AI compliance for retail and e-commerce

Your regulatory exposure

Companies in Retail and E-Commerce using common AI tools could face up to 67 regulations across 23 states.

• CCPA/CPRA Automated Decision-Making Technology Regulations

  California's ADMT regulations require businesses using automated decisionmaking technology for significant decisions (employment, finance, hou...

  HighEnacted (pending)
• Colorado Privacy Act (CPA profiling and ADM)

  Colorado profiling rules define three tiers: Solely Automated Processing, Human Reviewed Automated Processing, and Human Involved Automated Pr...

  HighIn effect
• Iowa AI-Generated Child Exploitation (SF 2243)

  Treats AI-generated depictions of child exploitation equivalently to real CSAM under Iowa criminal code.

  HighIn effect
• Executive Order 14281: Restoring Equality of Opportunity and Meritocracy

  Directs federal agencies to deprioritize disparate-impact enforcement across civil rights statutes (Title VII, Title VI, ECOA, Fair Housing Ac...

  HighIn effect
• Illinois AI-Generated Child Sexual Abuse Material (HB 4623)

  Clarifies that Illinois child pornography laws encompass AI-generated images of minors in sexual acts. AI-generated CSAM treated identically t...

  HighIn effect

Key obligations

• Transparency notices for AI-driven recommendations
• Opt-out mechanisms for algorithmic profiling
• Disclosure for AI-generated marketing content
• Consumer notification for dynamic pricing algorithms

Risk factors

Upcoming deadlines

• June 9, 2026 · New York Synthetic Performers Disclosure (SB 8420A)
• July 1, 2026 · Connecticut Public Act 25-113 (SB 1295) CTDPA and profiling amendments
• January 1, 2027 · CCPA/CPRA Automated Decision-Making Technology Regulations
• January 1, 2028 · Washington AI Content Disclosure Act (HB 1170)

Related state guides

• California
• Washington
• Illinois
• New York