AI Regulations Tracker

Effective January 1, 2027

CCPA/CPRA Automated Decision-Making Technology Regulations

California's ADMT regulations require businesses using automated decisionmaking technology for significant decisions (employment, finance, housing, education, healthcare) to provide pre-use notices, offer opt-out rights, respond to access requests, and conduct risk assessments with annual CPPA filing under penalty of perjury.

Colorado Privacy Act (CPA profiling and ADM)

Colorado profiling rules define three tiers: Solely Automated Processing, Human Reviewed Automated Processing, and Human Involved Automated Processing. Consumer opt-out applies to tiers 1 and 2. Tier 3 gets enhanced disclosure instead of opt-out. Core profiling provisions effective July 1, 2023. Universal opt-out mechanism compliance required since July 1, 2024. The 60-day cure period for CPA violations expired January 1, 2025, so the Attorney General may pursue enforcement without a cure window (distinct from the Colorado AI Act cure rule). HB 24-1130 added biometric consent requirements effective July 1, 2025. SB 24-041 added minor protections effective October 1, 2025.

Delaware Personal Data Privacy Act - Profiling Provisions

Grants Delaware consumers the right to opt out of profiling for decisions with legal or significant effects. Opt-out limited to profiling in furtherance of solely automated decisions. Impact assessment required for entities processing 100,000+ consumer records (higher threshold than some states for this specific obligation). Unlike most state privacy laws, does not exempt nonprofits or institutions of higher education. Universal opt-out signals required since January 1, 2026.

Maryland Online Data Privacy Act (MODPA), ADM and profiling provisions

Statute effective October 1, 2025, but enforcement does not begin until April 1, 2026. The law does not apply to processing activities before April 1, 2026. Considered one of the strongest state privacy laws due to strict data minimization and a complete ban on selling sensitive data (not only opt-in consent). The threshold of 35,000 consumers is lower than most states. Controllers must handle profiling and automated decision-making with strong consumer protections, including documented risk assessments and opt-out rights. Impact assessments required per algorithm used in high-risk processing. Nonprofits are largely included. Universal opt-out signals required from day one. 60-day cure period with no sunset date in the current statute.

Minnesota Consumer Data Privacy Act - ADM and profiling provisions

Minnesota is the first state privacy law to require controllers to create and maintain a data inventory. The right to question and challenge profiling decisions applies to any decisions with legal or significant effects (broader than the opt-out right, which only applies to automated decisions). Small business exemption (SBA-defined). Separate from this privacy act, Minnesota HF 1370 (election and NCII deepfake criminal and civil provisions) faces an active First Amendment challenge from X (formerly Twitter) over its election deepfake rules; that litigation does not govern CDPA compliance but is relevant context for Minnesota AI and elections risk.

Montana Consumer Data Privacy Act - Profiling Provisions

Grants Montana consumers the right to opt out of profiling for decisions with legal or significant effects. 2025 amendments expanded profiling opt-out scope from solely automated decisions to all automated decisions (removing the solely qualifier). Applicability thresholds lowered: now 25,000 consumers (was 50,000) or 15,000 consumers if 25%+ revenue from data sales (was 25,000).

Nebraska Data Privacy Act - ADM and profiling provisions

Nebraska requires consumer opt-out rights and risk assessments for qualifying profiling and automated decisions with legal or similarly significant effects.

New Jersey Data Privacy Act (Profiling Provisions)

Uniquely covers nonprofits with no revenue threshold. Universal opt-out mechanism (UOOM) requirement effective July 15, 2025 (18 months after enactment), extended to profiling decisions, unique among state privacy laws. Proposed rules would require controller consent before using personal data to train AI models.

Oregon Consumer Privacy Act - Profiling Provisions

Grants Oregon consumers the right to opt out of profiling for decisions with legal or significant effects. Opt-out limited to profiling in furtherance of solely automated decisions (narrower than Colorado, Connecticut, and Montana which have removed the solely qualifier). 2025 amendments (SB 2008, SB 3875) prohibit sale of personal data for consumers under 16 and precise geolocation data (effective October 1, 2025). The Oregon CPA included a 30-day cure window that was not permanent: it ended January 1, 2026, after which the Attorney General is no longer required to provide a cure notice before enforcement.

Rhode Island Data Transparency and Privacy Protection Act - ADM provisions

Rhode Island's privacy framework includes consumer rights tied to profiling and automated decisions, including opt-out and disclosure obligations. Opt-out limited to solely automated decisions. However, Rhode Island defines profiling broadly: human oversight and input into the outcome does not remove processing from the definition of profiling (broader than most states).

Texas Data Privacy and Security Act, Profiling Provisions (HB 4)

Texas comprehensive privacy law with profiling provisions. Requires data protection assessments for profiling that presents a risk of harm. Consumer opt-out for profiling producing legal or similarly significant effects, targeted advertising, and sale of personal data. Universal opt-out mechanism required for covered profiling opt-outs. Broad applicability: no revenue or data volume thresholds (unlike many state privacy laws). Small businesses as defined by the SBA are exempt. The 30-day cure period is permanent with no sunset. Profiling opt-out applies to decisions with legal or similarly significant effects, not all profiling.

Utah Consumer Privacy Act, Profiling Provisions (SB 227)

Utah's comprehensive privacy law. It is the least restrictive state privacy law regarding profiling and ADM among comparable statutes: it includes opt-out for targeted advertising and sale of personal data, but does not include a general profiling opt-out or ADM impact assessment requirement. No universal opt-out mechanism requirement. Trackers sometimes incorrectly list Utah as having ADM provisions similar to other states.

Virginia Consumer Data Protection Act (VCDPA, Profiling Provisions)

Grants Virginia consumers the right to opt out of profiling in furtherance of decisions that produce legal or significant effects. The VCDPA excludes employee and HR data and B2B data from scope; profiling opt-out applies to consumer data only. Permanent 30-day cure period with no sunset: unlike most states, Virginia does not phase out the cure opportunity. Virginia does not require universal opt-out mechanisms (UOOMs). Virginia does not grant the Attorney General rulemaking authority. In March 2025, Governor Youngkin vetoed HB 2094, a comprehensive AI act that would have materially expanded the privacy and AI framework. Virginia is the most business-friendly state privacy law among comparable statutes: permanent cure, no UOOMs, no AG rulemaking, and a high revenue threshold (50% for the 25,000-consumer applicability tier).