minors' data, limit profiling of known minors, stop targeted ads to minors, provide parental tools and publish annual independent audits. The Attorney General enforces. Signed February 5, 2026; effective on approval.
Updates the definition of cyberbullying in the dignity for all students act to include intentionally using artificial intelligence to mimic or alter a person's likeness or voice without their consent.
New York's S 10049 would amend Education Law section 11(8) so that the definition of cyberbullying (harassment or bullying through electronic communication) includes, but is not limited to, intentionally using artificial intelligence to mimic or alter a person's likeness or voice without their consent. It sets no penalty, enforcer or private right of action. The Senate passed it 60 to 0 on May 28, 2026 and delivered it to the Assembly, where it was referred to Education; it takes effect immediately if enacted.
Data brokers: data collection and deletion.
California's SB 361 expands what data brokers must report when registering with the California Privacy Protection Agency. Registrations must say whether the broker collects data such as account logins, government ID numbers, citizenship or immigration status, union membership, sexual orientation, gender identity or biometric data, and whether in the past year it shared or sold consumers' data to a developer of a generative AI system or model, a foreign actor, governments or law enforcement. Signed October 8, 2025 (Chapter 466); effective January 1, 2026.
Consumer Protection and Labor and Employment - Electronic Shelving Labels and Surveillance-Based Price and Wage Setting - Prohibitions
Maryland's SB 889 (2026, first reader text) would have barred surveillance-based price setting (pricing consumer goods or services based on profiling or processing of consumer or device data), barred food retailers of at least 15,000 square feet from using electronic shelving labels to display prices, and barred employers from surveillance-based wage setting using surveillance data with an automated decision system. It had a Senate Finance hearing set for March 12, 2026 and died when the 2026 session ended.
Vehicle Laws - Fully Autonomous Vehicles
Maryland's SB 909 (2026, first reader text, cross-filed with HB 1295) would have allowed fully autonomous vehicles to operate without a human driver on Maryland highways if they meet safety, first responder plan and insurance requirements, including at least $1,000,000 combined single limit liability coverage when the automated system is engaged. It would have barred state and local bans on such vehicles. It had a Senate hearing set for March 4, 2026 and died when the 2026 session ended.
Vehicle Laws - Fully Autonomous Vehicles
Maryland's HB 1295 (2026, first reader text, cross-filed with SB 909) would have allowed fully autonomous vehicles to operate without a human driver on Maryland highways if they meet safety, first responder plan and insurance requirements, including at least $1,000,000 combined single limit liability coverage when the automated system is engaged. It would have barred state and local bans on such vehicles. It had a House hearing set for March 5, 2026 and died when the 2026 session ended.
Consumer Protection and Product Liability - Chatbots
Maryland's HB 1250 (2026, first reader text, cross-filed with SB 827) would have regulated operators and developers of generative AI chatbots made available to Maryland users: affirmative consent for training on input data, a ban on using chat logs for advertising, a 10-year cap on chat log retention, protections for users under 13, hourly not-human warnings, monthly safety testing, and product liability with possible strict liability. It had a House Economic Matters hearing set for March 3, 2026 and died when the 2026 session ended.
Consumer Protection - Companion Chatbots - Regulation
Maryland's HB 952 (2026, third reader text) would have required operators of companion chatbots available to Maryland users to keep and publish self-harm and minor sexual-content protocols, display warnings that the chatbot is not human (a persistent on-screen warning plus pop-ups at the start and after every hour of continuous use), limit personal data use, and run a complaint system. A chatbot would be treated as a product with strict liability exposure. It passed the House 123-4, was referred to Senate Finance, and died when the 2026 session ended.
Use of automated decision systems in employment settings regulated.
Minnesota's HF 4445 would have required employers to give workers written notice before using an automated decision system (ADS) for employment-related decisions, with consent, human review, post-decision notice, appeal and records rules, enforced by the Commissioner of Labor and Industry and by private suits. It would have banned using ADS for facial, gait or emotion recognition. Introduced March 18, 2026 and never left committee.
Artificial Intelligence in Higher Education
Not law: died in committee. Florida's SB 1458 would have created the Artificial Intelligence in Higher Education Study Group to examine how AI affects academic integrity (including contract cheating), teaching, advising, grading, research, privacy, intellectual property and data security in the State University System and Florida College System. It would have had to report findings, recommendations and model policies to the Governor, Senate President and House Speaker by December 1, 2026, and the section would have expired December 31, 2026. It died in Education Postsecondary on March 13, 2026.
AN ACT relating to privacy protection.
Kentucky's HB 63 (2026 session) would have created a civil cause of action and a felony for disseminating a 'deep fake': realistic media that appears to show a person saying or doing something they did not, depends substantially on technical means, and lacks adequate labeling. A natural person who willfully and knowingly disseminated one without the depicted person's written consent would have been liable for damages, with a three-year limitation period; a criminal offense would have been a Class D felony. Referred to House Judiciary January 14, 2026; died when the session ended.
AN ACT relating to privacy protection.
Kentucky's HB 21 (2025 session) would have created a civil cause of action and a felony for disseminating a 'deep fake': realistic media appearing to show a person saying or doing something they did not, lacking adequate labeling and produced substantially by technical means. A natural person who willfully and knowingly disseminated one without the depicted person's express written consent would have been liable for damages, and certain disclosures with intent to harm would have been a Class D felony. Referred to committee February 4, 2025; died when the session ended.
An act relating to consumer data privacy
Vermont's S.93 (2025-2026 biennium) would have enacted a consumer data privacy law applying to businesses that process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 25 percent of revenue from selling data. It would have given consumers rights including opting out of profiling for solely automated decisions with legal or similarly significant effects, required consent for sensitive data including biometrics, and given the Attorney General exclusive enforcement. It died in committee after referral on February 27, 2025.
Prohibiting surveillance-based price discrimination and surge pricing for retail goods.
Washington's SB 6312, the Senate companion to HB 2481 (2026 session), would have barred non-small businesses selling grocery products from surveillance-based price discrimination (prices set from monitoring or automated analysis of a consumer's personal data) and from surge pricing based on real-time or predicted demand; 'algorithm' is defined to include AI. It would also have barred electronic shelf labels in stores of 15,000 square feet or more until January 1, 2030; violations would be Consumer Protection Act violations. It got no committee action on February 4, 2026 and died at adjournment.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's SB 454 (2026 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3F), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was sent to Senate Judiciary on January 16, 2026 and died when the session ended March 14, 2026.
Protecting state and local government systems and data from foreign entities
West Virginia's SB 70 (2026 regular session) would have created the Data Protection Act (new W. Va. Code art. 5-34). State agency officials, employees and contractors would have had to block, on state-owned or state-leased internet-capable devices, social media platforms owned by entities in a foreign country of concern, and could not use applications, software or AI algorithms owned by entities located in such a country. Senate Government Organization reported it do pass on February 6, 2026 and sent it to Judiciary, where it died when the session ended March 14, 2026.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's SB 170 (2025 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3F), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was sent to Senate Judiciary on February 12, 2025 and went no further.
Protecting state and local government systems and data from foreign entities
West Virginia's SB 694 (2025 regular session) would have created the Data Protection Act (new W. Va. Code art. 5-32). State agency officials, employees and contractors would have had to block, on state-owned or state-leased internet-capable devices, social media platforms owned by entities in a foreign country of concern, and could not use applications, software or AI algorithms owned by entities located in such a country. It was reported do pass but first to Judiciary on March 11, 2025 and went no further.
Prohibiting the use of deep fake technology to influence an election
West Virginia's HB 4963 (2024 regular session, committee substitute) would have added Article 3F to Chapter 61 barring anyone from disseminating a deep fake, or agreeing to, within 90 days before an election, knowing or reasonably should know it is a deep fake, without the depicted person's consent and with intent to injure a candidate or influence the result. Maximum prison terms would range from 90 days to 5 years. It passed the House on February 27, 2024 and died in Senate Judiciary.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's SB 720 (2024 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3D), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was sent to Senate Judiciary on February 8, 2024 and went no further.
Creating the protection against deep fakes act to provide a cause of action for damages arising from the use of generative artificial intelligence to create an image or likeness of another person without such person's consent for use in obscene material.
Not law. Kansas SB 525, the Protection Against Deep Fakes Act, would have let a person whose image or likeness is shown through synthetic media in published obscene material, without express written consent, sue the producer, promoter or intentional possessor. A plaintiff could recover actual damages, punitive damages equal to the defendant's revenue from the material, and attorney fees. It would not be a defense that the likeness was AI-generated and is not the person's actual image or likeness. It was referred to Senate Judiciary February 21, 2024 and died in committee April 30, 2024.
DFPR-AI-MENTAL HEALTH SERVICE
Illinois's HB 5649 (103rd General Assembly) would have made it an unlawful practice under the Consumer Fraud Act for a licensed mental health professional to provide mental health services through AI without first obtaining the patient's informed consent and disclosing the use of AI tools, with matching grounds for discipline in the professional licensing Acts. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
Sexual offenses.
Indiana treats AI-generated and digitally altered sexual images as 'intimate images' under both its civil nonconsensual-pornography law and its crime of distributing an intimate image. Distributing such an image of a person who has not consented, when the distributor knows or reasonably should know that, is a Class A misdemeanor, or a Level 6 felony if the person has a prior unrelated conviction for this offense. The act also covers concealed-camera voyeurism and certain child sexual abuse claims. The AI provisions took effect July 1, 2024.
Establishes a cause of action for misuse of artificial intelligence
Louisiana's HB157 would have made it a violation of the state's identity-misappropriation law to use AI to generate an audiovisual work of a person's identity (name, voice, likeness or digital replica) for a commercial purpose without prior consent. Violators could be liable for the greater of $1,000 or actual damages plus disgorgement of profits, with injunctions and discretionary attorney fees. It was referred to House Civil Law and Procedure March 9, 2026 and died.
Relating to explicit digital forgeries.
Not law. Oregon HB 2230 (2025), sponsored by Representative Osborne, would have made it a crime, with intent to harass, humiliate or injure, to create, possess, distribute or purchase a sexually explicit image digitally forged with software or AI to appear as a realistic depiction of an individual. First degree (depicted person a minor) would have been a Class C felony; second degree (without the person's consent) a Class A misdemeanor. It was referred to Judiciary and Ways and Means and was in committee upon adjournment June 27, 2025.
Ai in education
South Carolina's H 5253 would add Section 59-28-195 limiting AI in public schools. Schools would need written opt-in parental consent before requiring or permitting student AI use, AI could not replace a licensed teacher in core instruction or final grading, and student data could not be sold or used for profiling. Introduced February 24, 2026 and referred to the House Education and Public Works Committee; it has not passed either chamber.
A bill for an act relating to restrictions on the use of artificial intelligence, and creating a civil cause of action.
Iowa's HF 406 would require device companies and AI developers to disclose and get separate agreement before AI accesses private data on smart devices, let users uninstall preinstalled AI, and bar using AI to recreate a person's likeness without consent for commercial or deceptive uses. It creates a private right of action with punitive damages up to $250,000 per violation. A House subcommittee recommended passage March 5, 2025; it has not passed either chamber.
Use of fabricated media in elections.
Indiana's SB 7 (2024) would have barred disseminating 'fabricated media' made with generative AI, or contracting to do so, fewer than 90 days before an election to injure a candidate or influence the outcome, when the person knows or reasonably should know it is fabricated, the depicted person did not consent (for altered recordings and imitations of real people), and it lacks the disclaimer 'Elements of this media have been digitally altered or artificially generated.' A knowing and intentional violation would be a Class B misdemeanor, with enhancements. Referred to committee January 8, 2024; it did not pass.
Use of altered media in elections.
Indiana's HB 1283 (2024) would have barred anyone who finances a candidate communication from disseminating 'fabricated media' (altered recordings or generative-AI imitations made without consent) of a candidate in an election within 90 days, to injure the candidate or party or influence the outcome, unless it carries the disclaimer 'This media has been manipulated or generated by artificial intelligence.' A depicted candidate could sue; the bill sets no criminal penalties. Referred to committee January 9, 2024; it did not pass.
Eavesdropping, Peeping, and Voyeurism
South Carolina's H. 5394 (2023-24) would have amended Code 16-17-470 (eavesdropping, peeping and voyeurism) to increase penalties and to cover knowingly creating or altering images, audio, video or digital files with a generative adversarial network or other digital technology to make a realistic but false depiction of another person without consent, for sexual arousal or gratification, and knowingly selling or distributing such material without consent. It would also have required destruction of evidence and notice to additional victims. Referred to House Judiciary April 10, 2024; it did not pass.
Relating to the unlawful production or distribution of sexually explicit images or videos using deep fake technology; increasing a criminal penalty.
Texas HB 1092 (2025), as introduced, would have made it an offense to knowingly produce or distribute by electronic means a deep fake image or video that appears to show a real person with intimate parts exposed or in sexual conduct, without that person's effective consent. It would have been a Class A misdemeanor, or a state jail felony if a depicted real child was younger than 14 when the depiction was created. It did not pass both chambers and died when the regular session adjourned June 2, 2025.
Relating to the unlawful production or distribution of sexually explicit images or videos using deep fake technology; increasing a criminal penalty.
Texas HB 387 (2025), as introduced, would have amended Penal Code Sec. 21.165 so that knowingly producing or distributing by electronic means a deep fake image or video that appears to show a real person with intimate parts exposed or in sexual conduct, without effective consent, is a state jail felony instead of a Class A misdemeanor. It did not pass both chambers and died when the regular session adjourned June 2, 2025.
Relating to the creation of certain explicit deep fake material; providing a private cause of action.
Texas HB 421 (2025), as engrossed, would have added Business & Commerce Code Chapter 121 requiring the owner of a deep fake generator (a website or app operating in Texas that lets users create deep fake material) to verify the age of the person apparently depicted, using a commercially reasonable method, and barring it from allowing explicit deep fake material of an adult without written consent or of anyone under 18. A depicted person, or a minor's parent or guardian, could have sued for actual damages, court costs, attorney's fees and possibly exemplary damages. It passed the House, its chamber of origin, but died when the regular session adjourned June 2, 2025.
Relating to an automated artificial intelligence review of library material purchased by public schools; providing an administrative penalty.
Texas HB 4448 (2025), as introduced, would have required school districts and open-enrollment charter schools to have library material reviewed by a Texas Education Agency-approved third party using an automated AI review to rate it sexually explicit or sexually relevant. Explicit material could not be purchased, and relevant material would need parental consent. The agency could assess penalties up to $10,000 per library material acquired in violation. It did not pass both chambers and died June 2, 2025.
A BILL for an Act to create and enact a new section to chapter 12.1-31 of the North Dakota Century Code, relating to prohibiting deepfake videos and images; and to provide a penalty.
North Dakota's HB 1320 (2025) would have created a new section of Century Code chapter 12.1-31 making it a class A misdemeanor to intentionally produce, possess, distribute, promote, advertise, sell, exhibit, broadcast or transmit a 'deepfake video or image' without the consent of the person shown. A deepfake was any video or audio recording, film, image or photograph digitally altered or created by AI with intent to deceive that depicts a person's image or voice in something that did not occur. The House defeated it 17-69 on January 21, 2025.
Relating to the use of an automated employment decision tool by an employer to assess a job applicant's fitness for a position; imposing an administrative penalty.
Texas SB 2991 (2025), as introduced, would have added Labor Code Chapter 95 barring employers from using an automated employment decision tool on an applicant unless they notify the applicant, explain how it is used and what characteristics may be evaluated, and get written consent. Tools could not use protected-class status or the applicant's zip code. Employers would have had to make reasonable efforts to destroy assessments within 30 days, and the commission would assess administrative penalties of $2,500 to $7,500 per violation. No enrolled version exists, so it died June 2, 2025.
CHAT Act Children Harmed by AI Technology Act
The CHAT Act would require operators of companion AI chatbots (built mainly to simulate friendship, companionship, emotional or therapeutic conversation) to require user accounts and verify every user's age; existing accounts would be frozen until verified. Minors' accounts must be tied to a verified parent account with parental consent, parents must be told immediately of conversations involving suicidal ideation, and minors must be blocked from chatbots that engage in sexually explicit communication. A pop-up must say the user is not talking to a human at the start and every 60 minutes. Enforced by the FTC and state attorneys general; effective 1 year after enactment.
VET Artificial Intelligence Act Validation and Evaluation for Trustworthy (VET) Artificial Intelligence Act
The VET AI Act would direct NIST to develop, within a year and update at least every 2 years, voluntary technical guidelines for internal and independent third-party assurance of AI systems: testing, evaluating, verifying and validating them. The guidelines would address consumer privacy, assessing and reducing harms, dataset quality, documentation and disclosure, and governance, and recommend how often and how deeply developers and deployers should be assessed based on risk. Commerce would convene an advisory committee on assessor qualifications and study the capacity of the AI assurance sector. Introduced July 31, 2025.
Expressing the sense of the House of Representatives with respect to the use of artificial intelligence in the financial services and housing industries.
A nonbinding House resolution stating that the House Financial Services Committee should lead policymaking on AI in the financial services and housing industries. It says the committee should promote a pro-consumer, pro-investor and pro-innovation culture, ensure regulators enforce existing laws including anti-discrimination laws, avoid rules that disproportionately burden smaller firms, consider reforms to financial privacy laws, strengthen AI cybersecurity standards and study AI's effect on the workforce. Financial Services approved it 54-0 on January 22, 2026 and reported it, as amended, on March 19, 2026.
AN ACT relating to addictive online platforms.
Not law. As introduced, HB 227 would have regulated both AI companion platforms and large social media platforms in Kentucky: addictive features for minors, age verification, verifiable parental consent for children's accounts, a private right of action and Attorney General enforcement. The House committee substitute removed the AI companion platform provisions, leaving a social media bill, which the House passed 96-0 on March 9, 2026. It then stalled in the Senate Judiciary Committee and died when the 2026 session ended.
Relative to the use of information technology and artificial intelligence systems by state agencies.
Did not pass. SB 657 would have expanded New Hampshire's oversight of AI in state government: the information technology council would advise on agencies' development, procurement and use of AI, including compliance with the state's AI code of ethics (RSA 5-D) and privacy safeguards, and the Department of Information Technology would keep a public inventory of executive-branch AI systems and report each October 1 on their use, compliance, incidents and workforce effects. Both chambers passed versions, but the Senate refused the House amendment on May 21, 2026 and no further action followed.
Enacting the Kansas age-appropriate design code act to require businesses to assess and mitigate risks of compulsive use in minors; enacting the Kansas stopping likeness abuse by nonconsensual digital replicas act to create a private right of action for the unauthorized digital replication and…
Not law. HB 2772 would have enacted three Kansas acts. An Age-Appropriate Design Code Act would have required online businesses likely to be used by minors to assess designs for the risk of compulsive use, use the lowest-risk design by default, give minors the highest privacy settings, and limit data collection. A digital-replica act would have let people sue over digital replicas of their likeness made without consent. A chatbot act would have required chatbots to say they are not human, limited the use of chat logs, and made providers liable for injuries their chatbots cause. It died in the House Federal and State Affairs Committee on April 10, 2026.
Enacting the Kansas age-appropriate design code act to require businesses to assess and mitigate risks of compulsive use in minors, enacting the Kansas stopping likeness abuse by nonconsensual digital replicas act to create a private right of action for the unauthorized digital replication and…
Not law. SB 499, the Senate twin of HB 2772, would have enacted three Kansas acts. An Age-Appropriate Design Code Act would have required online businesses likely to be used by minors to assess designs for the risk of compulsive use, use the lowest-risk design by default, give minors the highest privacy settings, and limit data collection. A digital-replica act would have let people sue over replicas of their likeness made without consent. A chatbot act would have required chatbots to say they are not human, limited the use of chat logs, and made providers liable for injuries their chatbots cause. It died in the Senate Federal and State Affairs Committee on April 10, 2026.
Establishing the Kansas community harmed by AI technology act, mandating user accounts and age verification for AI chatbot access, classifying users by age, requiring parental consent for minors, blocking explicit content, protecting age information confidentiality, monitoring for suicidal…
Not law. The Kansas CHAT Act (Community Harmed by AI Technology Act) would have required anyone offering a companion AI chatbot in Kansas to require user accounts, verify every user's age (freezing existing accounts until verified), and link minors' accounts to a verified parent account with parental consent. Minors would have been blocked from chatbots that engage in sexually explicit talk, and cut off with their parent alerted if they expressed suicidal thoughts. Chatbots would have had to show a pop-up at least every 60 minutes saying the user is not talking to a human. It died in committee on April 10, 2026.
Ban on employer use of automated decision systems.
Not law. HB 1421 would have barred Indiana employers with 11 or more workers, and state and local government employers, from relying solely on an automated decision system for hiring, firing, pay, scheduling or other job decisions. Using such a system's output would have required bias testing before use and independent testing every year, advance notice to workers and applicants, human review, plain-language documentation within 7 days, and a right to dispute and appeal to a person. Workers could opt out of algorithmic management. It was referred to committee on January 8, 2026 and got no further action before the 2026 session adjourned.
AN ACT relating to artificial intelligence and declaring an emergency.
Not law. As passed by the House 88-7 on February 23, 2026, HB 455 would have barred anyone from providing or advertising therapy or psychotherapy in Kentucky, including through internet-based AI, unless a licensed professional performs it. Licensed therapists could have used AI only for administrative and supplementary support such as scheduling, billing and notes, with written notice and consent before using AI on recorded sessions, and AI could not make therapeutic decisions or treatment plans without their approval. Fines up to $10,000 per violation. It reached the Senate but got no further action before the 2026 regular session ended.
Creates a consumer bill of rights regarding artificial intelligence
Not law. HB 734 would have created a Louisiana AI bill of rights. Companion chatbot platforms would have needed a parent's consent for minors' accounts, with parental controls and self-harm alerts, AI disclosures and hourly break reminders for minors, and safeguards against material harmful to minors. Any bot would have had to show an hourly pop-up saying the user is not talking to a human. It also would have barred AI companies from selling personal data unless deidentified, banned commercial use of AI-generated likenesses without consent, and limited state AI contracts with entities tied to foreign countries of concern. It was withdrawn on March 30, 2026.
AN ACT to amend Tennessee Code Annotated, Title 4, Chapter 3, Part 31, relative to the artificial intelligence advisory council.
Not law. SB 1362 would have updated Tennessee's AI Advisory Council law: a new definition of artificial intelligence; a council of 24 to 27 members, including AI-experienced appointees and two or three nonvoting experts; data privacy and security best practices for state agencies in the council's action plan; and a yearly inventory of federal and state AI laws to find overlaps, conflicts and gaps that may hinder AI innovation. Filed in February 2025, it was sent to a Senate Commerce and Labor subcommittee in February 2026 and died when the 114th General Assembly adjourned.
Updates certain crimes to include nonconsensual pornographic deepfake threats and disclosure.
New Jersey's S3551 would amend the criminal invasion of privacy law to cover deepfake images. Recording an actual or deepfake image of a person's exposed intimate parts or sexual activity without consent would be a third-degree crime, and disclosing a deepfake of another person created in that way, knowing or with reckless disregard of lacking a license or privilege, would be a fourth-degree crime. Threatening to disclose such an image would count as criminal coercion. Introduced September 12, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Stop Non-Consensual Distribution of Intimate Deep Fake Media Act
West Virginia's HB 5548 (2026 regular session) would have created the Stop Non-Consensual Distribution of Intimate Deep Fake Media Act (new W. Va. Code art. 61-3F), making it a crime to intentionally or knowingly distribute a deep fake of a person's face showing sexual conduct the person did not engage in, with intent to coerce, harass, intimidate or damage reputation, and without consent. Maximum prison terms would range from 90 days to 5 years. It was referred to House Judiciary on February 16, 2026 and died when the session ended March 14, 2026.
Relating to digital replication rights in the voice and visual likeness of individuals; providing private causes of action; authorizing a fee.
Texas SB 1960 (2025), as engrossed, would have added Business & Commerce Code Chapter 651 giving individuals a licensable property right in computer-generated digital replicas of their voice or visual likeness. Producing or publishing a replica without written consent would have been prohibited, subject to exceptions such as news, commentary, satire and parody; online services would have had to designate a takedown agent, and rights holders could sue for injunctions and damages. It passed the Senate but died in a House committee at sine die adjournment June 2, 2025.
Artificial intelligence business; attorney general
Arizona's HB 4098 (2026) would have required an 'artificial intelligence business' using a frontier model from a large developer to assess each high-risk AI system for bias, child-safety, privacy and catastrophic risks, file a transparency report with the attorney general and post it publicly, and run quarterly audits. The attorney general could impose civil penalties of up to $50,000 per violation. It was held in House committees with no action and died when the 2026 session ended June 13, 2026.
Relates to the right of publicity; amends the definitions of "deceased performer", "deceased personality" and "digital replica" in relation to the right of publicity; relates to the use of a deceased performer's digital replica without authorization by the applicable right holder.
New York's S 8391 amends the post-mortem right of publicity (Civil Rights Law § 50-f). Using a deceased performer's digital replica in an audiovisual work, sound recording or live musical performance without the rights holders' prior consent creates liability if the user knew the use was of a digital replica and unauthorized. This replaces the old rule, which covered only scripted fictional-character uses and live musical performances and required a use likely to deceive the public, a test a conspicuous disclaimer defeated. Damages: the greater of $2,000 or compensatory damages, plus profits; punitive damages possible. Signed December 11, 2025 (Chapter 616); effective immediately.
A bill for an act relating to the requirements for chatbot deployers, including required protocols, limitations on data collection, and requirements for minors to interact with artificial intelligence companions and therapeutic chatbots, and providing civil penalties, punitive penalties, and civil…
Not law. HF 2204 would have required anyone offering a chatbot to the public in Iowa to keep protocols to detect, respond to and reduce harm to users, putting user safety first, and to collect only the data it needs. Deployers would have had to use age verification to keep minors from AI companions (chatbots that simulate a romantic or emotional bond), get permission before offering chatbots that impersonate real people, and meet strict conditions, including a licensed professional's recommendation and clinical trial evidence, before offering therapeutic chatbots to minors. It was referred to committee on January 29, 2026 and died when the 2026 session adjourned.
Requesting the Hawaii Tourism Authority to convene a global artificial intelligence summit in 2020
Not adopted. House Concurrent Resolution 171 (2019) asked the Hawaii Tourism Authority to convene a global artificial intelligence summit in 2020, bringing experts from around the world to discuss AI innovations and develop practical applications, citing Hawaii's central Pacific location. It noted AI's benefits as well as risks such as autonomous weapons, social manipulation and invasion of privacy. It was referred to House committees on March 14, 2019 and never adopted.
MS Artifical Intelligence and Stem Eduaction Act; create.
Mississippi's HB 1605 (2026), the Mississippi Artificial Intelligence and STEM Education Innovation Act, would authorize the Department of Education to set up a voluntary pilot program letting local education agencies use AI-assisted learning tools in STEM subjects in grades 6 through 12. Tools would have to comply with FERPA and state student data privacy laws, student data could not be sold or shared, and AI tools could not be used for teacher evaluation or employment decisions. It died in committee on February 3, 2026.
Election crime; create for dissemination of a deep fake within 90 days of an election.
Mississippi's HB 1689 (2024), as passed the House, would make it a crime to disseminate a deep fake that the person knows or has reason to know is a deep fake, within 90 days of an election, without the depicted individual's consent and with intent to injure a candidate, influence the result or deter anyone from voting. Penalties run up to one year and $5,000, or up to five years and $10,000 in aggravated cases. It passed the House on March 12, 2024 and died on the Senate calendar on April 10, 2024.
Mental health professionals: artificial intelligence.
Vetoed. SB 903, the Wellness and Oversight for Psychological Resources Act, would have limited AI in California psychotherapy to administrative and supplementary support. Recording or transcribing sessions, or AI triage, would have needed the patient's informed consent, and AI could not make therapeutic decisions, produce diagnoses or treatment plans, detect emotions or screen patients without a licensed professional's review. Companion chatbots could not be marketed as therapy. Governor Newsom vetoed it on September 30, 2026, calling it overly broad and saying it would restrict useful clinical tools and reach general-purpose AI.
Data Privacy Amendments
Utah's HB 450 reorganizes oversight of how state and local government entities handle personal data under the Government Data Privacy Act. It restructures the Utah Privacy Commission to include state agency, city, county and public education members, moves its support to the Utah Office of Data Privacy, makes a data privacy ombudsperson part of that office, sets a complaint process (complaints go first to the entity, then to mediation), and moves the state privacy auditor's duties to the state auditor. The act already treats facial recognition, automated decision-making and profiling as high-risk processing. It governs government, not businesses. Effective May 6, 2026.
Enacts the New York artificial intelligence bill of rights to provide residents of the state with rights and protections to ensure that any system making decisions without human intervention impacting their lives do so lawfully, properly, and with meaningful oversight.
New York's A 3265 would enact the New York artificial intelligence bill of rights as new Article 5 of the State Technology Law, giving residents rights against persons developing automated systems that have the potential to meaningfully impact their civil rights, equal opportunities or access to critical resources: safe and effective systems, protection from algorithmic discrimination, data privacy, notice and explanation, and human alternatives. The Attorney General could seek penalties of at least three times the damages. Referred to the Science and Technology Committee January 27, 2025 and again January 7, 2026; it has not passed either house.
Use of likeness: digital replica.
California's AB 1836 amends Civil Code § 3344.1 (post-mortem publicity rights). Anyone who produces, distributes or makes available a digital replica of a deceased personality's voice or likeness in an expressive audiovisual work or sound recording without prior consent from the rights holders is liable for the greater of $10,000 or the rights holder's actual damages. The existing exemption for films, TV, music and other expressive works does not cover such replicas. News, comment, satire, parody, fleeting or incidental uses and documentary or biographical portrayals not meant to pass as authentic recordings are exempt. Signed September 17, 2024 (Chapter 258); effective January 1, 2025.
An Act To Amend Titles 10 And 11 Of The Delaware Code Relating To Deep Fakes.
Delaware's HB 353 (84 Del. Laws c. 479), the Amelia Kramer Act, extends Delaware's intimate-image laws to deep fakes, meaning realistic but false sexual images made with generative adversarial network techniques or other digital technology. An identifiable person harmed by the intentional disclosure or threatened disclosure of a deep fake without consent may sue for damages or statutory damages up to $10,000, the defendant's gains, punitive damages, fees and an injunction. The violation-of-privacy crime now covers deep fakes without proof of an expectation of privacy, and an adult creating a depiction of a minor is an aggravating factor. Signed and effective October 9, 2024.
Information Practices Act of 1977.
California's AB 1337 (Ward) is mainly a government privacy bill. As amended in the Senate June 1, 2026, it would recast the Information Practices Act of 1977, beginning January 1, 2028, to cover local agencies as well as state agencies and to expand the definition of personal information. The AI-related part is narrow: personal information could exist in formats that include artificial intelligence systems capable of outputting it. Passed the Assembly 64-0 June 2, 2025; final Senate hearing canceled June 25, 2026; dead.
SCH CD-ASL IMPLEMENTATION
Illinois' Public Act 104-0399 (SB 1920) amends the School Code. New Section 2-3.118a requires the State Board of Education, with stakeholders, to develop and publish statewide guidance on AI in K-12 education by July 1, 2026, covering AI concepts, uses that preserve human relationships, bias, privacy, transparency, student-data privacy laws, AI literacy and special populations; the State Superintendent may convene an AI council. It also adds AI-created false depictions, including sexually explicit images and videos, to the recommended internet-safety topic on cyber-bullying. Its sign-language and educator-test parts do not involve AI. Approved August 15, 2025; effective January 1, 2026.
SCH CD-CYBER-BULLYING
Illinois' Public Act 104-0338 (HB 3851) amends the School Code's bullying prevention section (Section 27-23.7). Beginning with the 2026-2027 school year, "cyber-bullying" also includes posting or distributing an unauthorized digital replica, meaning a digital replica of an individual used without the depicted individual's consent, by electronic means if it causes any of the harms in the bullying definition. "Digital replica" has its meaning in the Digital Voice and Likeness Protection Act, which covers replicas made with AI or other technology. The act also lists posting or distributing sexually explicit images as a form of bullying. Approved August 15, 2025; effective July 1, 2026.
THERAPY RESOURCES OVERSIGHT
Illinois' Public Act 104-0054 (HB 1806) creates the Wellness and Oversight for Psychological Resources Act. No one may provide, advertise or offer therapy or psychotherapy services to the public in Illinois, including through Internet-based AI, unless a licensed professional conducts them. Licensed professionals may use AI only for administrative and supplementary support, need written notice and consent for supplementary-support AI on recorded or transcribed sessions, and may not let AI make independent therapeutic decisions, communicate therapeutically with clients or detect emotions or mental states. Civil penalties up to $10,000 per violation. Approved and effective August 1, 2025.
VIDEO INTERVIEW ACT
Illinois' Public Act 101-0260 (HB 2557) creates the Artificial Intelligence Video Interview Act. Employers that ask applicants to record video interviews and use AI analysis of them for Illinois-based positions must, before the interview, tell each applicant AI may be used to analyze it, explain how the AI works and what general types of characteristics it uses, and get the applicant's consent. Employers may not use AI to evaluate applicants who have not consented, may share videos only with those needed to evaluate the applicant, and must delete videos within 30 days of an applicant's request. Approved August 9, 2019; effective January 1, 2020.
Relates to privacy rights involving digitization; provides that such right of privacy and action for injunction and damages shall include a portrait, picture, likeness or voice created or altered by digitization.
New York's A 3924 (the "right to your own image act") would amend Civil Rights Law §§ 50 and 51 so that using a person's name, portrait, picture, likeness or voice for advertising or trade without written consent covers one created or altered by digitization: software, machine learning, artificial intelligence or other technological means. Both the misdemeanor and the civil action for an injunction and damages would apply. Introduced January 30, 2025 and referred to the Judiciary Committee (again January 7, 2026); it has not passed either chamber.
Relating To Demographic Data.
Hawaii's House Bill 2499 (2026) would have had the Office of Enterprise Technology Services set statewide standards for how state and county agencies collect and report race and ethnicity data. If that data informs an automated or AI system, the Office would have had to test for bias before deployment, monitor fairness, publish plain-language descriptions and ensure privacy laws apply. ECD deferred it February 6, 2026 and it was not enacted. It would have taken effect July 1, 2026.
Distribution Of Sensitive And Deepfake Images
New Mexico's HB 22 (2026) would have expanded the unauthorized-distribution-of-sensitive-images law (NMSA 30-37A-1) to cover 'sensitive deepfake images', meaning images created, altered or digitally manipulated to show a person's uncovered genitals, a woman's breast below the top of the areola, or an intimate act. It would also have made malicious threats to distribute such images a crime and created civil claims for libel, slander, invasion of privacy and emotional distress. It was referred to the House Pre-filed Committee (HPREF) on January 21, 2026, was not printed, and was postponed indefinitely (undated); the bill died.
Relating To The Hawaii Patients' Bill Of Rights And Responsibilities Act.
Hawaii's SB 2167 (2026) would have amended HRS chapter 432E, the Patients' Bill of Rights, to set prior authorization deadlines (one business day urgent, three non-urgent) and require that a denial initiated by an automated decision system be reviewed and co-signed by a board-certified specialist, with written notice to enrollees and providers whenever such a system is used. It was referred to HHS and CPN January 26, 2026 and died.
Chatbot regulations; personal data; requirements
Arizona's HB 2737 (2026) would have limited how a chatbot provider may use personal data and chat logs: no processing personal data to inform output without a user's express request and affirmative consent, no using chat logs for advertising, no training on chat logs of minors without parental consent or of adults without consent, no selling chat logs, and no retention beyond ten years unless required. It was held in House committees with no action and died when the 2026 session ended June 13, 2026.
Reducing emissions from artificial intelligence
Massachusetts' H 495 would add a new Chapter 93M to the General Laws. Search-engine operators with more than $10 million in revenue could not return AI-generated results unless the user gave affirmative consent. The state would study AI's environmental impacts, and companies that develop or power AI systems would have to report their annual environmental impacts or face penalties up to $20,000 a year. Referred to the Joint Committee on Economic Development and Emerging Technologies February 27, 2025; on March 5, 2026 it accompanied a study order (H 5178) and did not advance as its own bill.
CHAT Act (Children Harmed by AI Technology Act)
The CHAT Act would require anyone offering a companion AI chatbot in the U.S. to require user accounts, verify every user's age (freezing existing accounts until verified), and link minors' accounts to a verified parent account with parental consent. Parents would be told immediately of any conversation involving suicidal ideation, and minors blocked from chatbots that engage in sexually explicit talk. Chatbots would show a pop-up at the start of each conversation and at least every 60 minutes saying the user is not talking to a human. The FTC and state attorneys general would enforce it. Pending in the Senate Commerce Committee since September 4, 2025.
General Regulatory Provisions -- Generative Artificial Intelligence Models
Rhode Island H 6286 (2023), as introduced on April 19, 2023, would add chapter 6-59 setting operating standards for companies running large-scale generative AI models (at least one billion parameters). Companies would have to watermark or authenticate text output, obtain informed consent before using personal data, run risk assessments and register with the attorney general within 90 days. The text sets no penalties and takes effect September 1, 2023.
An Act to Enact the Maine Consumer Data Privacy Act
Not law. Maine's LD 1088, the Maine Consumer Data Privacy Act, as introduced would have applied to controllers handling data of 100,000 or more consumers (50,000 from 2028), or 25,000 with more than 25% of gross revenue from data sales. Consumers could have accessed, corrected, deleted and ported data and opted out of targeted advertising, sales and profiling in furtherance of solely automated decisions with legal or similarly significant effects. The Attorney General would have enforced it exclusively, with no private right of action. The Judiciary Committee split three ways on June 13, 2025, and Report A, Ought Not To Pass, was accepted June 25, 2025.
Relating to the unlawful dissemination of intimate images.
Oregon's HB 2299 amends the crime of unlawful dissemination of an intimate image (ORS 163.472) so that "image" includes a digitally created, manipulated or altered depiction that is reasonably realistic, however stored. The crime applies when a person, intending to harass, humiliate or injure another, knowingly causes an image of that person's intimate parts or sexual conduct to be disclosed, knowing or having reason to know the person does not consent, and the person is harmed. It stays a Class A misdemeanor, or a Class C felony with a prior conviction. Signed May 22, 2025 (Chapter 116, Oregon Laws 2025); effective January 1, 2026.
Mississippians' Right to Name, Likeness and Voice Act; enact.
Mississippi's HB 1504 (2026), the Mississippians' Right to Name, Likeness and Voice Act, would give every individual, living or dead, a property right in their own name, likeness and voice, covering AI and other digital replicas. A person who, without consent, distributes a personalized cloning service or publishes a digital voice replica or digital depiction knowing it was unauthorized would be liable for damages. It died in committee on February 3, 2026.
An Act to Enact the Maine Online Data Privacy Act
Not law. Maine's LD 1822, the Maine Online Data Privacy Act, as introduced would have applied to controllers handling data of 35,000 or more consumers (or 10,000 with over 20% of gross revenue from data sales). Consumers could have accessed, corrected and deleted data and opted out of targeted advertising, sales and profiling in furtherance of solely automated decisions with legal or similarly significant effects. It would have banned selling sensitive data and required data protection assessments, including for risky profiling. Committee amendment C-A and later floor amendments were adopted. The Attorney General would have enforced it exclusively. It died between houses April 13, 2026.
DIGITAL FORGERIES ACT
Illinois's HB 4763 (103rd General Assembly) would have created the Digital Forgeries Act. A person depicted in AI-made audio or visual material (a "digital forgery") would have a cause of action against anyone who, without consent, knowingly distributes it, creates it with intent to distribute, or solicits its creation, to harass, extort, threaten or harm, with reckless disregard of harm, or to incite violence or interfere with an official proceeding. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
PROTECTS VOICE & IMAGES
Illinois's SB 3248 (103rd General Assembly) would have created the No AI FRAUD Act, giving every individual a property right in their own likeness and voice, with a private cause of action against anyone who, without consent, distributes a personalized cloning service or publishes an unauthorized digital voice replica or depiction. Damages would include $50,000 or $5,000 per violation (depending on the conduct) or actual damages plus attributable profits. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
Relating to digital replication rights in the voice and visual likeness of individuals; providing private causes of action; authorizing a fee.
Texas HB 3950 (2025), as introduced, would have created a digital replication right in an individual's voice and visual likeness, and barred producing a digital replica or making one available to the public without the right holder's written consent. The right would last the individual's life plus 10 years, extendable. Eligible plaintiffs could sue over knowing violations, with statutory damages of $5,000 or $25,000 per work depending on the violator, and online service providers would have had notice-and-removal duties. It died when the regular session adjourned June 2, 2025.
BIOMETRIC DATA-COMMERCIAL USE
Illinois's HB 2411 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).
BIOMETRIC DATA-COMMERCIAL USE
Illinois's HB 4330 (100th General Assembly) would have amended Section 15 of the Biometric Information Privacy Act to bar a private entity from requiring a person or customer to provide a biometric identifier or biometric information as a condition of goods or services, except as needed for employer background checks or employee security protocols. It would not have applied to companies providing medical services, law enforcement agencies or governmental entities. It was not passed before the 100th General Assembly ended (Session Sine Die, January 8, 2019).
Department of Technology: Office of Artificial Intelligence: state agency public interface: use of AI.
California's SB 313 (2023-24 Regular Session), the California AI-ware Act, would create an Office of Artificial Intelligence in the Department of Technology to guide state agencies' design, use and deployment of automated systems consistent with privacy and civil liberties law and to minimize bias. A state agency using generative AI to directly communicate with a person would have to give notice and instructions for reaching a human. Held in Senate Appropriations May 18, 2023; not passed.
California Artificial Intelligence Research Hub.
California's SB 893 (2023-24 Regular Session), the California Artificial Intelligence Research Hub Act, would require the Government Operations Agency, the Governor's Office of Business and Economic Development, the California Privacy Protection Agency and the Department of Technology to collaborate to establish a research hub in the Government Operations Agency. The hub would facilitate collaboration among government, academia and the private sector on AI research. Passed the Senate 37-0; held in Assembly Appropriations August 15, 2024; not passed.
Social media platforms: artificial intelligence models.
California's AB 2169 (2025-26 Regular Session), the Digital Choice Act, would require a social media company, or a person that deploys an AI model (a deployer), to give a consumer a copy of their personal information, contextual data and social graph within five business days in a portable format where technically feasible. It would also require interoperability interfaces. Held under submission in Assembly Appropriations May 14, 2026; not passed.
Agentic artificial intelligence.
California's SB 1106 (2025-26 Regular Session), titled Agentic artificial intelligence, would define 'agentic artificial intelligence' in Civil Code section 3110 and amend Government Code sections 11546.45.5, 11549.64 and 11549.65. The Office of Emergency Services' AI risk-analysis recommendations and the Department of Technology's inventory of high-risk automated decision systems would have to cover agentic AI. Passed the Senate 39-0; held in Assembly Appropriations August 13, 2026; not passed.
Mental health service providers; use of artificial intelligence system, civil penalty.
Virginia's HB 668 (2026 Regular Session) would have let mental health service providers use AI for administrative and supplementary support but barred using AI to provide therapy or counseling without a provider. As introduced, violations carried a civil penalty up to $10,000. It failed: left in House Communications, Technology and Innovation Committee on February 18, 2026.
Artificial Intelligence Training Data Transparency Act; transparency and disclosure requirements.
Virginia's HB 2250 (2025 Regular Session) would have amended the Consumer Data Protection Act and added an Artificial Intelligence Training Data Transparency Act (new Title 59.1 chapter, §§ 59.1-607 through 59.1-611) with requirements for generative AI developers. It would also have allowed third-party opt-out of data processing and required consent to process adolescents' data. Left in committee on February 4, 2025; it failed.
Emerging Technologies, Cybersecurity, and Data Privacy, Division of; established.
Virginia's HB 2268 (2025 Regular Session) would have created a Division of Emerging Technologies, Cybersecurity, and Data Privacy in the Department of Law to oversee and enforce laws on cybersecurity, data privacy and the use of AI, with an annual report to the Joint Commission on Technology and Science by November 1. Left in Appropriations on February 4, 2025; it failed.
AN ACT to amend Tennessee Code Annotated, Title 4, Chapter 3, Part 31, relative to the artificial intelligence advisory council.
Tennessee's HB 1209 (114th General Assembly) would have amended the law creating the state's artificial intelligence advisory council: membership would change from 24 to at least 24 but not more than 27, including two or three nonvoting expert members, and at least two of the governor's appointees would need AI research or development experience. It would also redefine "artificial intelligence" and add data privacy and security best practices to the council's action plan. Companion: SB 1362. Not passed before the session ended in April 2026; last action February 12, 2025.
AN ACT to amend Tennessee Code Annotated, Title 29; Title 45; Title 47 and Title 66, relative to algorithmic pricing.
Tennessee's SB1807 (114th General Assembly) would have barred an entity from setting the price of a specific good or service for a consumer in Tennessee using personalized algorithmic pricing, meaning dynamic pricing set by an algorithm that uses personal data. A violation would have been an unfair or deceptive act under the Tennessee Consumer Protection Act of 1977. Insurers, certain financial institutions and some subscription prices were exempt. Companion: HB 1468. Not passed before the session ended in April 2026; last action: Assigned to General Subcommittee of Senate Commerce and Labor Committee (April 7, 2026).
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's HB2608 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: SB 2215. Not passed before the session ended in April 2026; last action: Taken off notice for cal in s/c Criminal Justice Subcommittee of Judiciary Committee (March 25, 2026).
Creates regulations of artificially generated online content using artificial intelligence
Missouri's SB 1324 (Missouri Artificial Intelligence Transparency and Accountability Act) would require anyone creating AI-generated content for public consumption to label it "AI-generated", add a disclaimer and obtain consent for content depicting a real person (except parody or satire), and require developers and deployers to keep usage logs for seven years. The attorney general would enforce it with civil penalties. The Senate General Laws Committee voted do pass on March 25, 2026, but the bill died when the 2026 regular session ended in May 2026 without being truly agreed to and finally passed.
Consumer protection; production of digital replicas of voice or visual likenesses, prohibited for commercial use unless licensed, procedures established, private right of action authorized
Alabama's HB 327, as introduced, would bar a person from intentionally publishing or making available to the public a digital replica of an individual's voice or visual likeness without the right holder's written consent, with listed exceptions. It would make the right licensable and descendible and authorize private actions for violating a digital replica license or producing a replica without consent. The House Judiciary committee reported a first substitute on February 18, 2026 (its text was not reviewed), and the bill died when the 2026 regular session ended without final passage.
An Act regulating the use of artificial intelligence (AI) in providing mental health services
Massachusetts' H 1974 (193rd General Court, 2023-2024) would have required a licensed mental health professional who wants to provide mental health services through AI to first seek approval from the relevant licensing board, keep the AI system continuously monitored, tell patients in advance, get their informed consent and offer them treatment from a licensed professional. A violation would bring licensing-board discipline. The bill accompanied a study order on June 6, 2024 and died when the session ended.
Relative to civil actions regarding the prohibited use of synthetic media.
New Hampshire's HB 1710-FN would have created a civil action over misleading synthetic media (media made or modified with AI algorithms): distributing it of an identifiable person without consent, without a conspicuous notice, and with intent to mislead. It would also have required political communications that include synthetic media to carry an AI-assistance disclosure. The House found it Inexpedient to Legislate February 1, 2024; it is dead.
Protecting kids from deepfakes and exploitative images.
Wyoming's AI deepfake and child-protection law (Chapter 91, Session Laws of 2026, effective July 1, 2026). It makes it a felony to knowingly distribute realistic AI-generated or digitally altered intimate images of an identifiable person without consent when it causes or is meant to cause harm, or to threaten to do so for gain (up to 10 years; 12 for a repeat offense). Using AI to create child sexual abuse material, or knowingly possessing AI-generated material, is sexual exploitation of a child. Building or distributing AI systems designed to produce such material or to promote self-harm is a felony, and using AI is no defense to any crime.
An Act amending Title 18 (Crimes and Offenses) of the Pennsylvania Consolidated Statutes, in forgery and fraudulent practices, providing for the offense of digital forgery.
Pennsylvania's Act 35 of 2025 adds 18 Pa.C.S. 4101.1, digital forgery. A person commits it by generating or creating and distributing a "forged digital likeness" as genuine, knowing or having reason to know it is forged, with intent to defraud or injure anyone. A forged digital likeness is a computer-generated image or voice recording of a real, identifiable person that closely resembles a genuine one, materially misrepresents them, is likely to deceive, and is made and shared without consent. It took effect 60 days after approval (July 7, 2025).
An Act to prevent abuse and exploitation
Massachusetts Chapter 118 of the Acts of 2024 criminalizes non-consensual distribution of intimate images, including fabricated ones. Under G.L. c.265 s.43A(b), knowingly distributing visual material, including material produced by "digitization" (creating or altering images, including through computer-generated images, so they falsely appear authentic), that shows an identifiable person nude, partially nude or in sexual conduct, with intent to harm or reckless disregard of harm or lack of consent, is criminal harassment. The act also creates an Attorney General sexting diversion program.
Representations depicting nudity and providing a penalty.
2025 Wisconsin Act 34 adds deepfake intimate images to the state's representations-depicting-nudity law (s. 942.09). A "synthetic intimate representation" is a representation generated using technological means that uses an identifiable person's face, likeness or other distinguishing characteristics to depict them intimately and is realistic enough that a reasonable person would believe it shows that person. Posting, publishing, distributing or exhibiting one with intent to coerce, harass or intimidate is a crime under s. 942.09, and making a reproduction of a private representation without consent is also covered. It took effect the day after publication (Oct. 3, 2025).
AN ACT RELATING TO ELECTIONS; AMENDING AND ENACTING SECTIONS OF THE CAMPAIGN REPORTING ACT BY ADDING DISCLAIMER REQUIREMENTS FOR ADVERTISEMENTS CONTAINING MATERIALLY DECEPTIVE MEDIA; CREATING THE CRIME OF DISTRIBUTING OR ENTERING INTO AN AGREEMENT WITH ANOTHER PERSON TO DISTRIBUTE MATERIALLY DECEPTIVE MEDIA; ADDING DEFINITIONS; PROVIDING PENALTIES.
New Mexico's HB 182 (Laws 2024, Chapter 57) amends the Campaign Reporting Act to address AI deepfakes. Campaign ads containing materially deceptive media (an image, video or audio produced in whole or in part with AI that shows someone saying or doing something they did not, published without consent) must carry the disclaimer "This ____ has been manipulated or generated by artificial intelligence." Knowingly distributing such media without the disclaimer within 90 days before an election to mislead voters is a crime: a misdemeanor, then a fourth degree felony. The act states no effective date.
An Act to revise a provision related to criminal invasions of privacy, prohibit the creation and distribution of digitally fabricated material of an identifiable individual, and provide penalties therefor.
South Dakota's 2026 SB 41 amends the invasion-of-privacy law (SDCL 22-21-4) to cover deepfake intimate images. Knowingly and intentionally creating, disclosing, distributing or selling, without the person's consent and with intent to gratify, harass or cause harm, digitally fabricated material showing an identifiable person nude or engaged in sexual conduct is a Class 5 felony. Digitally fabricated material is a visual depiction that appears authentic but is adapted, generated or modified to falsely depict a person's appearance, conduct or voice.
Ai Legislative Task Force
Alaska's HCR 3 (2025-26) is a concurrent resolution and does not change the law. As the House Community and Regional Affairs committee substitute, it would have created a seven-member Joint Legislative Task Force on Artificial Intelligence (three senators, four representatives) to study AI in state government, the economy, ethics and privacy, and the workforce, and report by January 31, 2026. The committee reported it April 11, 2025; it went to Finance and died May 20, 2026.
2026 Appropriations Act.
North Carolina's 2026 Appropriations Act (S.L. 2026-41) includes Section 7.39, Safe and Responsible AI in Schools. The State Board must adopt K-12 AI literacy standards (responsible use, limits of AI, verifying outputs, privacy, safety with chatbots). DPI must write a model AI policy by Dec. 31, 2026, and local boards, charter, lab and other public schools must adopt AI use policies by June 30, 2027. DPI must keep an evaluation framework and public lists of AI tools, and all teachers must complete AI training by June 30, 2028. The act took effect July 1, 2026.
Memorializes the United States Congress to take action relative to the use of artificial intelligence in health care
Louisiana's HR 313 is a House resolution, adopted 94-0 on June 10, 2025, that memorializes the United States Congress to act immediately to keep physicians in full control of medical decisions with AI as a support tool rather than a replacement, set nationwide standards for AI in health care (patient safety, data privacy, the doctor-patient relationship), monitor AI's effects on care and outcomes, promote transparency in AI algorithms, and develop ethical guidelines. Copies go to Congress's presiding officers and Louisiana's congressional delegation. As a resolution of one chamber, it does not change the law.
"New Jersey Kids Code Act"; adopts New Jersey Age-Appropriate Design Code and requires certain online service providers to implement certain measures concerning minors' use of online service.
New Jersey's A 4015 (P.L.2026, c.73), the New Jersey Age-Appropriate Design Code, covers online services that display user content and let account holders interact, are reasonably likely to be accessed by minors, and whose providers earn over $25 million a year or process data of 25,000+ consumers or households. For users they know are under 18, providers must set the highest privacy by default, limit notifications, keep their data out of algorithmic recommendations unless based on their settings or requests, and take reasonable steps against compulsive use. Enforced under the Consumer Fraud Act, with private suits. Approved August 11, 2026; effective September 1, 2027.
Relating To Deepfakes.
Hawaii's SB 1156 would have made it a misdemeanor to knowingly, and without the depicted person's consent, create or distribute a deepfake showing an individual nude or engaging in sexual conduct. The Senate committee on LBT deferred it February 7, 2025, it was carried over to the 2026 session with no further action, and it did not pass.
ALGORITHMIC PRICE TRANSPARENCY
Illinois's HB 4248, as the Senate amended it (Senate Floor Amendment 1), would create the Protection from Surveillance Pricing Act, banning surveillance pricing: customized prices for a consumer or group based on personal data. The House passed an earlier version 78-19 on May 22, 2026; the Senate passed it as amended 41-16 on May 31, 2026. The House has not concurred and re-referred it to the Rules Committee July 1, 2026, so it has not gone to the Governor.
Establishes Artificial Intelligence Ethics Board in DOLWD.
A 2478 would create a seven-member Artificial Intelligence Ethics Board in New Jersey's Department of Labor and Workforce Development to oversee the sale and use of AI technology, with a focus on bias prevention, privacy, transparency and accountability. Anyone selling or offering an AI product or service in the state would first need an independent AI impact assessment, done within the prior year and meeting the board's standards on privacy and job displacement. The board would also recommend protections for workers displaced by AI, such as a month's notice, retraining and severance. Pending in the Assembly Science, Innovation and Technology Committee.
Extends crime of identity theft to include fraudulent impersonation or false depiction by means of artificial intelligence or deepfake technology.
S 329 would expand New Jersey's identity theft crime to cover falsely depicting someone with a deepfake to gain a benefit or to injure or defraud them. A deepfake here is AI-generated or manipulated audio, video, speech or text that a reasonable person would believe shows the person, made without consent and likely to cause harm. Penalties would scale with the number of victims, from a fourth-degree crime (up to 18 months) for one victim to a second-degree crime (5 to 10 years) for five or more. Courts could order the deepfake destroyed and a public retraction at the defendant's expense. Pending in the Senate Judiciary Committee.
Higher educational institutions; JLARC to study artificial intelligence use policies.
House Joint Resolution 32 directs the Joint Legislative Audit and Review Commission (JLARC) to study AI use policies at Virginia's institutions of higher education. JLARC surveys policies adopted or under consideration and evaluates how they address academic integrity, data privacy, equity and access, transparency, and faculty autonomy; develops a model AI policy; and recommends tools, curricula and resources for a statewide clearinghouse. Agreed to by the House February 11 and the Senate March 3, 2026. A joint resolution needs no Governor's signature and does not change the law.
A bill for an act prohibiting personalized algorithmic pricing and surveillance pricing at certain food retail establishments, and providing civil penalties.
Iowa's SF 2278 (as introduced) would add Code chapter 554J for large food retail stores. Such a store using personalized algorithmic pricing based on a particular consumer's data would have to show "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." Stores could not use electronic shelf labels, collect data of minors under 17 or use it for targeted ads or personalized pricing, or use protected class data in pricing. Civil penalty up to $7,500 per violation. Introduced February 11, 2026; it died in committee when the 2026 session ended.
Enacts the NY privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
New York's A 4947 (the "New York privacy act") would add General Business Law Article 42-A. For solely automated decisions that materially contribute to denials of lending, housing, insurance, health care or similar services, controllers would have to disclose the automation, offer an appeal with meaningful human review and run annual impact assessments by an external, independent auditor or researcher. Consumers would also get opt-in consent, access, correction and deletion rights. AG penalties up to $15,000 per violation; private suits. Most sections would take effect two years after enactment. Referred to committee February 10, 2025 and January 7, 2026; not passed by either chamber.
Establishes the "protect our privacy (POP) act" to impose limitations on the use of drones for law enforcement purposes; prohibits the use of drones by law enforcement at concerts, protests, demonstrations, or other actions protected by the first amendment.
New York's A 972, the "protect our privacy (POP) act," would add Civil Rights Law § 52-e: law enforcement data from drones equipped with facial recognition software, or from facial recognition run on drone video or images, including private drones, could not be used in ongoing investigations or prosecutions and would have to be promptly deleted, retroactively. It would also generally bar police drone use except for search and rescue and post-disaster inspection, bar drones at protests and armed drones, and allow suits for the greater of $1,000 per violation or actual damages. Referred to Governmental Operations January 7, 2026; it has not passed either chamber.
Enacts the preventing algorithmic pricing discrimination act; requires the disclosure of algorithmically set prices.
New York's A 6765-A (the "Preventing Algorithmic Pricing Discrimination Act") would add General Business Law § 349-a, requiring anyone who knowingly advertises personalized algorithmic pricing based on an individual's consumer data to state "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA", and § 396 would bar using protected class data in setting prices. Attorney General penalties up to $1,000 per violation. Would take effect on the 60th day after it becomes law. On the Assembly floor calendar (Cal. 173, January 7, 2026); it has not passed either chamber.
Prohibits the creation and dissemination of synthetic media within sixty days of an election with intent to unduly influence the outcome of an election
New York's A 6491 would add Election Law § 17-172, making it a class E felony to create, with "intent to injure a candidate or unduly influence the outcome of an election," synthetic media (realistic AI-manipulated or artificial images, video or audio of a scenario that did not occur) and disseminate or publish it within sixty days of an election. Exemptions cover commentary, parody, news, consent of all persons depicted, and initial dissemination by platforms. Would take effect on the 30th day after it becomes law. Introduced March 5, 2025 and referred to the Election Law Committee (again January 7, 2026); it has not passed either chamber.
Clarifies the right of publicity including the definitions of who and what qualifies as a digital replica; provides guidance as to digital replicas that do not violate an individual or deceased individual's right to publicity; expands the statute of limitations for an action brought for violating…
New York's A 8611 would amend Civil Rights Law § 50-f to define "digital replica" as a computer-generated "highly realistic electronic representation" readily identifiable as a person's voice or likeness. Producing, distributing or making available a deceased personality's digital replica in an expressive audiovisual work or sound recording without consent would carry liability for the greater of $10,000 or actual damages, with news, commentary, documentary and similar exemptions. The post-mortem term would rise from forty to seventy years. Would take effect immediately. Referred to Judiciary May 22, 2025 (and January 7, 2026); it has not passed either chamber.
Requires the department of labor to study the long-term impact of artificial intelligence on the state workforce including but not limited to job performance, productivity, training, education requirements, privacy and security; prohibits any state entity from using artificial intelligence in any…
New York's A 4550-A would add Labor Law § 12-a requiring the Department of Labor, with the Department of Civil Service and the Office of Information Technology Services, to begin a study within six months of the effective date on the long-term impact of artificial intelligence on the state workforce, with a final report by December 31, 2034. Until that report, state entities could not use AI in a way that displaces workers or impairs collective bargaining agreements. Takes effect immediately and expires January 1, 2035. Referred to Ways and Means January 7, 2026; it has not passed either chamber.
California Consumer Privacy Act of 2018: artificial intelligence: training.
California's AB 2877 (2023-24 Regular Session) would amend the California Consumer Privacy Act to prohibit a developer, except if certain conditions are met, from using the personal information of a consumer under 16 to train an AI system or service unless the consumer or a parent or guardian affirmatively authorizes it, and then only after deidentifying and aggregating it. Passed the Assembly 73-0; held under submission in Senate Appropriations August 15, 2024; not passed.
Regulates the use of artificial intelligence in the provision of therapy or psychotherapy services by prohibiting the use of artificial intelligence to assist in providing supplementary support where the session is recorded or transcribed unless the patient is informed of the specific purpose of…
New York's A 9106, the "oversight of technology in mental health care act," would add Education Law § 6517. Only a licensed professional could provide or offer therapy to the public in New York, including through internet-based AI. Professionals could use AI only for administrative or supplementary support (with written notice and consent where sessions are recorded or transcribed), not for independent therapeutic decisions, direct therapeutic communication, unreviewed treatment plans or emotion detection. Civil penalty up to $50,000 per violation. Would take effect immediately. Referred to Higher Education September 26, 2025 (and January 7, 2026); it has not passed either chamber.
Relating to the creation of artificial sexual material harmful to minors.
Texas's HB 581 extends the state's age verification law (Civil Practice and Remedies Code Chapter 129B) to AI-generated sexual material harmful to minors in which a real person is recognizable. A commercial entity whose website has a publicly accessible tool for creating it, or that offers an app for creating it, must use reasonable age verification to confirm users are 18 or older, may not keep identifying information from the check, and must ensure anyone used as a source is an adult who consented to use of their face and body. Entities whose terms ban such material and that use technical tools to limit it are exempt. Signed June 20, 2025; effective September 1, 2025.
Relating to criminal and civil liability related to sexually explicit media and artificial intimate visual material; creating a criminal offense; increasing a criminal penalty.
Texas's SB 441 widens the Penal Code § 21.165 crime from deep fake videos to any deep fake media made or altered with AI or other technological means. Knowingly producing or distributing sexually explicit deep fake media of a person without signed written consent is a Class A misdemeanor, or a third-degree felony for a repeat offense or a depicted minor. Intentionally threatening to produce or distribute deep fake media to coerce, extort, harass or intimidate is a new offense. It adds civil liability for AI intimate images, including against nudification app owners, and requires websites and apps to honor removal requests within 72 hours. Signed June 20, 2025; effective September 1, 2025.
Enacts the "facial recognition technology study act" to study privacy concerns and potential regulatory approaches to the development of facial recognition technology.
New York's S 3699 would establish a seven-member task force to study the proper regulatory approach to facial recognition technology (technology capable of identifying or verifying a person from a digital image or video frame). It would examine privacy concerns, other jurisdictions' regulation, potential misuse and administrative regulation methods, and report its findings to the governor and Legislature within one year of the effective date. The Senate passed it 60-2 and sent it to the Assembly March 16, 2026.
Prohibits the use of electronic shelving labels, digital shelf display technology, and personalized algorithmic pricing in food retail establishments and drug retail establishments; provides injunctive relief, civil penalties, and a private right of action.
New York's S 8616-B, the Protecting Consumers and Jobs from Discriminatory Pricing Act, would add General Business Law § 349-a-1. Food and drug retail establishments could not use electronic shelving labels or digital shelf displays, could not engage in surveillance pricing (pricing set completely or in part by an algorithm that uses personal data), and could not use protected class data in pricing. The Attorney General could seek penalties up to $10,000 per violation. Passed the Senate May 13, 2026 and, as amended, June 4, 2026 (50-10); on June 5 the Assembly substituted it for A9396-B on its third-reading calendar. No Assembly vote is shown.
Relating to artificial intelligence mental health services.
Texas HB 1265 (2025), as introduced, would have barred anyone from providing AI mental health services in Texas unless the AI application is approved by the Health and Human Services Commission and a licensed mental health professional is available at all times. Clients would have to be told the service is AI-based and give informed consent. Violators would face disciplinary action under the applicable licensing statute. It died when the regular session adjourned June 2, 2025.
To protect biometric information
Massachusetts H 63 (2023-2024) would have added a new chapter 93M to the General Laws restricting how private entities collect and process biometric information, including face geometry, with consent, a written privacy policy and a ban on monetizing the data. It did not pass: on May 13, 2024 the committee folded it into new draft H4632 (the Massachusetts Data Privacy Act), which was sent to House Ways and Means and recorded 'No further action taken' on December 31, 2024, when the session ended.
Conversational Artificial Intelligence Service Operator Requirements
Colorado's HB 26-1263 regulates operators of conversational AI services: public AI systems that mainly simulate human conversation (customer-service, business and other listed uses excluded). From January 1, 2027, operators must tell users the service is AI (daily, every three hours or persistently, and when asked), run a suicide and self-harm protocol with crisis referrals, and not claim outputs come from or are endorsed by licensed health, legal or mental health professionals. For known minors they must also guard against sexual content and simulated romance, avoid unpredictable engagement rewards and offer privacy tools. Signed May 29, 2026 (Chapter 208); act effective August 12, 2026.
Consumer Protection - Online Products and Services - Data of Children (Maryland Kids Code)
Maryland's HB 603 (Kids Code) covers for-profit firms doing business in Maryland that have over $25M revenue, buy, receive, sell or share data of 50,000+ consumers, households or devices yearly, or get at least half their revenue from data sales. For online products reasonably likely to be accessed by under-18s they must do impact assessments (existing ones by April 1, 2026) and set high-privacy defaults. AI-related: no default profiling of children without safeguards and need or a compelling reason; assessments weigh algorithm harms. Fines up to $7,500 per child per violation. Signed May 9, 2024 (Chapter 461; same as SB 571); effective October 1, 2024. Not enjoined; NetChoice suit pending.
Relates to banning the use of biometric identifying technology in schools
New York's S 9643 would amend State Technology Law § 106-b so public and nonpublic elementary and secondary schools, including charter schools, are "prohibited from purchasing or utilizing biometric identifying technology for any purpose, including school security." Limited uses stay allowed: fingerprinting of prospective employees, fingerprint logins to digital devices, and identifying employees who consent in writing. Passed the Senate 38-22 on June 1, 2026 and was referred to the Assembly Education Committee; it has not passed the Assembly.
Prohibits transcripts being made from video conference meetings by artificial intelligence without conspicuous disclosure during such meeting that such meeting may be transcribed by artificial intelligence.
New York's S 8459 would add Civil Rights Law section 50-h ("Right to Privacy; Transcription"). No person could permit a video conference meeting to be transcribed by artificial intelligence unless the meeting includes a conspicuous disclosure during the meeting that every attendee may have their words transcribed by AI. The text defines no terms and sets no penalty, enforcer or private right of action. Referred to Rules July 16, 2025 and to Internet and Technology January 7, 2026; it has not passed either chamber.
Regulates the use of artificial intelligence in the provision of therapy or psychotherapy services by prohibiting the use of artificial intelligence to assist in providing supplementary support where the session is recorded or transcribed unless the patient is informed of the specific purpose of…
New York's S 8484 would add Education Law § 6517 on AI in therapy and psychotherapy. A licensed professional could use AI only for supplementary support in recorded or transcribed sessions after written notice and the patient's consent, and could not let AI make independent therapeutic decisions or interact directly in therapeutic communication. Civil penalties up to $50,000 per violation. Committed to Rules June 5, 2026; it has not passed either chamber.
Georgia Entertainment Artificial Intelligence Accountability and Performer Protection Act; enact
Georgia's HB 1603, the Georgia Entertainment Artificial Intelligence Accountability and Performer Protection Act, would add Article 38 to Title 10, Chapter 1. It would make an individual or production company liable in a civil action for publishing or distributing a digital replica of a performer without consent, or for distributing a product primarily designed to produce such replicas. Consent would need a written contract of no more than ten years while the performer is living. The bill reached House Second Readers on March 31, 2026 and died when the session ended.
Ai, Deepfakes, Cybersecurity, Data Xfers
Alaska's SB 2 (2025-26) would have required a disclosure statement on election-related communications that include a deepfake, set rules for state agency use of generative AI in consequential decisions (inventory, impact assessments, notice, consent, appeal, and bans on some uses), and addressed transfers of data about individuals between state agencies. It was heard and held in Senate State Affairs on April 29, 2025 and died May 20, 2026.
An act relating to consumer data privacy and online surveillance
Vermont's H.208 (2025-2026 biennium) would have enacted a consumer data privacy and online surveillance law applying to businesses processing data of at least 25,000 consumers, or 12,500 consumers with over 25 percent of revenue from selling data. Consumers could learn whether their data is used in an AI system and opt out of profiling for automated decisions; sensitive data including biometric and neural data would be limited. It would have taken effect July 1, 2026. It was referred to House Commerce on February 12, 2025 and died.
Establishing the Comprehensive Massachusetts Consumer Data Privacy Act
Massachusetts H80 would add G.L. Chapter 93M, the Massachusetts Consumer Privacy Act, giving consumers rights to access, correct, delete and port data and to opt out of targeted advertising, sales and profiling for solely automated decisions with legal or similarly significant effects. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.
Secretary of Government Operations: deepfakes.
California's SB 1216 added Government Code § 11547.5. It directed the Secretary of Government Operations to evaluate, upon appropriation by the Legislature, the impact and risks of deepfakes and digital content forgery for government, California businesses and residents, including privacy and effects on voters, and to develop a coordinated plan on standards and tools for digital content provenance. A report to the Legislature with the plan was due October 1, 2024. The section was repealed by its own terms on January 1, 2025, so it is no longer in effect. Signed September 30, 2022 (Chapter 885); effective January 1, 2023.
Children and Social Media
South Carolina's S 268, 'Children and Social Media', would add Chapter 80 to Title 39. Covered online services, which may include AI-based products, would owe minors a duty of care, face limits on data, notifications and profiling, and have to explain personalized recommendation systems and report on their algorithms. The Senate approved it 43-0 on second reading April 30, 2025 and gave it third reading May 1, 2025; it was then referred to the House Judiciary Committee.
Elections policy and finance bill (Laws 2024, chapter 112), including article 2, sections 63-64 and 76-78 amending the election deep fake crime (Minn. Stat. 609.771)
Minnesota's 2024 elections omnibus (Laws 2024, chapter 112) rewrites parts of the 2023 election deep fake crime, Minn. Stat. 609.771. Under article 2, section 76, disseminating a deep fake of a candidate without consent to injure the candidate or influence an election is a crime if done with knowledge or reckless disregard that it is a deep fake, within 90 days before a party nominating convention or after absentee voting begins; broadcasters required by federal law to air a candidate's ad are exempt. Sections 63-64 and 77 require a convicted candidate to forfeit the nomination or office and bar appointment to it, and section 78 revises who may seek injunctive relief.
Concerning fabricated intimate or sexually explicit images and depictions.
Washington's Chapter 88, Laws of 2024 (SHB 1999) covers digitally fabricated sexual images, including those made with artificial intelligence. It adds "fabricated depiction of an identifiable minor" to chapter 9.68A RCW, so the child sexual exploitation offenses reach images created or altered by digitization. It creates a new crime of disclosing a fabricated intimate image without consent (gross misdemeanor; class C felony for repeat offenses) and a civil cause of action under chapter 7.110 RCW with statutory damages up to $10,000, punitive damages, fees and injunctions. "Digitization" expressly includes creating or altering images with artificial intelligence.
An act to impose civil liability and prescribe criminal penalties for the nonconsensual creation or dissemination of deep fake sexual images; and to provide for remedies.
Michigan's Public Act 11 of 2025, the protection from intimate deep fakes act, covers deep fakes: realistic images, video or audio whose production depends substantially on technical means rather than impersonation. A person shown in a deep fake depicting their intimate parts or a sexual act may sue whoever created or disseminated it without consent, if the defendant knew or should have known it would cause harm or acted to harass, extort or threaten. Intentionally creating or disseminating such a deep fake is a misdemeanor, or a felony with aggravating factors. Platforms and general-purpose tool providers are exempt. Effective August 26, 2025.
An Act to amend Part 3 of Article 3 of Chapter 11 of Title 16 of the Official Code of Georgia Annotated, relating to invasion of privacy, so as to revise the prohibition on electronically transmitting or posting nude or sexually explicit photographs or videos for purposes of harassing the depicted person; to provide for an increased penalty for the electronic transmission or posting to a web page that is accessible to the general public; to provide for related matters; to repeal conflicting laws; and for other purposes.
Georgia's SB 78 toughens the law against sharing nude or sexually explicit images of an adult without consent, including falsely created videos or still images such as deepfakes. Under the revised O.C.G.A. 16-11-90, posting such an image to harass the person or cause them financial loss is a felony (1 to 5 years, up to $100,000) when it is sent to a website that advertises or promotes sexually explicit content. Sharing by other electronic means stays a high and aggravated misdemeanor for a first offense and becomes a felony for repeat offenses. The law keeps the exemption for platforms hosting content posted by others.
Removal of Altered Sexual Depictions Posted without Consent
Florida's CS/CS/HB 1161 (Chapter 2025-133), Brooke's Law, amends s. 836.13, F.S. Covered platforms (sites, services or apps that mainly host user content, or regularly make nonconsensual altered sexual depictions available) had to set up by December 31, 2025 a process for people to request removal of sexual deepfakes of them posted without consent. Within 48 hours of a valid request the platform must remove the content and make reasonable efforts to remove identical copies, and it must post plain-language notice of the process. Good-faith removals are immune; unreasonable noncompliance is a FDUTPA violation. Effective June 10, 2025.
candidates; digital impersonation; injunctive relief (now: digital impersonation; injunctive relief; requirements)
Arizona's HB 2394 (Laws 2024, Ch. 193) adds A.R.S. 16-1023. A candidate on a state ballot, or any Arizona resident, may sue a person who publishes a "digital impersonation" of them without consent: synthetic video, audio or image made with deep generative or AI methods to deceive viewers into thinking it is authentic. The main remedy is declaratory relief on an expedited schedule. Injunctive relief and damages are limited to sexual or nude content of private figures. Parody, satire and commentary are excluded, and interactive computer services are protected. The act carried an emergency clause, and the section applies 14 days after its effective date.
An Act relating to harassment by the dissemination, publishing, distribution, or posting of a visual depiction showing another person in a state of full or partial nudity or engaged in a sex act that has been altered to falsely depict another person, and making penalties applicable.
Iowa's 2024 Acts chapter 1065 (HF 2240) covers sexual deepfakes under the harassment law. Iowa Code 708.7(1)(a)(5) makes it harassment to disseminate, publish, distribute or post a visual depiction of another person in full or partial nudity or engaged in a sex act without that person's consent. "Another person" now includes an individual, recognizable by face, likeness or other distinguishing features, whose image is used to create, adapt or modify a visual depiction to depict them that way. The act does not name AI but reaches fabricated images of real people. The offense is first-degree harassment (an aggravated misdemeanor), and offenders 18 or older must register as sex offenders.
AN ACT concerning crimes, punishment and criminal procedure; modifying elements in the crimes of sexual exploitation of a child, unlawful transmission of a visual depiction of a child and breach of privacy; prohibiting certain acts related to visual depictions in which the person depicted is indistinguishable from a real child, morphed from a real child's image or generated without any actual child involvement; and related matters (L. 2025, ch. 120).
Kansas SB 186 (L. 2025, ch. 120) brings AI-made sexual images into the Kansas criminal code. Possessing an obscene "artificially generated visual depiction" of a child is now sexual exploitation of a child. Unlawful transmission of a visual depiction of a child covers images created or altered by artificial intelligence to depict an identifiable child, and breach of privacy covers sharing intimate images of an identifiable adult that were created or altered by AI, without consent and with intent to harass, threaten or intimidate. The act also has non-AI bond and warrant provisions.
AN ACT concerning crimes, punishment and criminal procedure; relating to release of persons prior to trial; authorizing electronic monitoring with victim notification; modifying the culpable mental state required to commit the crime of breach of privacy; modifying the elements of the crime of blackmail related to threatened dissemination of any image, video or other recording of another identifiable person who is nude or engaged in sexual activity; and related matters (L. 2026, ch. 114).
Kansas HB 2479 (L. 2026, ch. 114) is a criminal-law bill with an AI provision. Blackmail (K.S.A. 21-5428) now covers threatening to disseminate an image, video or other recording of an identifiable person who is nude or engaged in sexual activity, expressly including recordings created, altered or modified by artificial intelligence or any digital means, whether or not the person took part in the original. The breach-of-privacy offense keeps its AI-altered intimate image language. Other parts deal with pretrial electronic monitoring and are not about AI.
AN ACT to amend and reenact subsection 13 of section 12.1-27.1-01 and section 12.1-27.1-03.3 of the North Dakota Century Code, relating to sexually expressive images; and to provide a penalty.
North Dakota HB 1351 (2025) updates the law on sexually expressive images so it covers deepfakes. The definition in N.D.C.C. 12.1-27.1-01 now includes a "real, altered, or computer-generated" photograph or visual representation showing nudity or sexual conduct. Creating such an image surreptitiously, or distributing it to harm or humiliate or after notice that the subject does not consent, is a class A misdemeanor, and knowingly distributing an acquired image created without consent is a class B misdemeanor. A depicted person may sue for damages and attorney fees.
An act relating to the regulation of social media platforms and artificial intelligence systems
Vermont's H.365 (2025-2026 biennium) would have required operators of social media platforms and AI systems used by Vermont consumers to register annually with the Secretary of State ($100 fee) and meet product safety and privacy duties. AI providers would have had to use reasonable care against algorithmic discrimination, disclose AI interaction and get informed consent before collecting or sharing consumer data. The Attorney General would enforce. It was referred to House Commerce on February 26, 2025 and died when the biennium ended.
An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Consumer Contracts
Public Act 25-113 overhauls the Connecticut Data Privacy Act's rules on automated decision-making. From July 1, 2026, consumers can opt out of profiling used for any automated decision with legal or similarly significant effects (housing, insurance, health care, employment, financial services and more), question the result and learn why the decision was made, and for housing decisions correct inaccurate data. Controllers that profile for such decisions must complete impact assessments (for processing created on or after Aug. 1, 2026), and privacy notices must state whether personal data is collected, used or sold to train large language models.
An Act To Increase Privacy and Security by Regulating the Use of Facial Surveillance Systems by Departments, Public Employees and Public Officials
Maine's 2021 facial surveillance law (25 MRSA §6001) generally prohibits government departments, public employees and officials from obtaining, using or contracting for facial surveillance systems, defined as automated or semi-automated processes that identify people from facial characteristics. Limited exceptions allow searches for serious crimes with probable cause, missing or deceased persons and BMV fraud, but requests must go through the BMV or State Police, which log them. A facial match alone cannot establish probable cause, and illegally obtained data must be deleted and is inadmissible.
An Act Concerning Artificial Intelligence, Automated Decision-making And Personal Data Privacy.
Connecticut's Public Act 23-16 governs AI in state government. The Department of Administrative Services (for all state agencies) and the Judicial Department must inventory the AI systems in use by December 31, 2023 and yearly after, and post them. OPM and the Judicial Branch set policies by February 1, 2024 for buying, using and assessing AI; from then, agencies may not deploy an AI system without an impact assessment showing it will not cause unlawful discrimination or disparate impact. It formed a working group on AI best practices and an AI bill of rights, and from October 1, 2023 state contracts must require compliance with the data privacy act. Signed June 7, 2023.
Health care services: artificial intelligence.
California's AB 1979 sets rules for AI in clinical care. Health facilities such as hospitals, clinics, physician offices and group practices must take reasonable steps so licensed providers keep independent professional judgment whenever care is informed by a clinical decision support system, and may not use AI to independently perform licensed clinical work, or to direct unlicensed staff doing it. Businesses offering health care chatbots that consumers use to manage their health information or to diagnose, treat or manage a condition are treated as health care providers under the state's medical privacy law (CMIA). Signed September 30, 2026 (Chapter 854); effective January 1, 2027.
Ai, Deepfakes, Cybersecurity, Data Xfers
Alaska's SB 177 (2023-24), as the Senate State Affairs committee substitute CSSB 177(STA), would have required a disclosure statement on election-related communications that include a deepfake, set rules for state agency use of generative AI for consequential decisions, and addressed transfers of data about individuals between state agencies. Senate State Affairs reported it April 23-24, 2024 and it was referred to Judiciary; it died when the 33rd Legislature's session ended.
Crimes & offenses, prohibits a person from creating a private image without consent.
Alabama's HB 161 (Act 2024-96) amends Section 13A-6-240 to create the crime of knowingly creating, recording or altering an intimate image of an individual without consent where the person had a reasonable expectation of privacy. A private image now includes a recording that a reasonable person would believe actually depicts an identifiable individual, even if any portion is artificially generated or depicts someone else. Violations are a Class A misdemeanor, and a subsequent offense is a Class C felony. Internet service providers, search engines, cloud providers and technology developers are not liable solely because their service was used. Effective October 1, 2024.
Digitizations; create a criminal penalty for the wrongful dissemination of.
Mississippi's SB 2577 (Chapter 467, Laws of 2024) creates a crime of wrongful dissemination of digitizations: realistic images or audio altered or created with software, machine learning, AI or other computer-generated means (deepfakes) that a reasonable person would believe show real speech or conduct. Knowingly disseminating one within 90 days of an election, without consent and to injure a candidate, influence the result or deter voting, carries up to one year and $5,000, or up to five years and $10,000 if meant to incite violence or after a prior conviction. Officials, the depicted person, candidates and parties may seek injunctions. Effective July 1, 2024.
An act relating to miscellaneous judiciary procedures
Vermont's H.878 (Act 161 of 2024) is a judiciary omnibus. Its Sec. 45 amends 13 V.S.A. 2606, the crime of disclosing sexually explicit images without consent, so that a visual image includes a digital reproduction created or altered by digitization. Digitization means altering an image in a realistic manner using images of the person, images of other people or computer-generated images. Knowingly disclosing such an image of an identifiable person who is nude or engaged in sexual conduct, without consent and with intent to harm, harass, intimidate, threaten or coerce, is therefore a crime even when the image is a deepfake. The act took effect on passage; the Governor signed it June 6, 2024.
Provides for the Allen Toussaint Legacy Act.
Louisiana's SB 426 (Act 425 of 2022), the Allen Toussaint Legacy Act, gives each person a transferable property right in their identity, including name, voice, likeness and digital replica. A digital replica is a computer-generated reproduction of a performer's likeness or voice indistinguishable from the real one. Using a person's identity for commercial purposes without consent is a violation, and so is using a digital replica in a scripted audiovisual work or live dramatic performance to create the clear impression that the performer is actually performing a role. Remedies include the greater of $1,000 or actual damages, profits and injunctions. Effective August 1, 2022.
Criminalizes deepfakes involving minors and defines the rights to digital image and likeness.
Louisiana's SB 175 (Act 457 of 2023) adds R.S. 14:73.13, the crime of unlawful deepfakes. Creating or possessing material that uses deepfake technology to depict a minor engaging in sexual conduct is punishable by 5 to 20 years at hard labor (five without parole) or a fine up to $10,000, or both. Advertising, distributing, exhibiting, exchanging, promoting or selling sexually explicit deepfake material of a person without consent is punishable by 10 to 30 years or a $50,000 fine, or both, with at least 10 years served if a minor is depicted. Newsworthy, satirical and clearly disclosed works are excluded. Effective August 1, 2023.
DIGITAL FORGERIES ACT
The enacted version of HB 2123 amends the Civil Remedies for Nonconsensual Dissemination of Private Sexual Images Act (740 ILCS 190). "Sexual image" now covers images that falsely appear to show a person's intimate parts or sexual activity, and a depicted person can sue anyone who disseminates, or threatens to disseminate, an intentionally digitally altered sexual image of them. Liability also reaches reckless disregard of whether the person consented. Disclosing that an image was digitally altered is not a defense. Effective January 1, 2024.
Establishing an internet bill of rights
Massachusetts H1754 would add G.L. Chapter 93M, an 'Internet Bill of Rights' comprehensive data protection law, including a right not to be subject to decisions based solely on automated processing, including profiling, with legal or similarly significant effects. It did not advance as its own bill: on March 26, 2026 it accompanied study order H5281 (under House Rule 27).
Establishes the right of publicity and provides for a private right of action for unlawful dissemination or publication of a sexually explicit depiction of an individual
Chapter 304 of 2020 adds Civil Rights Law 50-f, a post-mortem right of publicity. Using a deceased performer's digital replica (a realistic computer-generated performance) in a scripted audiovisual work or live musical performance without the rights holder's consent creates liability of at least $2,000, unless a conspicuous disclaimer says the use was not authorized. It also adds section 52-c, a civil action for a person depicted through digitization (realistic computer-generated or altered nude images or sexual conduct) against anyone who disseminates the material without consent. Effective on the 180th day after it became law.
Provides for the registration and duties of model management companies; provides complaint procedures and penalties for violations
The Fashion Workers Act (Labor Law Article 36) includes protections against unauthorized digital replicas, defined as significant computer-generated or AI-enhanced representations of a model's face, body or voice. Model management companies and clients must get clear written consent, separate from the representation agreement, stating scope, purpose, pay and duration before creating or using a model's digital replica, and may not alter a model's replica with AI without it. Powers of attorney cannot cover digital replica use. A chapter amendment (A2249, Chapter 66 of 2025) clarifies that consent must come from the model. Effective on the 180th day after becoming law.
Depiction of individual using digital or electronic technology: sexually explicit material: cause of action.
AB 602 added Civil Code Section 1708.86, giving a depicted individual a private right of action against a person who creates and intentionally discloses sexually explicit material made through digitization (realistic computer-generated or altered depictions) when the person knows or reasonably should know the individual did not consent. It also covers a person who discloses such material they did not create if they know the depicted individual did not consent to its creation. Exceptions apply for matters of legitimate public concern and works of political or newsworthy value. A prevailing plaintiff may obtain injunctive relief, attorney's fees, and economic, statutory, and punitive damages.
California Consumer Privacy Act of 2018: personal information.
AB 1008 amended Civil Code Section 1798.140, the CCPA definitions section. It specifies that personal information can exist in various formats, including physical formats, digital formats, and abstract digital formats such as compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information. This brings personal information held in or produced by AI models within the CCPA's consumer rights and business obligations.
Sexually explicit digital images.
SB 981 added Business and Professions Code Section 22670 and following. Social media platforms must provide California users a reasonably accessible mechanism to report sexually explicit digital identity theft, meaning the posting of an image or video created or altered through digitization that appears to show an identifiable person's intimate body parts or sexual acts without that person's consent. Platforms must temporarily block reported material while they investigate and remove it when there is a reasonable basis to believe it is sexually explicit digital identity theft, within set time limits, and keep the reporting user informed.
An Act To Amend Title 6 Of The Delaware Code Relating To Personal Data Privacy And Consumer Protection.
Delaware's HB 359 (152nd General Assembly) would have applied the Delaware Personal Data Privacy Act to State government. Its substitute, HS 1 for HB 359, narrowed this to letting consumers enforce their opt-out right under 6 Del. C. § 12D-104(a)(6) against the State. That right covers opting out of targeted advertising, the sale of personal data, and profiling in furtherance of solely-automated decisions with legal or similarly significant effects. The bill text itself never mentions AI. HB 359 was substituted on May 2, 2024; the substitute stayed in a House committee and died when the 152nd General Assembly ended.
Student personal information.
AB 1159 amended the K-12 and early learning student privacy laws (KOPIPA and ELPIPA) in the Business and Professions Code and enacted the Higher Education Student Information Protection Act. Among other changes, it prohibits an operator of a site, service, or application used for school purposes from using covered student information, including persistent unique identifiers, to train a generative artificial intelligence system or service or to develop an artificial intelligence system. It adopts the Civil Code Section 3110 definitions of artificial intelligence and generative AI. The higher education act is operative July 1, 2027.
Consolidated Appropriations Act, 2021 (Division U, Title I: AI in Government Act of 2020)
Title I of Division U of the Consolidated Appropriations Act, 2021 is the AI in Government Act of 2020. It creates an AI Center of Excellence within the General Services Administration to help agencies adopt AI and share best practices (sec. 103). It requires the Director of OMB to issue guidance to agencies on the acquisition and use of AI, including how to reduce barriers, protect civil liberties, privacy and civil rights, and identify AI risks (sec. 104). It also directs the Office of Personnel Management to identify skills for AI positions and create or update an occupational series for AI work (sec. 105). The remainder of the omnibus is outside this entry.
Artificial Intelligence Training for the Acquisition Workforce Act (AI Training Act)
The AI Training Act requires the Director of OMB, within one year and with GSA, to develop and provide an AI training program for federal employees in program management, procurement and contracting, logistics, cost estimating and related acquisition roles (sec. 2(b)). The training must cover how AI works, how it can benefit the government, its risks including discrimination and privacy risks, ways to mitigate those risks, and future trends. OMB must update the program at least every two years and track participation and feedback. The Department of Defense and NNSA are excluded, and the section sunsets 10 years after enactment.
Budget Act of 2025.
Section 11.25 of the Budget Act of 2025 (Artificial Intelligence Projects in State Departments) states the Legislature's intent that the workforce, fiscal, environmental, privacy, and policy effects of state generative AI projects be discussed publicly. It provides that no state fiscal or personnel resources may be spent implementing or maintaining generative AI projects in departments under the Governor's control unless the proposals were approved in the Budget Act or another statute. Projects in operation or development as of July 1, 2025 and projects responding to a declared state of emergency are excluded. Section 11.25 was amended the same day by AB 102 (Chapter 5, Statutes of 2025).
Budget Act of 2025.
Section 239 of AB 102 rewrote Section 11.25 of the Budget Act of 2025. Departments under the Governor using state resources for generative AI projects must complete the state's GenAI risk assessment (SIMM 5305-F) and privacy assessments (SIMM 5310-C) and follow the project delivery lifecycle (SIMM 19H). For IT projects using generative AI, agencies must give project documentation to the Legislature regardless of funding source, and funding requests go through the annual budget. The administration had to report by March 1, 2026 on the state's first GenAI proofs of concept.
Relating to the protection of minors from harmful, deceptive, or unfair trade practices in connection with the use of certain digital services and electronic devices, including the use and transfer of electronic devices to students by a public school.
Texas HB 18, the SCOPE Act (2023), sets duties for digital service providers toward known minors. Its AI-relevant part is Business & Commerce Code 509.056, 'Use of algorithms': a provider that uses algorithms to automate the suggestion, promotion or ranking of information to known minors must make commercially reasonable efforts to ensure the algorithm does not interfere with its duty to prevent harm to minors, and must disclose in its terms or privacy policy how it uses algorithms and what personal data they use. Most of the act takes effect September 1, 2024.
Concerning preventing certain disclosures of intimate depictions, and, in connection therewith, creating a cause of action for nonconsensual disclosure of an intimate digital depiction and adding and amending related provisions in criminal law.
Colorado SB 25-288 enacts the Preventing Unauthorized Disclosure of Intimate Digital Depictions Act. A digital depiction is a highly realistic image falsely appearing authentic that was created, altered or produced by generative AI, image editing software or computer-generated means. A person who discloses or threatens to disclose an intimate digital depiction without signed consent can be sued for actual damages or $150,000, exemplary damages, fees and injunctions; a disclaimer is no defense. It also extends sexual exploitation of a child to realistic computer-generated depictions of an identifiable child and updates the private-image offenses.
Relating to Criminal Offenses -- Electronic Imaging Devices
Rhode Island's 2025 amendment to R.I. Gen. Laws 11-64-3 makes the crime of unauthorized dissemination of indecent material cover sexually explicit or intimate images of an identifiable adult, including any image created by a digital device or altered by digitization, when shared without consent and with knowledge or reckless disregard of harm or intent to harass. A first offense is a misdemeanor and later offenses are felonies; threatening disclosure to obtain a benefit or demanding payment for removal is a felony up to 5 years. Platforms and telecom services are not liable for third-party content. Effective on passage.
Relating to Criminal Offenses -- Electronic Imaging Devices
Rhode Island's 2025 amendment to R.I. Gen. Laws 11-64-3 makes the crime of unauthorized dissemination of indecent material cover sexually explicit or intimate images of an identifiable adult, including any image created by a digital device or altered by digitization, when shared without consent and with knowledge or reckless disregard of harm or intent to harass. A first offense is a misdemeanor and later offenses are felonies; threatening disclosure to obtain a benefit or demanding payment for removal is a felony up to 5 years. Platforms and telecom services are not liable for third-party content. Effective on passage.
Relating to Criminal Offenses -- Impersonation and Identity Fraud
Rhode Island's 2026 identity fraud amendment defines a forged digital likeness as a computer- or other electronic system-generated visual representation of an identifiable person, or an audio recording of their voice, made to closely resemble a genuine one, likely to deceive, and created and distributed without consent. Digital forgery, knowingly creating or distributing such a likeness as genuine to facilitate fraud, is now felony identity fraud under 11-49.1-3(a)(8). The act also covers impersonating an entity with intent to defraud. Constitutionally protected activity, law enforcement and providers or developers of the underlying technology are excepted. Effective on passage.
Relating to Criminal Offenses -- Impersonation and Identity Fraud
Rhode Island's 2026 identity fraud amendment defines a forged digital likeness as a computer- or other electronic system-generated visual representation of an identifiable person, or an audio recording of their voice, made to closely resemble a genuine one, likely to deceive, and created and distributed without consent. Digital forgery, knowingly creating or distributing such a likeness as genuine to facilitate fraud, is now felony identity fraud under 11-49.1-3(a)(8). The act also covers impersonating an entity with intent to defraud. Constitutionally protected activity, law enforcement and providers or developers of the underlying technology are excepted. Effective on passage.
Revenge Porn - Definition of Visual Representation and Civil Action
Maryland SB 360 (2025) redefines visual representation in the revenge porn statute, Criminal Law 3-809, to include an image created with or without other existing depictions of a person that is indistinguishable from the person to an ordinary observer, including a computer-generated image; drawings, cartoons, sculptures and paintings are excluded. Knowingly distributing such intimate images without consent and with intent to harm remains a misdemeanor up to 2 years and $5,000. Victims gain a civil action for defamation per se or invasion of privacy against distributors, with attorney fees. Effective July 1, 2025.
Intimate Image Distribution Prohibition
Utah HB 193 (2021) created the offense of unlawful distribution of a counterfeit intimate image. A counterfeit intimate image is any visual depiction, including a computer-generated one, edited, manipulated or altered to depict the likeness of an identifiable person nude or engaged in sexual conduct. Distributing one without the person's consent, knowing or having reason to know it would cause emotional distress or harm, is a crime, with an aggravated offense when the person depicted is a child. Law enforcement and crime-reporting activity is exempt.
Criminal Justice Amendments
Utah HB 366 (2024) is a criminal justice bill whose AI-relevant provisions limit algorithmic decision-making. Courts may not rely solely on an algorithm or a risk assessment tool score when deciding on diversion or determining a sentence (Utah Code 77-18-103). The Administrative Office of the Courts must collect data on risk assessment scores. Other provisions on the sentencing commission chair and escape offenses are unrelated to AI. Effective May 1, 2024.
Invasion of Privacy; prohibition against the transmission of photography depicting nudity; include falsely created videographic or still images
Georgia's SB 337 (Act 550 of 2020) brings fake intimate images into the state's nonconsensual pornography law. O.C.G.A. 16-11-90 already made it a crime to knowingly transmit or post, without consent, a photo or video showing an adult's nudity or sexually explicit conduct when it harasses or causes financial loss to the person depicted and serves no legitimate purpose to them. The act adds that this includes a falsely created videographic or still image, which covers deepfakes and other fabricated images. Interactive computer services and telecommunications providers are not liable for content posted by others. It took effect on the Governor's approval.
Sexual Images
Florida's CS/CS/HB 757 (Chapter 2025-99) extends s. 836.13, F.S., on altered sexual depictions (sexual deepfakes) to their creation. 'Generate' means creating or altering an image by computer or other means to portray an identifiable person, or offering or agreeing to do so. Willfully generating, or soliciting, an altered sexual depiction of an identifiable person without consent, or possessing one with intent to maliciously promote it, is a third-degree felony. New s. 800.045 covers lewd images of an identifiable minor, including images created or altered by electronic means. Effective October 1, 2025.
Data Privacy Amendments
Utah H.B. 444 (2025) amends the Government Data Privacy Act for state and local governmental entities. It defines "automated decision making" (decisions about a person by automated processing without human review) and says high-risk processing activities may include facial recognition technology and automated decision making. Each entity must describe its high-risk processing in an annual privacy program report, and the Utah Office of Data Privacy, which monitors high-risk processing, must help identify best practices on automated decision making and synthetic data. It applies to government, not businesses. Passed by two-thirds, it took effect when signed on March 27, 2025.
Establishes the crime of unlawful dissemination or publication of a fabricated photographic, videographic, or audio record as a class E felony.
New York's A 1280 would add Penal Law § 245.20, making it a class E felony to intentionally create and then disseminate or publish, without consent and with intent to cause harm to the liberty or emotional, social, financial or physical welfare of an identifiable person, a fabricated photographic, videographic or audio record. Such a record would have to look indistinguishable from reality and be manipulated or artificial, including through AI such as deepfakes. Several exemptions apply, including parody, news reporting and platforms. Referred to Codes January 7, 2026; it has not passed either chamber.
Establishes the Stop Addictive Feeds Exploitation (SAFE) for Kids act prohibiting the provision of addictive feeds to minors
New York's SAFE for Kids Act (Chapter 120 of 2024) adds GBL Article 45. An "addictive feed" is one in which user-generated media is recommended, selected or prioritized for a user based on information associated with the user or their device; the Legislature's findings describe these feeds as personalized by machine learning algorithms. An operator may not provide an addictive feed to a user unless it has used commercially reasonable methods to determine the user is not a minor or has verifiable parental consent, and may not send minors notifications between 12 a.m. and 6 a.m. without parental consent. It takes effect 180 days after the Attorney General's rules take effect.
Protecting Our Kids from Social Media Addiction Act.
California's SB 976 (Chapter 321 of 2024), the Protecting Our Kids from Social Media Addiction Act, adds Health and Safety Code section 27000 and following. An "addictive feed" is one in which user-generated media is recommended, selected or prioritized for a user based on information provided by or associated with the user or their device. An operator may not provide an addictive feed to a user it knows is a minor without verifiable parental consent, and from January 1, 2027 it must reasonably determine that a user is not a minor, including under Attorney General rules, before providing one. It also limits notifications to minors between 12 a.m. and 6 a.m. without parental consent.
DISCLOSING EXPLICIT SYNTHETIC MEDIA – Adds to existing law to provide for the crime of disclosing explicit synthetic media.
Idaho's H 575 (2024) created the crime of disclosing explicit synthetic media in Idaho Code 18-6606. Synthetic media is an image or video created or altered with technical means, such as artificial intelligence, to realistically show an identifiable person doing something they did not do; explicit synthetic media shows sexual conduct or intimate parts. Knowingly disclosing it without consent when it would cause substantial emotional distress, disclosing it to harass or degrade, or threatening to disclose it to extort money or images is a misdemeanor, and a felony (up to 10 years, $25,000) for a repeat offense within five years. Effective July 1, 2024.
Use of digitally altered media in elections
Indiana's HB 1133 (P.L. 81-2024) regulates deepfakes in campaign ads. Fabricated media includes undetectably altered recordings, lifelike artificially generated imitations of a person made without consent, and media of an artificially generated person. If a campaign communication includes fabricated media depicting a candidate, whoever paid for it must include the disclaimer 'Elements of this media have been digitally altered or artificially generated,' shown or read as the law specifies. A depicted candidate may sue for damages, injunctive relief and attorney's fees if the disclaimer is missing. It took effect on passage.
Relating to the unlawful production or distribution of sexually explicit videos using deep fake technology; creating a criminal offense.
Texas SB 1361 (2023) created Penal Code 21.165. It is a Class A misdemeanor to knowingly produce or distribute by electronic means, without the depicted person's effective consent, a deep fake video that appears to show the person with intimate parts exposed or engaged in sexual conduct. A deep fake video is a video created with intent to deceive that appears to depict a real person performing an action that did not occur in reality. SB 441 (2025) later broadened the offense. Effective September 1, 2023.
Education matters.
Indiana's HEA 1408 (P.L. 100-2026) is mostly an education bill, but Section 14 adds IC 24-16 on social media providers, defined in part as platforms that employ algorithms analyzing user data to select content for users. Providers must use commercially reasonable means to determine a new Indiana user's age and need verifiable parental consent to open an account for anyone under 16. Those accounts must be configured so they receive no content, content recommendations or advertising based on the adolescent's patterns of use, and no addictive features, and parents get tools to monitor and limit use. Violations are deceptive acts under Indiana consumer law. IC 24-16 is effective January 1, 2027.
DEFIANCE Act of 2025 Disrupt Explicit Forged Images And Non-Consensual Edits Act of 2025
The federal S. 1837 (DEFIANCE Act of 2025) would let an identifiable individual sue over intimate digital forgeries: sexually intimate images made with software, machine learning or AI that are indistinguishable from authentic ones to a reasonable person. Defendants who knowingly produce, possess with intent to disclose, disclose, or solicit and receive them could owe liquidated damages of $150,000 ($250,000 in cases tied to sexual assault, stalking or harassment), plus fees and injunctions. Passed the Senate by unanimous consent January 13, 2026 and held at the desk in the House.
Revise laws related to use of name, voice, and likeness of individuals and penalties for unauthorized use
Montana's HB 513 (Chapter 685 of 2025) gives Montana residents property rights in their name, voice and visual likeness that can be licensed, inherited and enforced for 20 years after death. Without consent, a person is liable for distributing an algorithm, software or tool knowing its primary purpose is to produce unauthorized digital voice or visual depictions of a particular person for commercial use, or for knowingly publishing such a depiction for commercial use. Remedies are actual damages plus profits, with exceptions for news, commentary, satire, parody and similar First Amendment uses. Effective January 1, 2026.
Criminalize use of real and digitally fabricated sexually explicit images
Montana's HB 514 (Chapter 686 of 2025) extends the offense of violating privacy in communications to digitally fabricated intimate images. Digitally fabricated means created with technical means, such as artificial intelligence, to realistically show an identifiable person doing something they did not do. It is a crime to publish, distribute or disclose real or fabricated nude or sexual images of an identifiable person without consent to terrify, intimidate, threaten, harass, injure or get money, or to possess them and threaten disclosure for money. A first offense is a misdemeanor; a second or later is a felony with up to five years and a $25,000 fine. Effective October 1, 2025.
Generally revise laws related to privacy and facial recognition technology
Montana's SB 397 (Chapter 781 of 2023), the Facial Recognition for Government Use Act, bars state and local agencies, law enforcement, public employees and officials from using continuous facial surveillance and, with exceptions, from obtaining or using facial recognition technology or contracting vendors for it. The Department of Justice and local police may use it in criminal investigations under restrictions, including a warrant requirement, must tell defendants before trial, and must report use annually. Agencies may use facial verification only under a written use and privacy policy, with notice, vendor retention limits and human review training. People harmed may sue.
An Act Concerning the State Budget for the Biennium Ending June 30, 2027, and Making Appropriations Therefor, and Provisions Related to Revenue and Other Items Implementing the State Budget
Section 261 of Connecticut's 2025 budget act (Public Act 25-168) creates the crime of unlawful dissemination of an intimate synthetically created image. A synthetically created image is a photo, video or other image not wholly recorded by a camera or partly or wholly computer-generated that is virtually indistinguishable from a real depiction of an identifiable person. It is a crime to intentionally share such an intimate image without consent, knowing it is synthetic, intending viewers to believe it is real, when the person is harmed, or after creating or obtaining it to harm them. Penalties reach a class D felony. Section 261 is effective October 1, 2025.
Relative to prohibiting the nonconsensual dissemination of synthetic sexual images
New Hampshire's HB 1319 (Chapter 127 of 2024) extends the crime of nonconsensual dissemination of private sexual images to synthetic images. A synthetic image is an image altered or created to depict a person in a realistic but false way. It is a class B felony to purposely share, to harass, intimidate, threaten or coerce the person shown, a synthetic image that manipulates a recognizable person's image to create a realistic but false depiction of their intimate parts or sexual activity without consent. Exceptions cover investigations, reporting unlawful conduct and lawful public purposes. Effective January 1, 2025.
Social media platforms; requirements related to accounts for minors established
Minnesota's HF 4138 (Laws 2026, chapter 111) adds section 325M.40 on social media accounts of children under 16. Covered platforms must estimate account holders' ages and update the estimate every six months, or as often as they apply data analytics or artificial intelligence to update other demographic estimates, whichever is sooner. Children's accounts need verifiable parental consent, and platforms may not present addictive interface features, which include profile-based feeds (content selected or prioritized based on personal information), or targeted paid advertising on a child's account. Effective July 1, 2027.
Unlawful dissemination of an intimate image.
Wyoming's HB 85 (Chapter 85 of 2021) created the crime of unlawfully disseminating an intimate image, and its definition of image includes a computer generated image that purports to represent an identifiable person, so fake or AI-made intimate images count. An adult commits the offense by sharing an intimate image of another person, including on social media, when they knew or should have known the person expected privacy and did not expressly consent, and they intended to humiliate, harm, harass, threaten or coerce, or acted for sexual gratification. It is a misdemeanor punishable by up to one year in jail, a $5,000 fine, or both. Effective July 1, 2021.
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
New York's A 974-A, the "New York data protection act," would add General Business Law Article 42-A letting consumers opt out of profiling (automated processing of personal data to evaluate or predict personal traits) in furtherance of decisions that produce legal or similarly significant effects, and requiring a data protection assessment for profiling with a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers. It would also add targeted-advertising and data-sale opt-outs and other rights, with Attorney General civil penalties of up to $20,000 per violation. Amended May 29, 2026 and recommitted to Codes; not passed by either chamber.
Requests a study of the use of facial recognition data by law enforcement
Louisiana's HR 199 is a House resolution, adopted 65-30 on June 10, 2021, that requests the House Committees on Administration of Criminal Justice and on Judiciary to jointly study law enforcement's use of facial recognition data, how it is obtained, and its use in investigations and legal proceedings, taking information from groups including the Department of Justice, police and sheriffs' associations, the ACLU and the NAACP. Their report, due February 1, 2022, was to include search, arrest and conviction statistics and recommendations on legislation to safeguard due process, privacy and civil liberties. As a resolution of one chamber, it does not change the law.
Requires disclosure of use of generative artificial intelligence to clients, criminal defendants, and the court.
New York's A 9097 would add CPLR Rule 2107 and Criminal Procedure Law § 10.50 on generative AI in legal drafting. No paper or file could be drafted using generative AI without the informed consent of the client (or defendant) after a warning of its dangers. A GenAI-assisted filing would need a separate affidavit disclosing the use and certifying human review, including case citations; other filings would need an affidavit saying none was used. Would take effect on the ninetieth day after it becomes law. Referred to Judiciary September 12, 2025 (and January 7, 2026); it has not passed either chamber.
Technology Transparency
South Carolina's H 3401, 'Technology Transparency', would add Chapter 31 to Title 37. It would bar government entities from working with social media platforms on content moderation, give consumers rights to opt out of profiling with significant effects, require search engines to publish plain-language ranking parameters, and require data protection assessments. Introduced January 14, 2025 and referred to the House Judiciary Committee; it has not passed either chamber.
An act relating to consumer data privacy and online surveillance
Vermont's S.71 (Act 145) adds the Vermont Data Privacy and Online Surveillance Act. It covers businesses that in the prior year processed personal data of at least 35,000 Vermonters or sensitive data of at least 3,000, or offered for sale personal data of at least 3,000. Consumers may access, correct, delete and port their data and opt out of targeted ads, sales and profiling for automated decisions with legal or similarly significant effects. Controllers must minimize data, get consent for sensitive data, say whether they use data to train large language models, and assess risky processing and profiling. Attorney General enforcement only. Signed June 16, 2026; effective January 1, 2028.
SCH CD-STUDENT BIOMETRIC INFO
Illinois's SB 1239 would amend the School Code to bar school districts from buying, acquiring, using or contracting for biometric systems, including facial recognition software, on students. Districts holding student biometric information would have to destroy it within 30 days after the Act takes effect. Filed January 24, 2025; re-referred to Assignments April 11, 2025; it has not passed either house.
Establishing the Massachusetts data privacy act
Massachusetts S2516 would add G.L. Chapter 93M (Massachusetts Data Privacy Act) and Chapter 93N (Location Shield Act), with consumer rights including opt-out of profiling for solely automated significant decisions. Reported to Senate Ways and Means May 12, 2025. On September 25, 2025 the Senate substituted new draft S2608, which, reprinted as S2619, passed the Senate 40-0; the House passed it with an amendment 146-0 on June 4, 2026, and a conference committee was appointed (Senate June 11, House June 17, 2026). It has not been enacted.
Establishing the Massachusetts Data Privacy Act
Massachusetts S45 would add G.L. Chapter 93M (Massachusetts Data Privacy Act) and Chapter 93N (location data), with an opt-out of profiling used for automated decisions with legal or similarly significant effects. Referred to committee February 27, 2025; on May 12, 2025 it was folded into new draft S2516 (reported to Senate Ways and Means that day; replaced by S2608 on September 25, 2025).
To establish the Massachusetts Data Privacy Act
Massachusetts S29 would add G.L. Chapter 93M (Massachusetts Data Privacy Protection Act) and Chapter 93N (location data), giving individuals a right to opt out of profiling that produces legal or similarly significant effects. Referred to committee February 27, 2025; on May 12, 2025 it accompanied new draft S2516 (reported to Senate Ways and Means that day; replaced by S2608 on September 25, 2025).
Establishing the Massachusetts Data Privacy Act
Massachusetts H104 would add G.L. Chapter 93M (the Massachusetts Data Privacy Act) and Chapter 93N (location data). Individuals could access, correct, delete and port covered data and opt out of profiling used for automated decisions with legal or similarly significant effects; biometric data is sensitive data. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.
A bill for an act relating to restrictions on the use of artificial intelligence, and creating a civil cause of action.
Iowa's HF 2082 would bar using artificial intelligence to intentionally recreate a person's audio or visual likeness without consent when the likeness is meant to be nearly indistinguishable from the person and is used commercially, in a political campaign the person does not support, or to deceive, embarrass or induce action. Victims could sue for actual and punitive damages. Referred to the House Economic Growth and Technology Committee January 15, 2026; it has not passed either chamber.
Sexually Related Offenses
Florida's CS/CS/SB 1798 (Chapter 2022-212) created s. 836.13, F.S. An altered sexual depiction is an image modified by digital or other means to show a realistic identifiable person with another person's or computer-generated nude body parts, or in sexual conduct they did not engage in. Willfully and maliciously promoting one without consent, knowing it is altered, is a third-degree felony; a disclaimer is no defense. Victims may sue for an injunction, the greater of $10,000 or actual damages, and attorney fees. Effective October 1, 2022.
Creates the surveillance pricing and online retailing act that would prohibit algorithmic price increases for online purchases.
Rhode Island H 7849 (2026), as introduced on February 27, 2026, would add chapter 6-13.4 barring online retailers from knowingly applying an 'algorithmic price increase': a price above the seller's baseline price set using an algorithm, AI or other data processing system and materially influenced by an individual consumer's personal data. Violations are deceptive trade practices with civil penalties up to $100 per violation. The text says it takes effect upon passage.
Psychotherapy Artificial Intelligence Restrictions
Colorado's HB 26-1195 limits how licensed mental health professionals and others lawfully providing psychotherapy use AI. They may use it for administrative and supplementary support (e.g. scheduling, billing) if they stay responsible for reviewing its outputs, but may not let AI engage in therapeutic communication with clients without their synchronous, real-time participation or generate therapeutic recommendations or treatment plans without their approval. AI recording or transcription of sessions needs advance written notice and consent. No one may present AI as psychotherapy, therapist-equivalent or therapist-confidential. Signed June 3, 2026 (Chapter 358); effective August 12, 2026.
"New Jersey Disclosure and Accountability Transparency Act (NJ DaTA)"; establishes certain requirements for disclosure and processing of personally identifiable information; establishes Office of Data Protection and Responsible Use in Division of Consumer Affairs.
New Jersey's S2602 would create the New Jersey Disclosure and Accountability Transparency Act (NJ DaTA). Controllers could process personally identifiable information only on a listed basis, such as the consumer's affirmative opt-in consent, and consumers would get disclosure, correction, erasure, objection and automated-decision rights. A violation would be an unlawful practice under the Consumer Fraud Act, and an Office of Data Protection and Responsible Use would be created in the Division of Consumer Affairs. Pre-filed for introduction in the 2026 session.
Updates certain crimes to include nonconsensual pornographic deepfake threats and disclosure.
New Jersey's A2736 would add deepfake images to New Jersey's invasion-of-privacy and criminal coercion offenses. Knowingly reproducing an actual or deepfake intimate image without consent would be third-degree; disclosing a deepfake image based on another person's image, knowingly or with reckless disregard of any license or privilege, would be fourth-degree; threatening disclosure would be criminal coercion.
AN ACT relating to protection of information and declaring an emergency.
Kentucky's HB 672 (2025 session) would have required state departments and agencies to route generative and high-risk AI through an Artificial Intelligence Governance Committee created by the Commonwealth Office of Technology. It would have required approval, a public registry, disclaimers on AI-generated decisions and outputs, risk management policies and impact assessments for high-risk systems, employee training, and regulations by July 1, 2025. It also would have let candidates and election officers sue over undisclosed synthetic media in election ads. Referred to House State Government; died. SB 4 (2025), with the same title, was enacted instead (Acts Ch. 66).
Prohibits deepfake pornography and imposes criminal and civil penalties for non-consensual disclosure.
New Jersey's S1159 would add 'deceptive audio or visual media' (deepfakes) to the State's invasion-of-privacy law, making it a third-degree crime, with a fine of up to $30,000, to disclose such intimate media of a person without consent, knowing one is not licensed or privileged to do so. It would add such media to the child sexual exploitation offenses and let the person depicted sue.
Establishes Office of Cybersecurity Infrastructure.
New Jersey's S2940 would create the Office of Cybersecurity Infrastructure, in but not of the Department of the Treasury, led by a full-time Director appointed by the Governor with Senate consent. Its mandate would include State cybersecurity policy, secure technology infrastructure, and AI policies so public and private institutions can safely integrate AI into professional practices.
Prohibits deepfake pornography and imposes criminal and civil penalties for non-consensual disclosure.
New Jersey's A1359 would add 'deceptive audio or visual media' (deepfakes) to the State's invasion-of-privacy law, making it a third-degree crime, with a fine of up to $30,000, to disclose such intimate media of a person without consent, knowing one is not licensed or privileged to do so. It would add such media to the child sexual exploitation offenses and let the person depicted sue.
Updates certain crimes to include nonconsensual pornographic deepfake threats and disclosure.
New Jersey's S3303 would amend the invasion of privacy and criminal coercion laws to cover deepfakes. Knowingly reproducing, without license or privilege, an actual or deepfake image of another person's exposed intimate parts or sexual activity without consent would be a third-degree crime; disclosing such a deepfake image knowingly or with reckless disregard of license would be fourth degree with a fine of up to $30,000; threatening to disclose one would count as criminal coercion. Introduced February 2, 2026.
"AI Likeness Protection Act"; concerns distributing realistic representation of individual's image, likeness, or voice created using generative artificial intelligence.
New Jersey's A5088, the AI Likeness Protection Act, would require a person to get consent from an individual (or a minor's parent or guardian) before publishing or distributing a highly realistic generative-AI representation of that person's voice or likeness. The individual could sue for an injunction and the greater of actual damages plus profits or a civil penalty of up to $1,000 per violation. Introduced May 14, 2026.
Providing for the use of artificial intelligence in mental health therapy and for enforcement.
Pennsylvania's HB 1993 (2025-26), the Artificial Intelligence in Mental Health Therapy Act, would bar mental health professionals from using AI to support recorded or transcribed therapy sessions without written notice and patient consent, bar AI providers from representing that an AI system can provide therapy or is a therapist, and bar AI from making independent therapeutic decisions. It was referred to the House Professional Licensure Committee on October 24, 2025.
Further providing for definitions; providing for use of automated employment decision tool; and further providing for civil penalties.
Pennsylvania's HB 594 (2025-26) would amend the Pennsylvania Human Relations Act to require an employer or employment agency using an automated employment decision tool to notify and get consent from individuals before the interview and to use only tools with a bias audit from within the past year, with the results summary posted online. It was referred to the House Labor & Industry Committee on February 12, 2025.
Establishing the Comprehensive Massachusetts Consumer Data Privacy Act
Massachusetts S 33 would create a comprehensive consumer data privacy act. After a joint committee hearing on April 9, 2025, the committee folded it into new draft S2516 on May 12, 2025, so S33 itself does not move further. The successor, redrafted as S2608 and passed by the Senate 40-0 on September 25, 2025 as S2619, would let consumers opt out of profiling for solely automated decisions with legal or similarly significant effects. The House passed different text on June 4, 2026 and a conference committee was appointed in June 2026; nothing is law.
Consumer protection: privacy; personal data privacy act; create. Creates new act.
Michigan's SB 359 would create a Personal Data Privacy Act giving consumers rights over personal data, including opting out of profiling in furtherance of solely automated decisions with legal or similarly significant effects. Introduced June 5, 2025 and referred to the Committee on Finance, Insurance, and Consumer Protection, it was reported favorably without amendment on June 11, 2025 and referred to the Committee of the Whole on June 12, 2025; it has not passed either house.
Regulates use of artificial intelligence-enabled video interview in hiring process.
New Jersey's S3263 would require an employer that asks applicants to take a video interview analyzed by AI to give notice, explain how the AI works and obtain written consent beforehand. Applicant videos could be shared only with necessary service providers and deleted within 30 days on request. Violations would carry civil penalties of $500 for a first offense and $1,000 for each later one. Introduced February 2, 2026.
Personal Data Privacy/Social Media Safety
North Carolina's H 462 (Edition 2) would enact a Data Privacy Act giving residents rights to access, correct, delete and take their data and to opt out of targeted ads, sales and profiling for solely automated decisions with significant effects, and a social media act requiring parental consent and age verification for minors. Reported favorably as a committee substitute and re-referred to House Commerce and Economic Development April 29, 2025; it has not passed either house.
An act relating to the regulation of chatbots
Vermont's H.784 (2026) would have regulated chatbot providers under a new 9 V.S.A. chapter 118. Providers could not use chat logs for targeted ads, sell chat logs, train on minors' data, or train on adults without affirmative consent, and would have had to disclose the chatbot is not human at the first output and hourly, assess risks monthly, and publish information. Chatbots would be products with provider liability. The Attorney General or a State's Attorney could sue, and users could recover $5,000 liquidated damages. Referred to committee January 27, 2026; died.
Video Surveillance
South Carolina's H 4675 would create the Community Data Protection and Responsible Surveillance Act. State and local law enforcement could not use surveillance systems (automated license plate readers) that store data on third-party servers or use AI to identify or track vehicles by appearance. Data would be kept at most 21 days and searched only with a warrant. Referred to the House Judiciary Committee January 13, 2026; it has not passed either house.
In preliminary provisions, providing for algorithmic pricing transparency and fairness; and imposing duties on the Office of Attorney General and Bureau of Consumer Protection.
Pennsylvania's HB 1779 would require a clear disclosure, 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.', on advertised personalized algorithmic prices, and bar using protected class data to set prices differently. The Attorney General could seek injunctions and courts could impose up to $1,000 per violation. Referred to the House Consumer Protection, Technology and Utilities Committee August 4, 2025; it has not passed.
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
New York's S 3044 (the New York privacy act) would add a consumer data privacy article to the General Business Law. Covered businesses would have to give notice, honor opt-outs of targeted advertising, data sales and profiling used for decisions with legal or similarly significant effects, and run data protection assessments. Referred to Senate Internet and Technology Committee January 23, 2025; reported to Finance May 29, 2025; referred back to Internet and Technology January 7, 2026; it has not passed either house.
Artificial Intelligence Wisdom for Innovative Small Enterprises Act AI–WISE Act
The AI-WISE Act would direct the Small Business Administration to create educational modules on artificial intelligence tools for small businesses and make them publicly available on an existing SBA online learning platform. Topics include how AI models work and their limits, spotting AI-generated output, managing AI risks and user-input privacy, keeping humans in important decisions, and judging whether a tool is worth adopting. An advisory working group and NIST would help keep it accurate, and SBA resource partners would spread the word. The House passed it by voice vote on January 20, 2026.
Establishes "Fair Price Protection Act."
New Jersey's Fair Price Protection Act (S 3612) was substituted on June 30, 2026 by A 4085 (Assembly committee substitute for A 4085 and A 4523, third reprint), which became P.L.2026, c.55 on July 23, 2026. It makes surveillance pricing of groceries and other foodstuffs, meaning pricing set in whole or part by an algorithm or automated system using personal data, an unlawful practice under the Consumer Fraud Act, with exceptions. It also sets a one-year moratorium on new electronic shelf labels. Effective August 1, 2027 (first day of the 13th month after enactment); the moratorium section takes effect February 1, 2027.
CONSUMER DATA PRIVACY
Illinois's SB 3890 would create the Illinois Data Privacy Protection Act, giving consumers rights to access, correct, delete and port their data, to opt out of targeted advertising, sales and profiling used for decisions with legal or similarly significant effects, and to question the result of such profiling. It would also create a data broker registry and deletion mechanism. Filed February 6, 2026; re-referred to Assignments May 22, 2026; it has not passed either house.
CONSUMER DATA PRIVACY
Illinois's SB 3220 would create the Illinois Consumer Data Privacy Act, giving consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, data sales and profiling used for decisions with legal or similarly significant effects. Controllers would have to run data protection impact assessments, including for risky profiling. The Attorney General would enforce it. Filed February 2, 2026; re-referred to Assignments May 22, 2026; it has not passed either house.
Establishes the position of chief artificial intelligence officer and such person's functions, powers and duties; including, but not limited to, developing statewide artificial intelligence policies and governance, coordinating the activities of any and all state departments, boards, commissions…
New York's S 933 would create an office of artificial intelligence headed by a chief artificial intelligence officer, appointed by the Governor with the advice and consent of the Senate, to develop statewide AI policies and governance and coordinate state agencies' use of AI tools and automated decision-making systems. It would also create an advisory committee on state AI policy. Passed the Senate on March 5, 2026 and was delivered to the Assembly and referred to its Governmental Operations Committee; it has not passed the Assembly.
Relative to social media, algorithm accountability, and transparency
Massachusetts's S.51 (194th General Court) would create an Office of Social Media Transparency and Accountability under the Attorney General. Covered platforms (processing personal information of 100,000+ Massachusetts consumers, or 25,000+ with over 25% of gross revenue from selling personal data) would register annually, file transparency reports and pay for monthly third-party algorithm risk audits focused on harms to children. Penalties of up to $500,000 per violation. Reported favorably by the Advanced Information Technology, the Internet and Cybersecurity Committee October 16, 2025 and sent to Senate Ways and Means; not passed.
AI Chatbots - Licensing/Safety/Privacy
North Carolina's S 624 (as filed) would require a Department of Justice license to operate or distribute a chatbot that deals substantially with health information, with a $50,000 civil penalty for violating G.S. 114B-5. It would also create a Chatbot Safety and Privacy Act: covered platforms would owe users a duty of loyalty and would have to disclose that a chatbot is not human, get consent each session and de-identify user data. Filed March 25, 2025 and referred to the Senate Rules and Operations Committee; it has not passed either house.
Relating To Artificial Intelligence.
Hawaii's HB 1676 HD 1 (2026) would have created an AI in Education Task Force within the University of Hawaii to develop model statewide guidance, data privacy and vendor transparency standards and other recommendations on AI in education. It passed the House, but the Senate EDU and LBT committees deferred it March 23, 2026, and it was not enacted.
A BILL for an Act to provide for a department of transportation study regarding autonomous and semiautonomous vehicle technologies; and to provide a legislative management report.
North Dakota's HB 1614 (2025), as engrossed, would have required the Department of Transportation to study autonomous and semiautonomous vehicle technologies during the 2025-26 interim, covering infrastructure readiness, review of accident and traffic data, accident liability rules, and privacy and data-security vulnerabilities, and to report to legislative management before August 1, 2026. The House passed it 84-9 on February 24, 2025, but the Senate defeated it 2-43 on March 31, 2025, so it died.
Establishes certain requirements for social media websites concerning content moderation practices; establishes cause of action against social media websites for violation of content moderation practices.
New Jersey's S861 would make it an unlawful practice under the Consumer Fraud Act for a social media website to fail to publish and consistently apply its censorship, suspension and "anonymous" ban standards, to notify users of such actions, and to let users opt out of post-prioritization and banning algorithms. It would bar those algorithms for known candidates, with Attorney General fines of $100,000 per day (statewide candidates) or $10,000 per day (others), and let users sue over inconsistent standards or censoring without notice. Referred to the Senate Commerce Committee January 13, 2026; it has not passed either chamber.
Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
New York's S 8524 (the "New York data protection act") would add General Business Law article 42-A, a consumer privacy framework. Controllers would have to give notice, honor access, correction and deletion requests, let consumers opt out of targeted ads, data sales and profiling for decisions with legal or similarly significant effects, and run data protection assessments for risky profiling and other high-risk processing. Data brokers would register annually with the attorney general, who could enforce the act with civil penalties up to $20,000 per violation. Introduced October 8, 2025; referred to the Internet and Technology Committee January 7, 2026. It has not passed either chamber.
Distribution of Intimate Images
South Carolina's S 72 would add Sections 16-15-330, 16-15-332 and 16-15-333 making it a felony to intentionally disseminate an intimate image or a digitally forged intimate image, including one generated or substantially modified with machine-learning techniques, without the depicted person's effective consent. A first offense carries a fine up to $5,000 or up to five years' imprisonment. Introduced January 14, 2025 and referred to the Senate Judiciary Committee; it has not passed either chamber.
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…
New York's A 6211 (same as S 8004) would add Civil Rights Law § 40-h, making it unlawful for an owner, manager, employee or other agent of a place or provider of public accommodation to use a biometric surveillance system or biometric surveillance information, or to let a third party do so on its behalf. It would also require written notice and consent before collecting biometric information. Referred to the Assembly Governmental Operations Committee in February 2025 and again January 7, 2026; it has not passed either chamber.
Artificial Intelligence
Not law: died in subcommittee. Florida's HB 1395 (2026) would have created an "Artificial Intelligence Bill of Rights" (new part IX of ch. 501): parental consent and controls for minors on companion chatbot platforms, an hourly not-human pop-up for bots, a ban on selling users' personal information unless deidentified, and consent for commercial use of generative-AI likenesses. It would also have barred government AI contracts with foreign-country-of-concern entities. It died on March 13, 2026.
SCH CD-ARTIFICIAL INTELLIGENCE
Illinois's HB 2503 (104th General Assembly) would amend the School Code to require the State Board of Education to establish a State Instructional Technology Advisory Board that guides and evaluates education technologies, including AI. With that board, the State Board would develop standards on safety, transparency, data privacy and educational quality for AI used in schools, plus guidance on AI use and AI literacy. Re-referred to the House Rules Committee on April 11, 2025.
Relating to artificial intelligence.
Not law. Oregon HB 4103 (2026) would have created the Senator Aaron Woods Commission on Artificial Intelligence within Enterprise Information Services to study state government's use of AI and report annually to the Legislative Assembly by September 1. It would also have required the Department of Administrative Services to employ an individual responsible for the state's privacy, data protection and AI strategy. It passed the Information Management and Technology committee with amendments (A-engrossed) February 20, 2026, went to Ways and Means and was in committee upon adjournment March 6, 2026.
Artificial intelligence; Joint Commission on Technology and Science to study advancements.
Virginia's SJ 14 (2024 Regular Session) was a Senate joint resolution that would have directed the Joint Commission on Technology and Science to study advancements in artificial intelligence, including deepfakes, data privacy, misinformation and discrimination. It would not have changed the law. Continued to 2025 in committee on February 7, 2024; it failed.
Protecting Children from Chatbots
South Carolina's H 5476, the Protecting Children from Chatbots Act (new Chapter 81 of Title 39), would require chatbot operators with 500,000 or more monthly active users to offer a limited-access mode, verify users' ages and obtain verifiable parental consent before minors use restricted features. The Attorney General could seek civil penalties of up to $50,000 per violation. Introduced March 31, 2026 and referred to the House Judiciary Committee; it has not passed either chamber.
ALGORITHMIC PRICING DISCLOSURE
Illinois's HB 5323 (104th General Assembly) would require an entity that sets prices with personalized algorithmic pricing (dynamic pricing set by an algorithm using personal data) and advertises or offers it using the consumer's personal data to include the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA'. A violation would be an unlawful practice under the Consumer Fraud Act. Re-referred to the House Rules Committee March 27, 2026.
Unauthorized use of name, portrait, etc.; digital replica, civil liability, statute of limitations.
Virginia's HB 2462 (2025 Regular Session) would have amended Code § 8.01-40 to extend the suit for unauthorized use of a person's name, portrait or picture to voice and likeness, and created civil liability for unauthorized digital replicas in expressive audiovisual works or sound recordings made without written consent. The Senate version also made platforms liable for failing to promptly remove a replica after notice. The chambers passed different versions and the bill failed in conference on February 22, 2025.
BIPA-IDOT TESTING VEHICLES
Illinois's HB 2593 (104th General Assembly) would amend Section 25 of the Biometric Information Privacy Act to add that nothing in the Act applies to companies registered with the Department of Transportation to conduct testing of autonomous vehicles. Re-referred to the House Rules Committee on March 21, 2025; the 104th General Assembly remains in session.
CONSUMER DATA PRIVACY ACT
Illinois's HB 5221 (104th General Assembly) would create the Consumer Data Privacy Act, with rules for agreements between personal data processors and controllers, controller responsibilities, small business requirements, data protection assessments and civil penalties. Consumers could opt out of processing for targeted advertising, sale of personal data, or profiling in furtherance of automated decisions with legal effects. It would take effect January 1, 2027. Re-referred to Rules March 27, 2026.
AI DATA PRIVACY ACT
Illinois's SB 3180 (104th General Assembly) would create the Artificial Intelligence Data Privacy Act. Beginning January 1, 2027, a deployer would have to either (1) not let its AI train on a user's covered information and retain the training data indefinitely without first informing the user in writing and getting express written consent, or (2) set its AI by default not to train on that information unless the user is notified and affirmatively consents. The bill has private right of action provisions, and a violation would be an unlawful practice under the Consumer Fraud Act. Last action: re-referred to Assignments May 22, 2026.
BIPA-VEHICLE SAFETY TECH
Illinois's HB 3292 (104th General Assembly) would amend Sections 10 and 25 of the Biometric Information Privacy Act to provide that nothing in the Act may be construed to apply to an entity using vehicle safety technology for a vehicle safety purpose. Last action: Rule 19(a) re-referral to the House Rules Committee on March 21, 2025, after assignment to Judiciary - Civil.
CONSUMER DATA PRIVACY ACT
Illinois's SB 3548 (104th General Assembly) would create the Consumer Data Privacy Act, giving consumers rights to confirm whether personal data is processed, correct and delete it, obtain a copy, and opt out of targeted advertising, data sales or profiling. It would apply to persons controlling or processing data of at least 100,000 consumers, with Attorney General enforcement. Last action: re-referred to Assignments May 22, 2026.
AGE-APPROPRIATE DESIGN CODE
Illinois' SB 50 is mainly a children's online privacy and design-code bill. As introduced, it would require covered entities (for-profit businesses over set revenue or data thresholds) to complete data protection impact assessments for services reasonably likely to be accessed by children, including whether algorithms and targeted advertising systems could harm children, and would bar profiling a child by default. Introduced January 13, 2025; re-referred to Assignments April 11, 2025 and still pending.
AGE-APPROPRIATE DESIGN CODE
Illinois' SB 3241 is mainly a children's online privacy and design-code bill. As introduced, it would require covered entities (for-profit businesses over set revenue or data thresholds) to complete data protection impact assessments for services reasonably likely to be accessed by children, including whether algorithms and targeted advertising systems could harm children, and would bar profiling a child by default. Introduced February 2, 2026; re-referred to Assignments May 22, 2026.
PRIVACY RIGHTS ACT
Illinois' SB 52 is a general consumer privacy bill. As introduced, the Privacy Rights Act would give consumers rights over their personal information and create a Privacy Protection Agency. Its AI-related parts are narrow: it defines profiling as automated processing of personal information, and directs the Attorney General to adopt rules on access and opt-out rights for automated decision-making technology and on risk assessments. Introduced January 13, 2025; re-referred to Assignments April 11, 2025 and still pending.
Regards an individual's persona usage; prohibit certain deepfakes
Ohio's HB 185 would amend the right-of-publicity law (chapter 2741) on unauthorized use of an individual's persona, including a modified facsimile that a reasonable trier of fact would confuse with the individual, and add a new chapter 2742 on 'malicious deepfake recordings.' Without the depicted person's written consent, no person could produce a malicious deepfake recording to distribute, or offer to distribute one, and no one could recklessly distribute one, subject to exceptions. Introduced March 19, 2025; referred to committee March 26, 2025.
AGE-APPROPRIATE DESIGN CODE
Illinois' SB 51 is mainly a children's online privacy and design-code bill. As introduced, it would require a business whose online service, product, or feature is likely to be accessed by people under 18 to complete a data protection impact assessment, which must address whether the service's algorithms and targeted advertising systems could harm children, and would bar profiling a child by default. Attorney General enforcement only. Introduced January 13, 2025; re-referred to Assignments April 11, 2025 and still pending.
Relating to disclosures and penalties associated with use of synthetic media and artificial intelligence
West Virginia's SB 484 (2025 regular session, committee substitute) would have added W. Va. Code 3-8-12a barring anyone from distributing, or agreeing to distribute, AI-manipulated synthetic media of a person within 90 days before an election, knowing it is false, without consent and intending to injure a candidate or influence the result, unless it carries a clear disclaimer. It would be a misdemeanor with a fine up to $1,000 per violation, plus civil actions. It passed no chamber: it was laid over on first reading and referred to Rules on March 4, 2025.
Artificial intelligence.
California's Senate Concurrent Resolution 17 affirms the Legislature's commitment to President Biden's vision for safe AI and to the five principles of the White House "Blueprint for an AI Bill of Rights": safe and effective systems; algorithmic discrimination protections; data privacy; notice and explanation; and human alternatives, consideration and fallback. The Legislature commits to examining and implementing them in its legislation and policies on automated systems. Adopted by the Senate February 17, 2023 and the Assembly August 14, 2023; filed August 23, 2023 (Res. Chapter 135). A concurrent resolution does not change the law.
Recognizing Data Privacy Day.
HR4609 recognizes Data Privacy Day in Washington. Full bill text access is required for comprehensive analysis.
Unauthorized Artificial Intelligence Impersonation Amendments
Utah's SB 271 extends the state's abuse-of-personal-identity law (Utah Code Title 45, Chapter 3) to AI. Personal identity now covers name, picture, video likeness, voice and audiovisual appearance, including recreations made with generative AI or digital manipulation. Using it without consent in content for advertising, fundraising or sales in a way that implies endorsement, is likely to confuse or falsely suggests participation is abuse, as is knowingly selling or licensing a tool whose primary purpose is unauthorized commercial use of personal identity. Victims may sue for injunctions, damages, exemplary damages and fees. Signed March 27, 2025; effective May 7, 2025.
Extend Prohibition on School Facial Recognition
Colorado's SB 25-143 keeps the SB 22-113 ban on schools signing facial recognition contracts by deleting its July 1, 2025 repeal date. Contracts in effect April 18, 2025 stay allowed. New exceptions cover vendor tools used with board-approved curricula, which need opt-in consent, and safety uses: an articulable and significant threat, a missing student, or a person ordered to stay off school property. Safety systems may identify only the people involved and only while such a situation is occurring. Biometric identifiers may be kept no longer than 18 months, and aggrieved parties may seek an injunction. Signed and effective April 18, 2025 (Chapter 86).
Relating To Privacy.
Hawaii's SB 309 (Act 59 of 2021) adds sexual deep fakes to the felony of violation of privacy in the first degree (HRS § 711-1110.9). A person commits it by intentionally creating, disclosing or threatening to disclose an image or video of a composite fictitious person shown nude or engaged in sexual conduct that includes a known person's recognizable physical characteristics, so it appears to depict that person, with intent to substantially harm them or as revenge or retribution. The public-nudity and commercial-transaction exemptions do not apply to it. It is a class C felony. Became Act 59 June 23, 2021; effective on approval.
Schools; creating the Oklahoma Responsible Technology in Schools Act; requiring development of guidance for use of artificial intelligence and emerging technologies. Effective date. Emergency.
Oklahoma's Responsible Technology in Schools Act sets rules for AI in public schools from July 1, 2026. Classroom AI must be educator-directed, with a person reviewing AI outputs before use; AI may not be the main basis for grading, discipline, placement or other high-stakes decisions; and tools must suit students' ages and follow student-privacy law such as FERPA. Districts must give parents a yearly written list of AI tools, vendors and student data shared, and let them opt students out of student-facing AI without penalty. Each district board must adopt an AI policy before the 2027-28 school year.
An Act To Amend Title 15 Of The Delaware Code Relating To Deep Fakes In Elections.
Delaware's HB 316 (enacted as House Substitute 1, 84 Del. Laws c. 487) makes it a crime to distribute, or contract to distribute, a deep fake of a candidate or party within 90 days before an election without the depicted person's consent, if the person knows or should know it is a deep fake. Media carrying "This (image/video/audio) has been altered or artificially generated." is exempt, as are qualifying news coverage, satire and parody. Violations are class B misdemeanors, or class A with intent to cause violence or within 5 years of a prior conviction; depicted candidates may sue in the Court of Chancery. Signed and effective October 9, 2024.
Criminalize disclosure of certain explicit AI-generated media
Montana's SB 413 (Chapter 606, 2025) creates the crime of disclosing explicit synthetic media (sexual deepfakes): knowingly or purposely disclosing it when the person knows or should know the identifiable person shown did not consent and would suffer substantial emotional distress; disclosing it to terrify, intimidate, threaten, harass or injure that person; or threatening disclosure to obtain money or other valuable consideration. Penalties: up to $1,000 and 1 year in jail; repeat convictions up to $10,000 and 5 years; up to $10,000 and 10 years if the person shown is under 18. Signed and effective May 13, 2025.
A bill for an act establishing requirements and guidelines for conversational AI services, and providing civil penalties, and including applicability provisions. (Formerly SSB 3011.) Effective date: 07/01/2026. Applicability date: 07/01/2027.
Iowa's SF 2417 (Iowa Code ch. 554J) covers public conversational AI services built mainly to simulate human conversation. For known minors, operators must disclose AI use, take reasonable measures against sexual content and human-like claims, not give rewards at unpredictable intervals to boost engagement, and offer privacy tools. If a reasonable user would think it is human, it must say it is AI. Operators need self-harm crisis-referral protocols and may not knowingly and intentionally program it to claim licensed mental health care. AG enforces: the greater of actual damages or $1,000 per violation (penalty capped at $500,000). Signed May 2, 2026 (Acts Chapter 1068); applies July 1, 2027.
PUBLICITY ACT-USE OF AI
Illinois' Public Act 103-0836 (HB 4875) amends the Right of Publicity Act. A person may not knowingly distribute, transmit or make available to the general public a sound recording or audiovisual work with actual knowledge that it contains an unauthorized digital replica: an imitation of a real person's voice, image or likeness made with AI or other technology and used without consent. Facilitators with actual knowledge may also be liable, subject to a notice-and-takedown safe harbor for hosts and cloud providers. Artists' exclusive labels and exclusive distribution licensees may also enforce. News, commentary and parody uses are exempt. Approved August 9, 2024; effective January 1, 2025.
An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services
Maine's LD 2082 (Public Law chapter 687) bars any person from providing, advertising or offering therapy or psychotherapy services to the public, including through Internet-based AI, unless a licensed professional provides them; violations fall under the Maine Unfair Trade Practices Act. Licensed therapists may use AI for administrative or supplementary support (such as therapy notes) only if they keep full responsibility; supplementary use requires a recorded or transcribed session, written notice and client consent, and AI may not make independent therapeutic decisions or interact with clients therapeutically. Signed April 13, 2026.
Senate Study Committee on Artificial Intelligence and Digital Currency; create
Georgia's SR 391 is a Senate resolution, adopted 52-0 on April 2, 2025, that created the Senate Study Committee on Artificial Intelligence and Digital Currency: six members appointed by the President of the Senate, who names a legislative member as chair. It was to study AI and digital and cryptocurrency, including safeguards against fraud, unintended bias, discrimination and privacy infringements from AI, and to recommend any action or legislation. The committee stood abolished December 1, 2025. As a resolution of one chamber, it does not change the law.
BIPA-SECURITY PURPOSES
Illinois's HB 5635 (103rd General Assembly) would have amended the Biometric Information Privacy Act to waive certain requirements for collecting biometric identifiers or information in circumstances relating to security purposes, exclude information captured by a biometric time clock or lock that converts it to a mathematical representation, and add a one-year filing period and a 30-day cure notice. Died at Session Sine Die on January 7, 2025.
SCH CD-ARTIFICIAL INTELLIGENCE
Illinois's SB 1556 (104th General Assembly) would amend the School Code to require the State Board of Education to establish a State Instructional Technology Advisory Board to provide guidance, integration, oversight and evaluation of education technologies, including AI. The State Board and Advisory Board would develop standards for safety, transparency, data privacy and educational quality for AI in schools. Effective immediately. Re-referred to Assignments April 11, 2025.
Consumer Data Privacy Act
Pennsylvania's HB 78 (Consumer Data Privacy Act) would give consumers rights to access, correct, delete and port personal data and to opt out of targeted advertising, data sales and profiling for solely automated decisions with legal or similarly significant effects. Controllers would need consent for sensitive data and data protection assessments; the Attorney General alone would enforce, with no private right of action. Passed the House 127-76 October 1, 2025; this describes the Senate-amended version (PN 3688), which has not passed the Senate.
Relates to the use of automated lending decision-making tools by banks for the purposes of making lending decisions; allows loan applicants to consent to or opt out of such use.
New York's A 773-C would add Banking Law § 103-a requiring covered banking organizations and licensed lenders that use automated lending decision-making tools to commission an annual independent impact assessment and post a summary report, report discriminatory or biased findings to the Department within thirty days, and give applicants notice at least 24 hours before use and, to the extent practicable, a denial reason within 24 hours. It contains no consent or opt-out right. Reported and advanced to third reading (calendar 393) April 30, 2026; it has not passed either chamber.
"New Jersey Disclosure and Accountability Transparency Act (NJ DaTA)"; establishes certain requirements for disclosure and processing of personally identifiable information; establishes Office of Data Protection and Responsible Use in Division of Consumer Affairs.
New Jersey's A1360 would create the New Jersey Disclosure and Accountability Transparency Act (NJ DaTA). Controllers could process personally identifiable information only on a listed basis, such as the consumer's affirmative opt-in consent, and consumers would get disclosure, correction, erasure, objection and automated-decision rights. A violation would be an unlawful practice under the Consumer Fraud Act, and an Office of Data Protection and Responsible Use would be created in the Division of Consumer Affairs. Pre-filed for introduction in the 2026 session.
Relates to the use of automated lending decision-making tools by banks for the purposes of making lending decisions; allows loan applicants to consent to or opt out of such use.
New York's S 8115-C would add Banking Law section 103-a on automated lending decision-making tools used by banking organizations, licensed foreign and interstate branches and licensed lenders (national and federal institutions are excluded). Covered entities must get an annual independent impact assessment, post the final report on their website, keep records for seven years, report discriminatory outcomes to the department within thirty days, and give applicants notice at least 24 hours before use. Reported from Banks and committed to Internet and Technology May 12, 2026; it has not passed either chamber.
Establishes the "protect our privacy (POP) act" to impose limitations on the use of drones for law enforcement purposes; prohibits the use of drones by law enforcement at concerts, protests, demonstrations, or other actions protected by the first amendment.
New York's S 1096, the protect our privacy (POP) act, would add Civil Rights Law section 52-e. It would prohibit drone use by law enforcement agencies or for law enforcement purposes, with exceptions for search and rescue and examining dangerous areas after natural disasters, bar drones at concerts, protests and other First Amendment activity, and bar armed drones. Data from drones using facial recognition could not be used in investigations or prosecutions and would have to be deleted. Remedies would include suppression and a private action for the greater of $1,000 per violation or actual damages. Referred to Codes January 7, 2026; it has not passed either chamber.
Platform Accountability and Transparency Act
The federal Platform Accountability and Transparency Act (S. 3292) would require large social media platforms to give vetted outside researchers access to data and to publish transparency reports, including on their recommender and ranking algorithms. Introduced by Senators Coons and Cassidy, it was read twice and referred to the Senate Commerce, Science, and Transportation Committee on December 1, 2025; it has not passed either house.
Deepfake Liability Act
The Deepfake Liability Act (H.R. 6334) would amend Section 230 of the Communications Act and the TAKE IT DOWN Act. Section 230(c)(1) protection would apply only to platforms that run a reasonable process against cyberstalking and intimate privacy violations, including sexually explicit digital forgeries, and platforms would have to remove such content within 48 hours of a valid request. Referred to the House Energy and Commerce Committee on December 1, 2025; it has not passed either house.
Establishes the position of chief artificial intelligence officer and such person's functions, powers and duties; including, but not limited to, developing statewide artificial intelligence policies and governance, coordinating the activities of any and all state departments, boards, commissions…
New York's A 10231 (2023-2024 session) would have created an Office of Artificial Intelligence in the Office of Information Technology Services, headed by a chief artificial intelligence officer appointed by the Governor with Senate consent, to set statewide AI policy, coordinate and audit state agencies' use of AI and automated decision-making systems, and report annually to the legislature. It also would have created an advisory committee. It was introduced May 15, 2024 and referred to Governmental Operations; it did not pass, and the 2023-2024 session ended without action.
Mississippi Consumer Privacy Protection Act; create.
Mississippi's HB 1051 (2026) would have created the Mississippi Consumer Privacy Protection Act for businesses with over $25 million in revenue that handle personal information of 175,000+ consumers (or 25,000+ with over half of revenue from selling data). Consumers could opt out of profiling used for decisions with legal or similarly significant effects. It was referred to House Judiciary A on January 16, 2026 and died in committee on February 3, 2026.
An act relating to public safety; establishing a cause of action for nonconsensual dissemination of deep fake sexual images; establishing the crime of using deep fake technology to influence an election; establishing a crime for nonconsensual dissemination of deep fake sexual images
Minnesota's HF 1370 (Chapter 58) creates a civil claim (Minn. Stat. 604.32) and a crime (617.262) for disseminating without consent a deep fake that realistically depicts an identifiable person's intimate parts or sexual acts, and a crime (609.771) for disseminating a deep fake without consent to injure a candidate or influence an election. The election crime was amended in 2024 (2024 c 112) and now applies within 90 days before a political party nominating convention or after absentee voting starts for a primary or election. Signed May 26, 2023; effective August 1, 2023.
Prohibits the use of surveillance pricing
New York's A 9349-B would amend General Business Law section 349-a to prohibit surveillance pricing, meaning prices set in whole or part by an algorithm using personal data to offer different prices to different customers for the same goods or services. It would replace the current disclosure requirement with a ban, and bar using personal data to enable it. The Assembly passed it June 4, 2026; the Senate substituted it for S 8623-B and passed it June 4, 2026; as of October 8, 2026 the records show no delivery to or action by the Governor.
Use of Artificial Intelligence in Psychological, Clinical, Counseling, and Therapy Services
Florida's SB 344 (Grall) would create ss. 490.016 and 491.019, prohibiting licensees from using AI in the practice of psychology and school psychology, and licensees, registered interns and certificateholders from using AI in clinical social work, marriage and family therapy and mental health counseling, with exceptions for administrative support and consented session recording. Filed November 4, 2025; it died in the Health Policy Committee March 13, 2026.
AN ACT relating to data privacy.
Kentucky's HB 33, the Kentucky Price Fairness Act (2026 session), would have amended the Kentucky Consumer Data Protection Act (KRS 367.3611 and 367.3617) to bar controllers from 'surveillance pricing', meaning customized price increases based on individualized data, and from setting or displaying a price with an automated-decision system based on such data. The base price would have had to be the same for all consumers. Exceptions: uniform real-time market adjustments, loyalty programs, and verifiable costs. Referred to committee January 13, 2026; died when the session ended.
AN ACT relating to violations of privacy.
Kentucky's SB 180 would make it unlawful, without a court-approved warrant, for state and local agencies to obtain or use facial recognition technology or information derived from it, and would set consent, retention and disclosure rules for private entities holding biometric identifiers. Violations could be enforced by private suits or the Attorney General, and facial-recognition evidence would be inadmissible in Kentucky proceedings. Introduced February 6, 2024; sent to the Senate Judiciary Committee February 8, 2024. It died when the 2024 session ended.
AN ACT relating to data privacy.
Kentucky's HB 633, the Kentucky Kid's Code, would add duties to the Consumer Data Protection Act for large online services used by minors: highest-privacy defaults, controls over algorithmic feeds, limits on algorithmic recommendations linking adults and minors, and bans on profiling, targeted ads, dark patterns and certain push notifications. Introduced February 12, 2026; sent to the House Small Business & Information Technology Committee February 20, 2026. It died when the 2026 session ended without passing.
Consumer data protection and providing a penalty. (FE)
Wisconsin's SB 166 (as introduced March 27, 2025) would create a consumer data protection law (s. 100.80) for controllers handling the personal data of 100,000+ consumers, or 25,000+ consumers while deriving over 50 percent of revenue from selling data. Consumers could access, correct, delete and obtain their data and opt out of targeted advertising, sale and certain forms of automated processing. Controllers would owe privacy notices and data protection assessments, including for profiling. Violators would face forfeitures up to $10,000 per violation. It failed to pass pursuant to Senate Joint Resolution 1 on March 23, 2026 and did not become law.
Artifical intelligence; prohibit use of in professional mental and behavioral health care.
Mississippi's HB 1048 (2026, as introduced) would have barred AI providers from offering AI systems programmed to provide professional mental or behavioral health care, or claiming such systems can provide it, and barred licensed mental health professionals from using AI in practice except for administrative and supplementary support, and for recording sessions with written informed consent 24 hours in advance. Violators would have faced civil penalties up to $15,000 per violation in Attorney General actions, and licensees board discipline. Referred January 16, 2026; it died in committee February 3, 2026.
AI Accountability and Personal Data Protection Act
The federal S. 2367 (AI Accountability and Personal Data Protection Act) would make it a federal tort to appropriate, use, collect, process, sell or otherwise exploit an individual's covered data without express, prior consent, including training a generative AI system on it or using one to generate content derived from it. Individuals could sue for the greater of actual damages, treble profits or $1,000, plus punitive damages and fees. Referred to the Senate Judiciary Committee July 21, 2025; it has not passed either chamber.
Deepfake recordings or images
Vetoed. Arizona's SB 1336 (2024) would have added A.R.S. § 13-3508, making it a crime to intentionally disseminate a deepfake recording or image that realistically depicts an identifiable person's intimate parts (real or generated by synthetic media) or the person engaging in a sexual act, when the person who created and disseminated it knew or reasonably should have known the person did not consent. It would have been a class 6 felony, or a class 4 felony in cases such as posting it online, intent to profit or harass, or a prior conviction. The Governor vetoed it May 29, 2024, calling it duplicative of SB 1078.
Relative to AI health communications and informed patient consent
Massachusetts' H 1210 would give patients the right to be told when health information they get was generated by AI, with instructions for reaching a human provider if the provider had not reviewed it. Health insurance carriers would have to disclose AI or automated decision tools used in claims review and file an annual report on AI algorithms and training data used in utilization review, with a bias attestation. Referred to Financial Services February 27, 2025; on February 9, 2026 it accompanied a study order (H 5066) and did not advance as its own bill.
Synthetic digital representations and providing a penalty.
Wisconsin's SB 815 would have created s. 942.085, making it a Class A misdemeanor to create and post, publish, distribute or exhibit a deepfake (a synthetic digital representation of an individual's recognizable face, voice or likeness that looks authentic and was made without consent) with intent to coerce, harass or intimidate, and a Class I felony if done with intent to defraud, coerce or intimidate for monetary gain. Introduced January 14, 2026 and referred to committee; it failed to pass March 23, 2026.
Georgia Likeness, Expression, Generative AI, and Commercial Yield (LEGACY) Act; enact
Georgia's HB 1399 (2026), the Georgia Likeness, Expression, Generative AI, and Commercial Yield (LEGACY) Act, would have given every individual a property right in their likeness and required the individual's written consent to create, distribute or exploit a digital replica of them for commercial purposes. Aggrieved individuals could have sued for damages, punitive damages and injunctions. It was read the second time in the House February 24, 2026 and died when the session adjourned April 2, 2026.
Relative to prohibiting the unlawful distribution of misleading synthetic media.
New Hampshire's HB 1500-FN would have made it a class A misdemeanor to purposely distribute synthetic media (media created or modified with artificial intelligence algorithms) of an identifiable person without consent and without a conspicuous synthetic-media notice, intending to mislead others. An election-related offense would have covered the 90 days before an election. Referred for interim study March 14, 2024; the October 31, 2024 report was Not Recommended for Future Legislation, so it is dead.
Establishes consumers' foundational data privacy rights; creates oversight mechanisms; establishes enforcement mechanisms; establishes the privacy and security victims relief fund.
New York's A5827 (2025-26) would add a new Article 46, the "American Data Privacy and Protection Act", to the General Business Law, covering data minimization, a duty of loyalty, consumer rights to access, correct, delete and port covered data, and consent and opt-out rules for transfers and targeted advertising; its title also establishes a privacy and security victims relief fund. A large data holder using a covered algorithm in a way that poses a consequential risk of harm would have to conduct an impact assessment of it. Referred to the Assembly Science and Technology Committee February 20, 2025 and again January 7, 2026; not enacted.
Protecting Children from Chatbots
South Carolina's S 1037, the Protecting Children from Chatbots Act (new Chapter 81 of Title 39), would require chatbot operators with five hundred thousand or more monthly active users worldwide to offer a limited-access mode, verify age and obtain verifiable parental consent before minors use restricted features. The Attorney General could seek civil penalties of up to $50,000 per violation. Referred to the Senate Labor, Commerce and Industry Committee March 19, 2026; it has not passed either chamber.
Protecting Everyone from Excessive Police Surveillance (PEEPS) Act
West Virginia's HB 4628, the Protecting Everyone from Excessive Police Surveillance (PEEPS) Act (2026 regular session), would have barred government officials from accessing databases of photos, video, license plate, facial recognition or cell site data that reveal locations more than 24 hours old unless there is a warrant, voluntary consent, a reported lost or stolen vehicle, exigent circumstances, or specified traffic, toll and parking uses. Data could be kept no more than 10 days. It was sent to House Judiciary on January 21, 2026 and died when the session ended March 14, 2026.
Prohibiting surveillance-based price discrimination and surge pricing for retail goods.
Washington's HB 2481, the fair pricing and transparency act (2026 session), would have barred non-small businesses selling grocery products from surveillance-based price discrimination (prices set from monitoring or automated analysis of a consumer's personal data) and from surge pricing based on real-time or predicted demand; 'algorithm' is defined to include AI. It would also have barred electronic shelf labels in stores of 15,000 square feet or more until January 1, 2030; violations would be Consumer Protection Act violations. It was heard in House Appropriations on February 5, 2026 and died at adjournment.
Prohibits the use of biometric identifying technology in schools for any reason other than certain specified purposes; adds fingerprint identification of teachers, administrators and students for the purpose of securely logging into a digital device for academic and administrative purpose to…
New York's S 3827-A would amend State Technology Law § 106-b so public and nonpublic elementary and secondary schools, including charter schools, are "prohibited from purchasing or utilizing biometric identifying technology for any purpose," including school security. Exceptions cover fingerprinting of prospective employees, fingerprint logins to digital devices and employees who consent in writing. Passed the Senate 38-21 on June 12, 2025 and was referred to the Assembly Education Committee; it has not passed the Assembly.
BIPA-VEHICLE SAFETY TECH
Illinois's SB 2051 (104th General Assembly) would amend Sections 10 and 25 of the Biometric Information Privacy Act to provide that nothing in the Act may be construed to apply to an entity using vehicle safety technology for a vehicle safety purpose. Filed February 6, 2025; last action: referred to the Senate Committee on Assignments that day.
Updates certain crimes to include nonconsensual pornographic deepfake threats and disclosure.
New Jersey's A4435 would amend the criminal invasion of privacy law to cover deepfake images. Recording an actual or deepfake image of a person's exposed intimate parts or sexual activity without consent would be a third-degree crime, and disclosing a nonconsensual deepfake based on another person's image, knowingly or with reckless disregard of lacking a license or privilege, would be a fourth-degree crime. Threatening to disclose such an image would count as criminal coercion. Introduced May 20, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Artificial intelligence and cybersecurity.
Indiana's SB 150 (Public Law 108 of 2024) creates a 15-member legislative AI task force (IC 2-5-53.7) that studies AI used, developed or considered by state agencies, assesses its benefits, risks and effects on residents' rights, privacy, employment and economic welfare, and reports recommendations by October 31 each year. From July 1, 2025, state agencies may submit AI inventories and public entities may adopt technology and cybersecurity policies; entities connecting to state technology infrastructure after July 1, 2026 (public entities after July 1, 2027) must meet cybersecurity rules. Signed March 13, 2024; task force effective July 1, 2024; the AI chapters expire December 31, 2027.
Chatbot Regulation
South Carolina's S 896 was introduced as the Chatbot Protection Act (Chapter 80 of Title 39). The Senate Labor, Commerce and Industry Committee reported it favorably with an amendment on May 6, 2026, and the amended text is the Protecting Children from Chatbots Act: operators with 50,000 or more monthly active users would need age verification and parental consent for minors, with civil penalties of up to $50,000 per violation. It has not passed the Senate.
AI Chatbots-Licensing, Safety, and Privacy.
SB 963 would require a state license from the North Carolina Department of Justice to operate or distribute any chatbot dealing substantially with health information, with evidence of effectiveness, insurance, encryption, fast breach reporting and annual audits. A Chatbot Safety and Privacy Act would give larger chatbot providers a duty of loyalty: respond to users at risk of harm, prevent emotional dependence, disclose at each new interaction that the chatbot is not human and get consent, deidentify data, and keep sensitive data out of training. Users could sue for $1,000 per violation. Pending in the Senate.
An Act Concerning Consumer Privacy And Protection.
Connecticut's Public Act 26-64 (SB 4) targets data-driven pricing and surveillance. Businesses that use an automated price setting device fed by personal data (other than to set a discount) and advertise the price online must show "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA" or similar. Retailers and delivery apps may not use surveillance pricing. Data privacy act controllers using facial recognition on premises for security must match only against their own database and post entrance signs. It also requires data brokers to register, bans selling precise geolocation data, and adds genetic-testing consent rules. Signed May 27, 2026; effective October 1, 2026.
Artificial Intelligence Chatbots Act; established, prohibited practices, penalties.
Virginia's HB 635 (2026 Regular Session) would create the Artificial Intelligence Chatbots Act. As introduced, an operator could not offer a companion chatbot in Virginia unless it is incapable of certain specified actions, and would have to show non-human disclosures and have a suicide and self-harm protocol. Continued to 2027 on February 9, 2026.
Chatbot Regulation
South Carolina's H 5138 would enact the Chatbot Protection Act (new Chapter 80 of Title 39). Chatbot providers would need affirmative consent to process personal data, could not use chat logs for advertising, would have to disclose that the user is talking to a chatbot, and would face civil penalties of up to $5,000 per violation. Introduced February 10, 2026 and referred to the House Labor, Commerce and Industry Committee; it has not passed either chamber.
ALGORITHMIC PRICING DISCLOSURE
Illinois's HB 4717 (104th General Assembly) would require an entity that sets prices with personalized algorithmic pricing (dynamic pricing set by an algorithm using personal data) and advertises or offers it using the consumer's personal data to include the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA'. A violation would be an unlawful practice under the Consumer Fraud Act. Referred to the House Rules Committee February 6, 2026.
Online Privacy Act of 2026
The federal H.R. 8014 (Online Privacy Act of 2026) would create individual privacy rights and security duties for covered entities that intentionally collect, process or maintain personal information and send or receive it over the internet, and a new Digital Privacy Agency to enforce them. Its AI-related parts include a right to human review of solely automated decisions that materially increase reasonably foreseeable significant privacy harms and a ban on behavioral personalization without affirmative express consent. Introduced March 19, 2026 and referred to House committees; no further action.
AI in Health Care Efficiency and Study Act
The federal H.R. 7064 (AI in Health Care Efficiency and Study Act) would require the Secretary of Health and Human Services, not later than 18 months after enactment, to conduct a study of strategies for applying AI across the health care industry to improve administrative and clerical processes while protecting patient data privacy and security in HHS programs and activities. The Secretary would report to Congress 6 months after finishing the study. Introduced January 14, 2026 and referred to the House Energy and Commerce Committee; no further action.
Save Taxpayers’ Privacy Act
The federal H.R. 6616 (Save Taxpayers' Privacy Act) would have barred the Secretary of the Treasury from establishing or maintaining any verification process using facial recognition technology for access to an Internal Revenue Service online account or service. Introduced February 4, 2022 and referred to the House Ways and Means Committee; it died when the 117th Congress ended on January 3, 2023.
Requires disclosure of social media posts that are paid for by a campaign; authorizes the state board of elections to promulgate certain regulations.
New York's A 3929-B would amend Election Law § 14-106 so campaign-paid social media posts would have to carry the "Paid for by" disclosure and are not exempt as small digital media, and would require anyone who distributes political communications containing materially deceptive media (content created or altered with software, machine learning, AI or other technological means), with actual knowledge, to disclose the manipulation. A candidate depicted without consent could seek an injunction, costs and fees. Would take effect on the ninetieth day after becoming law. Reported to Rules June 5, 2025, referred to Codes January 7, 2026; it has not passed either chamber.
Crimes and punishments; creating and disseminating a digitization or synthetic media; making certain acts unlawful; emergency.
Not law. The committee substitute for HB 3299 would have made it a misdemeanor in Oklahoma (up to 1 year and $1,000) to create and disseminate synthetic media of another person's name, image, voice or likeness without written consent and with intent to deceive and cause harm, and a felony (up to 5 years and $10,000) when it causes over $25,000 in financial harm or is used for extortion or blackmail. It would also have required disclosure of synthetic media in political ads and attestations from content creators. It cleared House committees in February 2026 but never received a House floor vote.
AN ACT relating to privacy protection.
Kentucky's HB 45 (2024 session) was a privacy bill covering automated license plate readers (data kept no more than 30 days with exceptions, no sale), drone surveillance, deep fakes, identification devices and tracking devices. The deep fake sections would have given a civil action against anyone who willfully and knowingly disseminated a deep fake without written consent and made certain harmful disclosures a Class D felony. The House passed it 96-0 with a committee substitute on February 28, 2024; in the Senate it was reassigned to Transportation March 7, 2024 and died.
AN ACT relating to the protection of children using the internet.
Kentucky's SB 345 (2024 session) would have required businesses that knowingly process children's personal information to protect children (under 18) online. Before offering new online services likely to be accessed by children, they would have had to complete data protection impact assessments, set default privacy settings to a high level, and not profile children by default where an assessment found unmitigated high risk. Profiling meant automated processing of personal information to evaluate a person. Violations would have been unfair or deceptive practices with Attorney General penalties of up to $2,500 or $7,500 per affected child. Referred to committee March 1, 2024; died.
Consumer Protection – Online Products and Services – Data of Children (Maryland Kids Code)
Maryland's SB 571 (Kids Code) covers for-profit firms doing business in Maryland that have over $25M revenue, buy, receive, sell or share data of 50,000+ consumers, households or devices yearly, or get at least half their revenue from data sales. For online products reasonably likely to be accessed by under-18s they must do impact assessments (existing ones by April 1, 2026) and set high-privacy defaults. AI-related: no default profiling of children without safeguards and need or a compelling reason; assessments weigh algorithm harms. Fines up to $7,500 per child per violation. Signed May 9, 2024 (Chapter 460; same as HB 603); effective October 1, 2024. Not enjoined; NetChoice suit pending.
Labor and Employment - Use of Facial Recognition Services - Prohibition
Maryland's HB 1202 bars employers from using a facial recognition service to create a facial template (the machine-interpretable pattern of facial features extracted from images) during a job applicant's interview unless the applicant consents by signing a waiver. The waiver must state in plain language the applicant's name, the interview date, that the applicant consents to facial recognition during the interview, and whether the applicant read the waiver. The act itself sets no penalty. Became law without the Governor's signature (Chapter 446, May 8, 2020); effective October 1, 2020.
Relating to the unlawful production or distribution of sexually explicit media using deep fake technology.
Vetoed. Texas's HB 449 would have widened the Penal Code § 21.165 crime from deep fake videos to any deep fake media: a visual depiction made or altered with software, machine learning, AI or other technological means that appears to a reasonable person to show a real person, indistinguishable from an authentic depiction, doing something that did not happen. It would have dropped the "intent to deceive" element. Knowingly producing or distributing such media by electronic means, showing a person with intimate parts exposed or engaged in sexual conduct, without their consent, would have stayed an offense. Vetoed by the Governor June 22, 2025.
Ai, Deepfakes, Cybersecurity, Data Xfers
Alaska's HB 306 would have required a statement ('This communication has been manipulated or generated by artificial intelligence') on campaign communications containing a deepfake meant to injure a candidate or party or deceive voters. It would also have set rules for state agency AI used for consequential decisions: inventories, impact assessments, notice, consent, appeals and bans. It was heard and held in House State Affairs March 19, 2024 and died when the 33rd Legislature ended.
Establishing the Massachusetts consumer data privacy act
Massachusetts H 78 would create the Massachusetts Consumer Data Privacy Act, giving consumers rights over personal data, including opting out of profiling for solely automated decisions with legal or similarly significant effects. After a hearing on April 9, 2025, the committee folded it into new draft H4746 on November 17, 2025, which was referred to House Ways and Means; the page shows no later action. Separately, Senate bill S2619 is in a conference committee (June 2026). Neither bill has passed both houses.
An Act advancing the economic development of the commonwealth through comprehensive data privacy
Massachusetts' S 301 would add a new chapter 93M to the General Laws, the Massachusetts Information Privacy and Security Act, a comprehensive data privacy law with defined terms such as consent (which excludes dark patterns), controller, data broker and biometric information. In the captured text, a large data holder's risk assessment would also have to say whether processing relies on an algorithmic process, such as machine learning or AI, and describe its design, input data and outputs. The bill accompanied a study order on December 18, 2025 and did not advance.
Regulates use of artificial intelligence enabled video interview in hiring process.
New Jersey's A3911 would require an employer that asks applicants for video interviews and uses AI to analyze them to notify the applicant, explain how the AI works and what characteristics it evaluates, and obtain written consent first. Employers would have to delete interviews within 30 days of a request and report applicants' race and ethnicity data annually to the Department of Labor and Workforce Development. Violations would carry a $500 civil penalty for a first offense and $1,000 for each later one. Introduced February 27, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
LIFE with AI Act Learning Innovation and Family Empowerment with AI Act
The federal S. 3063 (LIFE with AI Act) would condition federal education funds on student-privacy rules: a simpler directory-information opt-out form, a bar on using student photos to train facial recognition without parental consent, and public ed-tech contracts with vendor privacy certifications. It would also create a "Golden Seal of Excellence in Student Data Privacy", a Privacy Technical Assistance Center, and teacher resources and research priority for AI in education. Introduced October 28, 2025 and referred to the Senate HELP Committee; no further action.
Artificial Intelligence Task Force; create and prescribe responsibilities of.
Mississippi's SB 2426 created the Artificial Intelligence Regulation (AIR) Task Force: two legislators as co-chairs plus the heads (or designees) of Information Technology Services, the Mississippi AI Network, Homeland Security, the National Guard and the Attorney General's office, with optional nonvoting experts. It drafts proposed revisions to the Mississippi Code on AI, reviews other states' and federal AI laws (privacy, testing, ethics, liability, bias, copyright), and recommends AI uses in state agencies. It reports by December 1 each year and dissolves December 31, 2027. Its meetings and findings are exempt from open meetings and public records laws. Effective March 18, 2025.
Deepfake pornography.
California's AB 621 rewrites Civil Code § 1708.86, the civil claim over sexually explicit deepfakes. A depicted person can sue anyone who creates and intentionally discloses, or intentionally discloses, digitized sexually explicit material (including images) when they know or reasonably should know the person did not consent or was a minor, and anyone who knowingly facilitates or recklessly aids or abets it. Deepfake pornography services and providers that keep them running after 30 days' notice face presumptions of liability. Statutory damages reach $50,000, or $250,000 if malicious, and prosecutors may sue. Signed October 13, 2025 (Chapter 673); effective January 1, 2026.
Online Internet Safety; certain disclosures related to conversational AI services; require
Georgia's AI companion chatbot law (Act 518, effective July 1, 2027). Operators must clearly disclose that users are talking to an AI, at the start and at least every three hours (hourly for minors or minor-directed bots). For known minors they must take reasonable measures to block sexual content, romantic role-play, encouraging secrecy or isolation, and manipulative engagement tactics. Every operator needs a self-harm crisis protocol with referrals such as 988, published in summary with yearly referral counts, plus parental tools and age assurance before any sexually explicit feature. The Attorney General enforces it, with penalties up to $10,000 per knowing violation.
Educ-Tech Rts/Biometric Info
Illinois's SB 3735 (104th General Assembly) would create the Student Educational Technologies Rights Act, giving students and parents rights to opt out of school-issued devices and predictive analytics and to request human review of AI-generated grades. It would bar school districts from acquiring biometric systems for students and limit operators from letting AI train on student data. Re-referred to Senate Assignments May 22, 2026.
AN ACT relating to crimes; expanding the crime of unlawful dissemination of an intimate image to include certain acts relating to the distribution of certain photorealistic images, digital images, computer images and computer-generated images; providing an exception to the crime of unlawful dissemination of an intimate image for persons who are less than 18 years of age; revising the definition of "intimate image"; providing penalties; and providing other matters properly relating thereto.
Nevada SB 213 brings AI deepfake nudes within the intimate-image law. "Intimate image" now includes photorealistic, digital, computer and computer-generated images that a reasonable person would believe show an identifiable person nude or in sexual conduct, and the public-figure exclusion is removed. Knowingly distributing such an image, made so it would be believed real, without the person's consent and with intent to harass, harm or terrorize, is a category D felony. Minors are exempt and offenders do not have to register as sex offenders.
Enacts the "digital fairness act"; requires any entity that conducts business in New York and maintains the personal information of 500 or more individuals to provide meaningful notice about their use of personal information; establishes unlawful discriminatory practices relating to targeted…
New York's S 4276 (the digital fairness act) would require businesses holding personal information of 500 or more people to give short-form privacy notices, get opt-in consent, and bar discriminatory targeted advertising. It would also set rules for government automated decision systems: use policies, notice, human review and impact assessments. Referred to the Senate Internet and Technology Committee February 3, 2025, and again January 7, 2026; it has not passed either house.
Realigning Mobile Phone Biometrics for American Privacy Protection Act
The federal H.R. 7124 (Realigning Mobile Phone Biometrics for American Privacy Protection Act) would require the Secretary of Homeland Security, within 30 days after enactment, to develop standards and guidelines for DHS and its components that bar use of the Mobile Fortify and Mobile Identify mobile applications (and successors) except for identification at ports of entry, bar sharing them with other agencies, require their removal and remote disabling, and require destruction of images and fingerprints of U.S. citizens. Introduced January 15, 2026; referred to the House Homeland Security Committee and, January 16, to its Subcommittee on Border Security and Enforcement; no further action.
Protections for Youth on Social Media
Colorado's HB 26-1148 as introduced would add minor-protection duties for online gaming businesses (default privacy settings, an account-deletion tool, limits on using a minor's data to recommend media, a 5% fee on minors' add-on purchases) and would require social media platforms to disclose their algorithmic recommendation systems and bar using them to distribute illicit substances to minors. House Judiciary postponed it indefinitely 8-3 on April 7, 2026; it did not pass.
AN ACT relating to data privacy, portability, and interoperability.
Kentucky's HB 559, the Kentucky Digital Choice Act (2026 session), would have given users of social media services and AI model operators data portability, deletion and interoperability rights. Companies and operators would have had to answer copy or deletion requests within five business days and offer open-protocol interoperability interfaces. Only the Attorney General could enforce it, with damages of up to $7,500 per continued violation after a 30-day cure period. It was referred to committee February 11, 2026 and died when the session ended.
REGISTERED NURSE USE OF AI
Illinois's SB 3702 would amend the Nurse Practice Act to bar AI systems from providing nursing services in place of a registered professional nurse in direct patient care, require a nurse to get patient consent before AI records or analyzes an encounter, and require written notice that AI supports but does not replace the nurse. Health care entities employing nurses and deploying AI in direct patient care would have to keep validation and bias monitoring records, train nurses, and not rely solely on AI for staffing, triage, admission, discharge or transfer decisions. Introduced February 5, 2026; re-referred to Assignments May 22, 2026 under Senate Rule 3-9(a); it has not passed either house.
Relating to criminalizing the use of deep fakes
West Virginia's HB 5516 (2024 regular session, committee substitute) would have made it a crime to knowingly and intentionally disclose, or threaten to disclose, an image showing a person's intimate parts or sexually explicit conduct (including a deep fake) with intent to harass, intimidate, threaten, humiliate, embarrass or coerce. A first offense would be a misdemeanor and a repeat offense a felony. It also would have added deep fakes to the definition of visual portrayal in the minors sexual-conduct article. It passed the House on February 27, 2024 and died in Senate Judiciary.
ILLINOIS PRIVACY RIGHTS ACT
Illinois's HB 5581 (103rd General Assembly) would have created the Illinois Privacy Rights Act, giving consumers rights to access, correct, delete and obtain a copy of their personal data and to opt out of targeted advertising, sale, or profiling in furtherance of solely automated decisions with legal or similarly significant effects. It would apply only to entities above specified consumer-data thresholds. Died at Session Sine Die on January 7, 2025.
Extends crime of identity theft to include fraudulent impersonation or false depiction by means of artificial intelligence or deepfake technology.
New Jersey's A3912 would extend the identity theft crime to impersonating or falsely depicting another person by means of AI or deepfake technology. A 'false personation record' is computer-generated or substantially manipulated media or text that appears to show a real person doing something they did not do, without consent, and is substantially likely to cause perceptible individual or societal harm. Grading follows the benefit or number of victims: fourth degree for one victim up to second degree for five or more. Introduced February 27, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Arbitration; divorce proceedings; artificial intelligence
Arizona's HB 2371 (2026) would have added A.R.S. 25-332, letting parties to a divorce proceeding use artificial intelligence-assisted arbitration only if both give written consent, including on whether the result is a recommendation or a binding determination, and they share no minor children. It passed the House 42-13 on March 10, 2026, was held in the Senate after Senate Rules found it proper for consideration on March 30, and died when the 2026 session ended June 13, 2026.
An Act Prohibiting The Creation And Dissemination Of Intimate Images Generated Using Artificial Intelligence And Without Consent.
Connecticut's SB 1143 (2025) was a short proposed bill with no operative text, stating its intent to prohibit the creation and dissemination of AI-generated intimate images without the consent of the person depicted by amending C.G.S. 53a-189c, establish criminal penalties and civil remedies, and define "deepfake technology" and "intimate image". It was referred to the Judiciary Committee on January 23, 2025 and died when the 2025 session ended.
Extends crime of identity theft to include fraudulent impersonation or false depiction by means of artificial intelligence or deepfake technology.
New Jersey's S736 would extend the identity theft crime to impersonating or falsely depicting another person by means of AI or deepfake technology. A 'false personation record' is computer-generated or substantially manipulated media or text that appears to show a real person doing something they did not do, without consent, and is substantially likely to cause perceptible individual or societal harm. Grading follows the benefit or number of victims: fourth degree for one victim up to second degree for five or more. Pre-filed for the 2024 session. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Prohibits deepfake pornography and imposes criminal and civil penalties for non-consensual disclosure.
New Jersey's S976 would make it a third-degree crime to disclose deceptive audio or visual media (deepfakes) depicting sexual activity or intimate parts without the person's consent, with a fine of up to $30,000. It would also treat such media depicting a child as child sexual exploitation material with the same penalties as other such items, and give the depicted person a civil action in Superior Court with at least $1,000 liquidated damages per violation. Pre-filed for the 2024 session. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Artificial intelligence; use of systems for student instruction.
Virginia's HB 1186 adds Code § 22.1-20.2:1. The Department of Education, consulting school divisions and stakeholders, must compile how public schools use AI for instruction and post guidance for its safe, ethical and equitable use. The guidance covers student data privacy (FERPA, COPPA), teacher training, transparency, data agreements that bar using student or division data to train outside AI models, and bias, and must ensure approved AI uses give teachers access to transcripts of students' AI interactions. School boards must adopt policies following it. If funded, the Department runs an AI pilot program; that authority expires July 1, 2030. Identical to SB 394; effective July 1, 2026.
Adopt the Agricultural Data Privacy Act and the Conversational Artificial Intelligence Safety Act
Nebraska's LB 525 creates the Conversational Artificial Intelligence Safety Act, operative July 1, 2027, and an Agricultural Data Privacy Act. Operators of public AI chat services must tell minors they are talking to AI, take reasonable measures to prevent sexual content and claims of being human, sentient or emotionally or romantically attached for minors, offer privacy and parental tools, disclose AI to anyone who could be misled, keep a suicide and self-harm referral protocol, and not claim to provide mental health care. The Attorney General enforces: at least $1,000 per violation, up to $500,000 per operator. Signed April 14, 2026.
AN ACT relating to privacy protection.
Kentucky's HB 58 (2026) makes it unlawful for anyone, including the state and local governments, to use automated license plate readers (ALPRs: high-speed cameras plus data processing that turn vehicle and plate images into computer-readable data) except for listed purposes such as parking, secured-area access, public safety and auto theft, law enforcement, commercial vehicle enforcement and tolls. Captured data generally may not be kept over 90 days or sold or shared, with exceptions for police, insurers and lenders. Violations carry fines of $20 to $2,000, up to one year in jail, or both. Signed April 10, 2026 (Acts Ch. 71).
Data Privacy - Consumer Data, Public Records, and Message Switching System (Data Privacy Act)
HB711 prohibits the sale of consumer data to governmental units engaged in civil immigration enforcement unless required by law.
Regulates use of artificial intelligence enabled video interview in hiring process.
New Jersey's S3015 would require an employer that asks applicants for video interviews and uses AI to analyze them to notify the applicant, explain how the AI works and what characteristics it evaluates, and obtain written consent first. Employers would have to delete interviews within 30 days of a request and report applicants' race and ethnicity data annually to the Department of Labor and Workforce Development. Violations would carry a $500 civil penalty for a first offense and $1,000 for each later one. Introduced April 8, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Education; institute initiatives to promote literacy in math, reading, finance, computer science, and civics.
Mississippi's SB 2294 is a broad education act: the Mississippi Math Act (the Moving Mathematics in Mississippi program), reading interventions for grades 4-8, financial literacy and civics requirements, and the Mississippi Future Innovators Act. Its AI provision is in the last: starting with the ninth-grade class entering in 2029-2030, public high school students must earn a computer science credit (or a career and technical course with embedded computer science) to graduate, and that course must teach emerging technologies such as AI, including what AI is, how it works and its impact on society. Approved April 8, 2026 (Chapter 479); effective July 1, 2026.
Prohibits use and sale of algorithmic devices that set sale price of goods or services.
New Jersey's A 4685 (as introduced) would make it unlawful for a business entity to use, sell, distribute, develop, transfer or otherwise make available an algorithmic device, meaning software that uses algorithms on a consumer's personal data to recommend or set the sale price of goods or services. The Attorney General could sue for damages, injunctive relief, restitution and civil penalties up to $1,000 per violation. Introduced March 16, 2026 and referred to the Assembly Consumer Affairs Committee; it has not passed either house.
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's SB2215 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: HB 2608. Not passed before the session ended in April 2026; last action: Assigned to General Subcommittee of Senate Judiciary Committee (March 23, 2026).
"Social Media Fairness and Transparency Act"; establishes requirements for social media companies concerning content moderation practices; establishes cause of action against social media companies for violation of content moderation practices.
New Jersey's A4768, the Social Media Fairness and Transparency Act, would require large social media companies to publish their content-moderation standards and the keywords used to censor or prioritize posts, let users opt out of algorithmic post prioritization, and notify users when their content is censored. Violations would be consumer fraud violations, with a private right of action (up to $100,000 in statutory damages per claim). Introduced and referred to the Assembly Science, Innovation and Technology Committee on March 19, 2026; it has not passed either house.
James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (Division G, Title LXXII, Subtitle B: Advancing American AI Act)
Subtitle B of Title LXXII of Division G of the FY2023 NDAA is the Advancing American AI Act. OMB guidance under the AI in Government Act must consider responsible-AI practices and civil rights and privacy protections (sec. 7224). For five years each agency must keep an inventory of its AI use cases, share it, and publish it where practicable (sec. 7225). OMB must identify new AI use cases and run pilot projects (sec. 7226), and the Act supports small-business engagement in agency AI work (sec. 7227). Intelligence community elements are exempt (sec. 7228). The rest of the NDAA is outside this entry.
AN ACT to amend Tennessee Code Annotated, Title 29; Title 45; Title 47 and Title 66, relative to algorithmic pricing.
Tennessee's HB1468 (114th General Assembly) would have barred an entity from setting the price of a specific good or service for a consumer in Tennessee using personalized algorithmic pricing, meaning dynamic pricing set by an algorithm that uses personal data. A violation would have been an unfair or deceptive act under the Tennessee Consumer Protection Act of 1977. Insurers, certain financial institutions and some subscription prices were exempt. Companion: SB 1807. Not passed before the session ended in April 2026; last action: Sponsor(s) withdrawn. (March 18, 2026).
Companion Artificial Intelligence Chatbots
Not law: died in committee. SB 1344 would have required operators of companion AI chatbots in Florida (bots built mainly to simulate friendship, companionship, emotional or therapeutic conversation) to require user accounts and verify every user's age, freezing existing accounts on July 1, 2026 until verified. Minors would have needed a verified parental account and parental consent and been blocked from bots that suggest sexually explicit communication, and every user would have seen a pop-up at the start and every 60 minutes saying they are not talking to a human. It died in the Senate Commerce and Tourism Committee on March 13, 2026.
Enacts the preventing algorithmic pricing discrimination act
New York's S 7033 would have enacted the Preventing Algorithmic Pricing Discrimination Act. Anyone who knowingly advertised or published personalized algorithmic pricing based on a person's consumer data would have had to disclose "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA" (new General Business Law § 349-a), and General Business Law § 396 would have barred using protected class data in pricing. The Attorney General could seek penalties of up to $1,000 per violation. The Senate struck the enacting clause on April 15, 2026.
AN ACT to amend Tennessee Code Annotated, Title 28 and Title 39, Chapter 17, relative to the unauthorized use of deepfake or actual likeness.
Tennessee's SB 1346, the Preventing Deepfake Images Act (Tenn. Code § 39-17-1901 et seq.), lets a person shown in an intimate digital depiction (a realistic digitally created or altered image appearing to show them nude or in sexual conduct) sue anyone who intentionally discloses it knowing, or recklessly disregarding, that they did not consent. Remedies: the defendant's gains, actual or $150,000 liquidated damages, punitive damages and fees. Disclosing or threatening to disclose one to harass or harm is a Class E felony (Class C if reasonably expected to affect a government proceeding or election, or to facilitate violence). Signed May 9, 2025 (Public Chapter 466); effective July 1, 2025.
Directs the commissioner of education to conduct a study on the use of biometric identifying technology; prohibits the use of biometric identifying technology in schools until July 1, 2022 or until the commissioner authorizes such purchase or utilization, whichever occurs later.
New York's A 6787-D barred public and nonpublic elementary and secondary schools, including charter schools, from buying or using biometric identifying technology until July 1, 2022 or until the Commissioner of Education authorized it after a public report, whichever was later. As signed it added Education Law § 2-e; Chapter 2 of 2021 moved it to State Technology Law § 106-b, had the Office of Information Technology Services write the report, and allowed employee fingerprinting and consenting-employee uses. In September 2023 the Commissioner banned facial recognition in schools and left other biometrics to local decision. Signed December 22, 2020 (Chapter 349); effective immediately.
Relating to requirements that apply to persons that process consumer personal data.
Oregon's HB 3899 (2025) would have amended the Oregon Consumer Privacy Act. It would have lowered the applicability thresholds in ORS 646A.572 from 100,000 to 35,000 consumers, and from 25,000 consumers with 25 percent of gross revenue from selling personal data to 10,000 consumers with 20 percent. It would have barred controllers from selling sensitive data for any reason and from processing sensitive data for targeted advertising or for profiling a consumer, and required processing to stop no later than 15 days after a consumer revokes consent. It remained in the House Committee on Commerce and Consumer Protection when the 2025 session adjourned on June 27, 2025.
ALGORITHMIC PRICING
Illinois's HB 4544 would create the Preventing Algorithmic Pricing Discrimination Act. Anyone who knowingly advertises personalized algorithmic pricing based on a person's consumer data would have to state that the price was set by an algorithm using the person's personal data, and pricing could not use protected class data to deny or vary offers. Filed January 22, 2026; referred to the House Rules Committee January 30, 2026 (co-sponsor added February 18, 2026); it has not passed either house.
Establishes regulations regarding the use of artificial intelligence in mental health care treatments.
Rhode Island's Oversight of Artificial Intelligence Technology in Mental Health Care Act bars any person or company from offering therapy or psychotherapy to the public, including through internet AI, unless a licensed professional provides it. Licensed professionals may not let AI make independent therapeutic decisions, set treatment plans, or talk with clients therapeutically outside an established care relationship, and need written informed consent before using emotionally bonding AI or AI companions on recorded or transcribed sessions. FDA-cleared tools, religious counseling, peer support and approved research are exempt. Effective June 22, 2026.
Enacts the "facial recognition technology study act" to study privacy concerns and potential regulatory approaches to the development of facial recognition technology.
New York's A 2642 (the "facial recognition technology study act") would have created a seven-member task force to study the proper regulatory approach to facial recognition technology: privacy concerns, regulation by other jurisdictions, misuse, and the best administrative methods. It would report to the governor and legislature within one year of the act's effective date. Introduced January 26, 2023 and referred to the Governmental Operations Committee (again January 3, 2024); it died at the end of the 2023-2024 session.
An act relating to regulating the use of artificial intelligence in the provision of mental health services
Act 156 bars a corporation or other entity from providing, advertising or offering mental health services to the public, including through AI, unless the services are provided by a licensed mental health professional or are part of an approved institutional review board or privacy board study. Professionals may still use HIPAA-compliant AI tools if they review and approve the services, and FDA-authorized digital therapeutics prescribed or recommended by a professional are allowed. Violations by entities are enforced under the Consumer Protection Act, including by private suits. Effective June 17, 2026.
Digital replicas.
California's SB 1111 clarifies that the voice or likeness protected by Civil Code § 3344, the right to sue over knowing use of a person's name, voice, signature, photograph or likeness on products or in advertising without consent, includes a digital replica: a computer-generated, highly realistic representation readily identifiable as a person's voice or visual likeness. It drops the presumption that using an employee's incidental likeness without consent was not knowing. New Penal Code § 540 makes using a digital replica with intent to impersonate someone false impersonation for crimes such as §§ 528.5, 529 and 530. Signed September 30, 2026 (Chapter 862); effective January 1, 2027.
BETTER SOCIAL MEDIA FEEDS ACT
Illinois's SB 3454 (104th General Assembly) would create the Better Social Media Feeds Act. A covered online platform deploying an algorithmic recommender system would have to prominently list each system, describe its inputs and the weights used, and configure systems that use personal data by default to maximize one or more long-term user value metrics. It would take effect January 1, 2027. Last action: re-referred to Assignments May 22, 2026.
Includes "deep fake" images created by digitization within the definition of unlawful dissemination or publication of an intimate image.
New York's S 1042-A extends the crime of unlawful dissemination or publication of an intimate image (Penal Law § 245.15), a class A misdemeanor, to images created or altered by digitization, meaning realistically altered using images of another person or computer-generated images. It is a crime to intentionally disseminate or publish, with intent to harm a person's emotional, financial or physical welfare, an image of that identifiable person with intimate parts exposed or engaged in sexual conduct with another person, when the actor knew or reasonably should have known the person did not consent. Signed September 29, 2023 (Chapter 513); effective November 28, 2023.
Prohibits the use of biometric identifying technology in schools for any reason other than specified purposes.
New York's S 7944 (2023-2024) would have amended State Technology Law § 106-b to prohibit public and nonpublic elementary and secondary schools, including charter schools, from purchasing or using biometric identifying technology for any purpose, replacing the earlier temporary bar. Schools could still use it for fingerprint identification of prospective employees as education law requires and to identify employees who consent in writing. Referred to Internet and Technology January 4, 2024, reported and committed to Education May 7, 2024; it died when the 2023-2024 session ended.
Consumer Protection - Workgroup on Artificial Intelligence Implementation
Maryland's HB 956 creates the Workgroup on Artificial Intelligence Implementation: legislators, the Attorney General, the Maryland Technology Development Corporation CEO and appointed industry, academic, labor, civil rights, privacy, consumer and cybersecurity representatives. It monitors and makes recommendations on AI, including regulating AI used in decisions that significantly impact people's livelihood and life opportunities, developer and deployer obligations, consumer rights and disclosures, Attorney General enforcement and AI in government benefit decisions, and reports yearly from July 1, 2026. Approved April 22, 2025 (Chapter 105); effective July 1, 2025; ends June 30, 2029.
Enacts the New York artificial intelligence bill of rights to provide residents of the state with rights and protections to ensure that any system making decisions without human intervention impacting their lives do so lawfully, properly, and with meaningful oversight.
New York's S 8209 (2023-2024) would have added State Technology Law Article IV (§§ 401-409), the New York artificial intelligence bill of rights. New York residents would have rights to safe and effective automated systems, protection from algorithmic discrimination, data privacy, notice and explanation, and a human alternative. Operators violating the rights would be liable for a penalty of not less than three times the damages caused, enforced by the Attorney General; there is no private right of action. Referred to Internet and Technology January 12, 2024; it died when the 2023-2024 session ended.
Prohibits the creation and dissemination of synthetic media within sixty days of an election with intent to unduly influence the outcome of an election; makes such act a class E felony.
New York's S 8400-A (2023-2024) would have added Election Law § 17-172 making it a class E felony to create, or cause to be created, synthetic media and disseminate or publish it within sixty days of an election with intent to injure a candidate or unduly influence the outcome. It excluded commentary, parody, news reporting and media made with consent. Amended January 30, 2024 and left in the Elections Committee; it died when the 2023-2024 session ended.
Establishes the position of chief artificial intelligence officer and such person's functions, powers and duties; including, but not limited to, developing statewide artificial intelligence policies and governance, coordinating the activities of any and all state departments, boards, commissions…
New York's S 9104 (2023-2024) would have created the position of chief artificial intelligence officer, appointed by the governor with Senate advice and consent, and an office that would develop statewide AI policy and a risk management plan, coordinate agency AI procurement, audit agency AI use and report annually to legislative leaders; an advisory committee would be created. Passed the Senate June 4, 2024 (61-0) and went to the Assembly Governmental Operations Committee, where it died when the 2023-2024 session ended.
Provides relative to the regulation of artificial intelligence (OR +$256,243 GF EX See Note)
Louisiana's HB791, the People's A.I. Act, would have regulated AI chatbot providers: consent before processing personal data or training on chat logs, no selling chat logs, a ban on using chat logs for ads, notices that the user is talking to a chatbot, monthly risk assessments, and treating chatbots as products for liability. The Attorney General or a district attorney could enforce and users could sue. It was referred to House Commerce March 9, 2026 and died.
TO CREATE THE CRIMINAL OFFENSE OF UNLAWFUL CREATION OR DISTRIBUTION OF DEEPFAKE VISUAL MATERIAL; AND TO ESTABLISH A CAUSE OF ACTION FOR UNLAWFUL CREATION OF DEEPFAKE VISUAL MATERIAL.
Arkansas Act 827 of 2025 makes it a crime to knowingly create or distribute, without consent, realistic deepfake images or video showing an identifiable person nude or engaged in sexual conduct: a Class A misdemeanor for a first offense and a Class D felony after that. The Attorney General may sue providers or developers of prompt-based image generation tools used to make such material if they lacked reasonable safeguards, and injured people may sue the tool provider or whoever caused the deepfake, recovering damages and attorney's fees. Approved April 17, 2025; effective August 5, 2025.
Prohibits deepfake pornography and imposes criminal and civil penalties for non-consensual disclosure.
Not law. A 1892 would have made it a crime in New Jersey to disclose sexually explicit deepfakes of a person without consent, with the same penalty as nonconsensual 'revenge porn' (a third-degree crime: 3 to 5 years and up to $15,000), and would have punished deepfakes depicting the sexual abuse of a child like child sexual abuse material. People depicted could also sue for invasion of privacy. The Assembly Science, Innovation and Technology Committee approved it 7-0 on March 4, 2024, but it got no further action before the 2024-2025 session ended. Its Senate twin was S 976.
Artificial Intelligence Modifications
Utah's HB 276 enacts two AI laws. The Digital Voyeurism Prevention Act bars AI image generation services from distributing counterfeit intimate images of a real person without verified consent, requires covered platforms to remove reported images within 48 hours, and lets victims sue, subject to safe harbors. The Digital Content Provenance Standards Act requires large online platforms to show content provenance data and generative AI providers with over 1,000,000 monthly users and capture-device makers (devices made for sale from 2028) to embed latent disclosures; fines up to $2,500 per violation. Signed March 24, 2026; effective January 1, 2027.
IDPH-DIAGNOSTIC ALGORITHM
Illinois's HB 5115 (103rd General Assembly) would have amended the University of Illinois Hospital Act, the Hospital Licensing Act and the Medical Patient Rights Act. Before using a diagnostic algorithm to diagnose a patient, a hospital would have to confirm it is certified by the Departments of Public Health and Innovation and Technology, is as or more accurate than other means, and is not the only diagnosis method available. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
CHATBOT RESPONSE LIABILITY ACT
Illinois's SB 3368 (104th General Assembly) would create the Chatbot Response Liability Act. A chatbot proprietor could not disclaim liability when its chatbot gives materially misleading, incorrect, contradictory or harmful information resulting in financial loss, other demonstrable harm or bodily harm to the user or a third party, would have to give clear notice that users are talking to AI, and would face companion chatbot rules including parental consent for minors. Re-referred to Assignments May 22, 2026.
An act relating to neurological rights and the use of artificial intelligence technology in health and human services
Act 101 states Vermont's intent for the ethical and responsible use of AI in health care and human services and recognizes individual neurological rights, including mental and neural data privacy, freedom of thought, and protection from unauthorized access to or manipulation of brain activity (18 V.S.A. ch. 42C). It adds members to the state Artificial Intelligence Advisory Council, extends the Council to June 30, 2030, and directs it to report by January 15, 2027 on neurological-rights protections, generative AI use by regulated professions, and AI in health insurance utilization review. Effective May 18, 2026.
Consumer Data Privacy Act
Alaska's HB 367 (2026), as the House Judiciary committee substitute CSHB 367(JUD), would have created a consumer data privacy article in AS 45.48 and a data broker registry, amended the social security number laws, and made certain violations unfair or deceptive trade practices. It would have applied to businesses that collected or processed the data of at least 35,000 consumers (or 10,000 consumers with over 20 percent of gross revenue from selling data). It was referred to House Finance on May 12, 2026 and died when the session ended May 20, 2026.
Relating To Artificial Intelligence.
Hawaii's HB 2137 (Act 247 of 2026) adds a new HRS chapter making it unlawful to knowingly publish a realistic digital imitation (a highly realistic AI-generated depiction, audio or video of a real person's voice, face or likeness in a work they did not perform in) without the person's express written consent if it is used in an advertisement, causes harm, or is used for fraud, defamation, harassment or other crimes. Parody, satire, commentary, news and documentaries are exempt. The person or their estate (up to 10 years after death) may sue for an injunction, up to $25,000 per advertisement or actual damages, punitive damages if malice is proven, and fees. Act 247; effective July 14, 2026.
Artificial Intelligence and Therapy or Psychotherapy
South Carolina's S 788 (committee-amended text of April 28, 2026) would add Chapter 86 to Title 40. A licensed professional could not use AI for supplementary support in therapy where the session is recorded or transcribed unless the patient is told in writing that AI will be used and why and gives written consent. No one could knowingly and intentionally offer therapy to the public, including through internet-based AI, unless a licensed professional conducts it, and professionals could not let AI make independent therapeutic decisions. Licensing boards would assess civil penalties up to $10,000 per violation. It passed the Senate and is in a House committee; not enacted.
Artificial Intelligence Bill of Rights
Not law: passed the Senate but died in the House. Florida's SB 2-D (2026 special session D) would have created an "Artificial Intelligence Bill of Rights" (new part IX of ch. 501, F.S.): parental consent and parental controls for minors on companion chatbot platforms, an hourly pop-up telling users a bot is not human, limits on selling AI users' personal data, an AI-image consent rule for commercial use of name, image or likeness, rules for AI in schools and a ban on state contracts with AI vendors tied to foreign countries of concern. The Senate passed it 37-1 on April 28, 2026; it died in the House Information Technology Budget & Policy Subcommittee on April 29, 2026.
AN ACT CONCERNING THE USE OF ARTIFICIAL INTELLIGENCE AND OTHER MEANS TO GENERATE DECEPTIVE SYNTHETIC MEDIA AND AFFECT ELECTIONS.
Did not pass. HB 5342 would have barred distributing deceptive synthetic media (AI-altered or fake images, audio or video of a person) within 90 days before a Connecticut election or primary, without the person's consent and with intent to injure a candidate or sway the result, unless it carried a 'manipulated' disclaimer. Violations would have been crimes, from a class C misdemeanor to a class D felony for repeat offenses, and the Attorney General, depicted people and candidates could have sued. It cleared two committees but never got a House vote; the page previously showed it as passed by one chamber.
Enacts into law major components of legislation necessary to implement the state transportation, economic development and environmental conservation budget for the 2025-2026 state fiscal year; relates to the waterfront commission act; makes amendments to change "applicant" to "licensee or…
New York's 2025-26 budget bill (Chapter 58 of 2025) includes two AI laws. Part U requires operators of AI companions (AI that simulates a sustained human-like relationship) to make reasonable efforts to detect and address suicidal ideation or self-harm and refer users to crisis services such as 988, and to tell users at the start of an interaction and every three hours that they are not talking to a human; the Attorney General can seek up to $15,000 a day (in effect since November 5, 2025). Part X requires businesses using personalized algorithmic pricing to show 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' (since July 8, 2025).
"Prohibition of Exploitation by Deepfakes Act"; enact.
Mississippi's SB 2437 (2025), the "Prohibition of Exploitation by Deepfakes Act," would have made it unlawful to use an interactive computer service to knowingly publish intimate visual depictions, including AI-made "morphed images," of identifiable individuals in certain circumstances. Per its title it would also have required covered platforms to run a notice-and-removal process. It was referred to Judiciary, Division B on January 20, 2025, and died in committee on February 4, 2025.
Artificial intelligence; definitions; establishing the rights of Oklahomans when interacting with artificial intelligence; effective date.
Oklahoma's HB 3453 (2024), as engrossed, would define artificial intelligence and declare that Oklahomans have rights when dealing with it: to know when they interact with AI in consequential exchanges or consume realistic content generated entirely by AI without human review, to rely on watermarks and content credentials, to consent to AI recreations of their voice or likeness, and to be free from algorithmic discrimination. It passed the House 89-0 on March 14, 2024 and was referred to Senate Judiciary March 27, 2024; it died when the 2024 session ended without Senate passage.
Senate Impact of Social Media and Artificial Intelligence on Children and Platform Privacy Protection Study Committee; create
Georgia's SR 431 is a Senate resolution, adopted 52-0 on April 2, 2025, that created the Senate Impact of Social Media and Artificial Intelligence on Children and Platform Privacy Protection Study Committee: five senators named by the President of the Senate, with majority- and minority-party cochairs, to study social media's and AI's effects on children (including AI chatbots that engage children in obscene conversations) and how online privacy protections can be strengthened, and to recommend action or legislation. The committee stood abolished December 1, 2025. As a resolution of one chamber, it does not change the law.
Consumer Protection - Artificial Intelligence Toys (Artificial Intelligence Toy Safety Act)
Maryland's HB 1261 (2026, the Artificial Intelligence Toy Safety Act, first reader text) would have set rules for toys that use AI and are marketed to or mainly used by children: no sexual, violent or emotionally manipulative content, verified parental consent, limits on child data, pre-sale and annual safety assessments, AI labels, and a civil penalty up to $50,000 per violation plus mandatory recall. It had a House Economic Matters hearing set for March 3, 2026 and died when the 2026 session ended.
Establishes the position of chief artificial intelligence officer and such person's functions, powers and duties; including, but not limited to, developing statewide artificial intelligence policies and governance, coordinating the activities of any and all state departments, boards, commissions…
New York's A 1205 would amend the State Technology Law to create a chief artificial intelligence officer, appointed by the Governor with the advice and consent of the Senate, who would set state AI and automated decision-making policy, coordinate agencies' AI use, audit that use, recommend deactivating harmful applications and report annually to the legislature. It would also create an Advisory Committee for State Artificial Intelligence Policy. Referred to Governmental Operations January 7, 2026; it has not passed either chamber.
Artificial Intelligence Bill of Rights
Not law: passed the Senate but died in the House when the session ended. Florida's CS/SB 482 (2026), the "Artificial Intelligence Bill of Rights," would have required parental consent and controls for minors on companion chatbot platforms, an hourly not-human notice from bot operators, deidentified data for any sale of user data by AI companies, consent for generative-AI likenesses, and rules for AI tools in schools. The Senate passed it 35-2 on March 4, 2026; it died in House Messages on March 13, 2026.
Artificial intelligence technology.
Vetoed. California's SB 11 would have required anyone offering consumers AI technology that can create a digital replica to post, by December 1, 2026, a warning that unlawful use to depict another person without consent may bring civil or criminal liability, with civil penalties up to $10,000 a day. It would also have counted digital replicas as a voice or likeness under the right-of-publicity law, treated impersonation by digital replica as false impersonation, and had the Judicial Council address AI-generated evidence by January 1, 2027. Vetoed by Governor Newsom October 13, 2025; veto sustained March 2, 2026.
Artificial intelligence; establishing certain rights; prohibiting certain actions by certain entities; requiring certain actions by certain entities. Effective date.
Oklahoma's SB 2085 (2026), as introduced, would, per the official bill summary, have barred the state from accepting bids from or renewing contracts with AI technology providers that do not attest they are not foreign-owned or foreign-adversary controlled, required AI companies to de-identify user data before selling it, restricted commercial use of a person's generative-AI likeness without consent, and set parental-consent rules for companion chatbots and minors. It was referred to a Senate committee February 3, 2026 and died when the session ended May 14, 2026.
Crimes and punishments; sexual obscenity; making certain acts unlawful; effective date.
Oklahoma's HB 1364 (2025) adds AI-made sexual images to the crime of nonconsensual dissemination of private sexual images. An artificially generated sexual depiction is an image that appears to authentically show a person nude or in sexual conduct that did not happen, produced mainly by technical means such as artificial intelligence or photo editing software. Sharing one of another person without their effective consent, intending or recklessly disregarding that it will harass, threaten or cause physical, emotional, reputational or economic harm, is a misdemeanor; sharing three or more within six months is a felony punishable by up to ten years. Effective November 1, 2025.
An act relating to regulating the use of artificial intelligence in the provision of mental health services
Vermont's H.644 (2026) would have barred anyone from offering, providing or advertising mental health services in Vermont that use AI in whole or in part, and barred mental health professionals from using AI for therapeutic decisions or communications, treatment plans, or detecting emotions. AI could be used for administrative support and, with written notice and consent, transcription. Violations of the ban would have been Consumer Protection Act violations carrying a $10,000 civil penalty each. Referred to House Health Care January 13, 2026; died. Senate companion S.241 also died.
An act relating to regulating the use of artificial intelligence in the provision of mental health services
Vermont's S.241 (2026) would have barred anyone from offering, providing or advertising mental health services in Vermont that use AI in whole or in part, and barred mental health professionals from using AI for therapeutic decisions or communications, treatment plans, or detecting emotions. AI could be used for administrative support and, with written notice and consent, transcription. Violations of the ban would have been Consumer Protection Act violations carrying a $10,000 civil penalty each. Referred to Senate Health and Welfare January 13, 2026; died. A House companion, H.644, also died.
Artificial intelligence; statewide education program
Died in the Senate. The 'Getting Arizona Ready for AI Act' would have created a voluntary Arizona Artificial Intelligence Education Program in the Department of Education: a summer course open to any resident, teaching digital hygiene (algorithmic bias, data privacy, spotting AI-generated misinformation) and practical AI skills for small businesses. Public schools, universities and community colleges could have awarded credit for it. It passed the House but was held in the Senate and died when the Legislature adjourned on June 13, 2026.
Artificial intelligence; use of systems for student instruction.
Virginia's SB 394 adds Code § 22.1-20.2:1. The Department of Education, consulting school divisions and stakeholders, must compile how public schools use AI for instruction and post guidance for its safe, ethical and equitable use. The guidance covers student data privacy (FERPA, COPPA), teacher training, transparency, data agreements that bar using student or division data to train outside AI models, and bias, and must ensure approved AI uses give teachers access to transcripts of students' AI interactions. School boards must adopt policies following it. If funded, the Department runs an AI pilot program; that authority expires July 1, 2030. Identical to HB 1186; effective July 1, 2026.
Artificial intelligence; requiring informed consent for use by licensed mental health professional or health care provider; authorizing and prohibiting certain uses. Emergency.
Oklahoma's SB 2037 (2026), as introduced, would have required a licensed mental health professional to inform a patient in writing and get consent before using AI for supplementary support in recorded or transcribed therapy sessions, allowed AI for administrative or supplementary support if the professional stays responsible, and barred professionals from letting AI make independent therapeutic decisions. It was referred to a Senate committee February 3, 2026 and died when the session ended May 14, 2026.
Identity Protection Modifications
Utah SB 256 (2026) applies defamation law to deepfakes and strengthens likeness rights. It is not a defense to libel or slander that content was created with generative AI, computer animation or digital manipulation. Before suing over digitally created content, a plaintiff must give the publisher written notice, and removal within 10 days limits recovery to actual damages. It establishes an exclusive right to consent to use of one's identity and extends the Abuse of Personal Identity Act, as amended by 2025 SB 271, to distributing or trafficking in identity-replication tools, with exemptions. Effective May 6, 2026.
Establishes regulations regarding the use of artificial intelligence in mental health care treatments.
Rhode Island H 7349 Substitute A (2026), enacted as Chapter 373, the Oversight of Artificial Intelligence Technology in Mental Health Care Act, adds chapter 40.1-5.5. Providers may use AI only for administrative or supplementary support, may not let AI make independent therapeutic decisions or determine treatment plans, and need written patient consent for certain AI use. Only licensed professionals may offer therapy to the public. Enacted June 22, 2026; effective upon passage.
Disclosure of Intimate Images
South Carolina's H. 3058 (Act No. 37 of 2025) creates the crime of unauthorized disclosure of intimate images (S.C. Code §§ 16-15-330, 16-15-332), covering real images and "digitally forged intimate images" made or substantially modified with machine learning or other computer means, even if labeled as fake. Intentionally sharing one without the person's effective consent is a felony if meant to cause harm or for profit (first offense up to $5,000 and/or 5 years; later offenses up to $10,000 and/or 1 to 10 years) and otherwise a misdemeanor for a first offense. Signed May 12, 2025; effective on approval.
To establish a commission to investigate AI in education
Not law. S 429 would have created a commission in the Massachusetts Executive Office of Education to study AI in schools and recommend regulations, limits, standards and safeguards. It would have surveyed how public and private school systems use generative AI and automated decision systems (for grading, scheduling, lesson planning and budgeting), examined bias, transparency, data protection, plagiarism and a possible watermark requirement, and produced guidelines for ethical use. On December 4, 2025 it was sent to a study order (S 2792), ending it for the 2025-2026 session.
Creates penalties for likenesses altered or created by artificial intelligence being used for commercial gain; establishes a private right of action for the unlawful dissemination of still or video images generated by artificial intelligence.
New York's S 8721 would add Civil Rights Law § 50-h, barring use of a person's likeness altered or created by software, machine learning or AI for products, merchandise, advertising or solicitation without prior consent, with liability of the greater of $2,000 or compensatory damages plus profits. It would also add § 52-e, a private right of action over dissemination of digitized private images. Referred to Codes January 7, 2026; it has not passed either chamber.
No Robot Bosses Act
The federal H.R. 6371 (No Robot Bosses Act) would bar employers from relying exclusively on an automated decision system for an employment-related decision, and from using its output unless it was tested before use and at least annually for discrimination, disclosed to the individual, overseen by a human, explained in writing within 7 days and open to dispute and appeal. Employees could opt out of being managed by such a system. Enforcement would be by the Labor Secretary, private lawsuits and State attorneys general. Introduced December 3, 2025 and referred to three House committees; no further action.
Adopt the Age-Appropriate Online Design Code Act
Nebraska's LB 504 (2025), the Age-Appropriate Online Design Code Act, applies to covered online services that know a user is a minor. Among the tools a service must give each covered minor, it must let the minor control personalized recommendation systems, defined as fully or partially automated systems that suggest, promote or rank content based on users' personal data, by opting in to a chronological feed or preventing categories of content from being recommended. It also requires tools to limit engagement-boosting design features such as infinite scroll and notifications, and to limit in-game purchases. Approved May 30, 2025; operative January 1, 2026.
Consumer Data Protection Act; social media platforms & model operators, interoperability interfaces.
Virginia's SB 85 (2026 Regular Session) would have required social media platforms and operators to build third-party interoperability interfaces letting users share social graph data and contextual data tied to AI systems, as the user designates. It passed the Senate 40-0 on February 10, 2026 but was tabled in House committee on March 9, 2026.
An act relating to an age-appropriate design code
Vermont's S.69 (Act 63 of 2025) is the state's age-appropriate design code for online services likely to be used by minors. Its algorithm provision, 9 V.S.A. § 2449e, requires a covered business to prominently disclose the purpose of each algorithmic recommendation system it uses (a system that uses an algorithm to select, filter and arrange media to recommend or prioritize it for a user) and, for each input, how it is measured, how it uses minors' personal data, how it influences recommendations and how it is weighted. The act also limits data practices and design features for minors. It takes effect January 1, 2027; rulemaking provisions took effect July 1, 2025.
Establishes the "AI-Generated Content Accountability and Privacy Protection Act of 2026"
Missouri's HB 2321 (AI-Generated Content Accountability and Privacy Protection Act of 2026), as introduced, would make it a crime to knowingly publish or distribute algorithmically generated or altered content depicting a person without that person's consent (up to two years or $20,000, or both), with higher penalties for sexual content or distribution through online platforms, and exceptions for art, parody, satire and research. A House committee substitute was reported do pass on February 26, 2026 (filed under primary bill HB 1887; not reviewed here), but the bill died when the 2026 regular session ended in May 2026 without being truly agreed to and finally passed.
Youth AI Privacy Act
The federal S. 4199 (Youth AI Privacy Act), as introduced, would require AI chatbot deployers that know a user is a minor to disclose that the user is talking to an AI, bar profiling, advertising and training on minors' data, and have the FTC write rules against compulsive-use features. The Commerce Committee ordered it reported with a substitute August 5, 2026; the substitute text is not yet published, and the bill has not passed either chamber.
Enacts the "facial recognition technology study act" to study privacy concerns and potential regulatory approaches to the development of facial recognition technology.
New York's A 8788, the "facial recognition technology study act," would create a seven-member task force (two appointed by the governor, two by the senate temporary president, two by the assembly speaker, one by the director of the office of information technology services) to study the proper regulatory approach to facial recognition technology, including privacy concerns and misuse, and report to the governor and legislature within one year of the effective date. It regulates no one. Would take effect immediately. Referred to Governmental Operations June 5, 2025 (and January 7, 2026); it has not passed either chamber.
Preventing Deepfakes of Intimate Images Act
The federal H.R. 1941 (Preventing Deepfakes of Intimate Images Act) would let the subject of a digitally manipulated intimate depiction sue anyone who discloses it without consent, with $150,000 in liquidated damages, and make it a federal crime to disclose or threaten to disclose one with intent to harass or to cause harm: up to 2 years in prison, or up to 10 in certain cases. Introduced March 6, 2025 and referred to the House Judiciary Committee; no further action.
Consumer Protection and Product Liability - Chatbots
Maryland's SB 827 (2026, first reader text, cross-filed with HB 1250) would have regulated operators and developers of generative AI chatbots made available to Maryland users: affirmative consent for training on input data, a ban on using chat logs for advertising, a 10-year cap on chat log retention, protections for users under 13, hourly not-human warnings, monthly safety testing, and product liability with possible strict liability. It had a Senate Finance hearing set for March 12, 2026 and died when the 2026 session ended.
AI WORK TRANSITION COMMISSION
Illinois's HB 5760 (104th General Assembly) would create the Commission on Artificial Intelligence and Workforce Transition Act. The Commission would direct State agencies to assess the actual and projected impact of generative and frontier AI systems on Illinois industries, occupations, regions and workers, and make recommendations on State and federal workforce, education, apprenticeship, unemployment insurance and income support programs. The Act would be repealed January 1, 2034. Last action: referred to the House Rules Committee May 5, 2026.
23 Asilomar AI Principles.
California's Assembly Concurrent Resolution 215 expresses the Legislature's support for the 23 Asilomar AI Principles as guiding values for the development of artificial intelligence and of related public policy. The principles, drafted at a January 2017 meeting of AI researchers and others in Asilomar, California, cover research issues, ethics and values (such as safety, failure transparency, personal privacy and human control) and longer-term issues (such as catastrophic risks and recursive self-improvement). Adopted by the Assembly June 25, 2018 and the Senate August 30, 2018; filed September 7, 2018 (Res. Chapter 206). A concurrent resolution does not change the law.
Artificial Intelligence Bill of Rights
Florida's SB 2-D (2026 special session D), the Artificial Intelligence Bill of Rights, would have required companion chatbot platforms to get parental consent before a minor holds an account, required bots to tell users hourly that they are not talking to a human, barred AI companies from selling users' personal information unless deidentified, restricted AI tools in schools, and required AI vendors to government to attest they are not owned, controlled or based in a foreign country of concern. It passed the Senate 37-1 on April 28, 2026, was referred in the House to the Information Technology Budget & Policy Subcommittee, and died there on April 29, 2026. It did not become law.
AN ACT relating to protection of information and declaring an emergency.
Kentucky's SB 4 (2025) governs state government's use of AI. The Commonwealth Office of Technology must create an Artificial Intelligence Governance Committee, set standards for agencies' use of generative and high-risk AI, keep a registry of those systems and report yearly. Agencies must disclose AI use to the public, explain AI-driven decisions and offer appeals of consequential decisions. A candidate whose appearance, action or speech is altered with synthetic media in an electioneering communication may sue the sponsor to require a clear disclosure. Signed March 24, 2025 (Acts Ch. 66); emergency act, effective on signing.
State-by-State Regulation of Data Privacy & AI
Artificial intelligence regulation is advancing at the state level. This page lists the 420 published bills we track on Data Privacy & AI. State attorneys general, privacy regulators, and legislatures are developing a patchwork of laws that impose different obligations on businesses deploying AI systems related to this topic. Compliance teams and legal counsel must track both enacted laws and the pipeline of pending bills that could shift requirements at any time.
Obligations differ from bill to bill. Depending on the law, they can include consumer disclosure obligations, prohibition on specific high-risk uses, mandatory algorithmic impact assessments, bias audits, rights to explanation, and human override requirements. Penalties for non-compliance vary by state — use our Penalty Tracker to review enforcement provisions. For upcoming effective dates, see the Deadlines page.
To understand how Data Privacy & AI laws intersect with specific industries, browse our Healthcare, Employment, Insurance, and Financial Services industry trackers. Compare how different state laws approach this topic using our Bill Comparator.