Tracking 100 regulations across 24 states and jurisdictions.

AI Regulations Tracker

Every AI and automated decision-making regulation XIRA tracks, organized by state. Every entry verified against enrolled statute text.

Regulation catalog

Database snapshot. 100 regulations, 24 jurisdictions.

Colorado

(1 tracked)

ColoradoIn Effect
Colorado Privacy Act (CPA profiling and ADM)
Colorado profiling rules define three tiers: Solely Automated Processing, Human Reviewed Automated Processing, and Human Involved Automated Processing. Consumer opt-out applies to tiers 1 and 2. Tier 3 gets enhanced disclosure instead of opt-out. Core profiling provisions effective July 1, 2023. Universal opt-out mechanism compliance required since July 1, 2024. The 60-day cure period for CPA violations expired January 1, 2025, so the Attorney General may pursue enforcement without a cure window (distinct from the Colorado AI Act cure rule). HB 24-1130 added biometric consent requirements effective July 1, 2025. SB 24-041 added minor protections effective October 1, 2025.
Effective July 1, 2024Risk weight 8

California

(1 tracked)

CaliforniaUpcoming
CCPA/CPRA Automated Decision-Making Technology Regulations
California's ADMT regulations require businesses using automated decisionmaking technology for significant decisions (employment, finance, housing, education, healthcare) to provide pre-use notices, offer opt-out rights, respond to access requests, and conduct risk assessments with annual CPPA filing under penalty of perjury.
Effective January 1, 2027Risk weight 9

Delaware

(1 tracked)

DelawareIn Effect
Delaware Personal Data Privacy Act - Profiling Provisions
Grants Delaware consumers the right to opt out of profiling for decisions with legal or significant effects. Opt-out limited to profiling in furtherance of solely automated decisions. Impact assessment required for entities processing 100,000+ consumer records (higher threshold than some states for this specific obligation). Unlike most state privacy laws, does not exempt nonprofits or institutions of higher education. Universal opt-out signals required since January 1, 2026.
Effective January 1, 2025Risk weight 5

Maryland

(1 tracked)

MarylandIn Effect
Maryland Online Data Privacy Act (MODPA), ADM and profiling provisions
Statute effective October 1, 2025, but enforcement does not begin until April 1, 2026. The law does not apply to processing activities before April 1, 2026. Considered one of the strongest state privacy laws due to strict data minimization and a complete ban on selling sensitive data (not only opt-in consent). The threshold of 35,000 consumers is lower than most states. Controllers must handle profiling and automated decision-making with strong consumer protections, including documented risk assessments and opt-out rights. Impact assessments required per algorithm used in high-risk processing. Nonprofits are largely included. Universal opt-out signals required from day one. 60-day cure period with no sunset date in the current statute.
Effective October 1, 2025Risk weight 7

Minnesota

(1 tracked)

MinnesotaIn Effect
Minnesota Consumer Data Privacy Act - ADM and profiling provisions
Minnesota is the first state privacy law to require controllers to create and maintain a data inventory. The right to question and challenge profiling decisions applies to any decisions with legal or significant effects (broader than the opt-out right, which only applies to automated decisions). Small business exemption (SBA-defined). Separate from this privacy act, Minnesota HF 1370 (election and NCII deepfake criminal and civil provisions) faces an active First Amendment challenge from X (formerly Twitter) over its election deepfake rules; that litigation does not govern CDPA compliance but is relevant context for Minnesota AI and elections risk.
Effective July 31, 2025Risk weight 7

Montana

(1 tracked)

MontanaIn Effect
Montana Consumer Data Privacy Act - Profiling Provisions
Grants Montana consumers the right to opt out of profiling for decisions with legal or significant effects. 2025 amendments expanded profiling opt-out scope from solely automated decisions to all automated decisions (removing the solely qualifier). Applicability thresholds lowered: now 25,000 consumers (was 50,000) or 15,000 consumers if 25%+ revenue from data sales (was 25,000).
Effective October 1, 2024Risk weight 5

Nebraska

(1 tracked)

NebraskaIn Effect
Nebraska Data Privacy Act - ADM and profiling provisions
Nebraska requires consumer opt-out rights and risk assessments for qualifying profiling and automated decisions with legal or similarly significant effects.
Effective January 1, 2025Risk weight 6

New Jersey

(1 tracked)

New JerseyIn Effect
New Jersey Data Privacy Act (Profiling Provisions)
Uniquely covers nonprofits with no revenue threshold. Universal opt-out mechanism (UOOM) requirement effective July 15, 2025 (18 months after enactment), extended to profiling decisions, unique among state privacy laws. Proposed rules would require controller consent before using personal data to train AI models.
Effective January 15, 2025Risk weight 6

Oregon

(1 tracked)

OregonIn Effect
Oregon Consumer Privacy Act - Profiling Provisions
Grants Oregon consumers the right to opt out of profiling for decisions with legal or significant effects. Opt-out limited to profiling in furtherance of solely automated decisions (narrower than Colorado, Connecticut, and Montana which have removed the solely qualifier). 2025 amendments (SB 2008, SB 3875) prohibit sale of personal data for consumers under 16 and precise geolocation data (effective October 1, 2025). The Oregon CPA included a 30-day cure window that was not permanent: it ended January 1, 2026, after which the Attorney General is no longer required to provide a cure notice before enforcement.
Effective July 1, 2024Risk weight 5

Rhode Island

(1 tracked)

Rhode IslandIn Effect
Rhode Island Data Transparency and Privacy Protection Act - ADM provisions
Rhode Island's privacy framework includes consumer rights tied to profiling and automated decisions, including opt-out and disclosure obligations. Opt-out limited to solely automated decisions. However, Rhode Island defines profiling broadly: human oversight and input into the outcome does not remove processing from the definition of profiling (broader than most states).
Effective January 1, 2026Risk weight 7

Texas

(1 tracked)

TexasIn Effect
Texas Data Privacy and Security Act, Profiling Provisions (HB 4)
Texas comprehensive privacy law with profiling provisions. Requires data protection assessments for profiling that presents a risk of harm. Consumer opt-out for profiling producing legal or similarly significant effects, targeted advertising, and sale of personal data. Universal opt-out mechanism required for covered profiling opt-outs. Broad applicability: no revenue or data volume thresholds (unlike many state privacy laws). Small businesses as defined by the SBA are exempt. The 30-day cure period is permanent with no sunset. Profiling opt-out applies to decisions with legal or similarly significant effects, not all profiling.
Effective July 1, 2024Risk weight 5

Utah

(1 tracked)

UtahIn Effect
Utah Consumer Privacy Act, Profiling Provisions (SB 227)
Utah's comprehensive privacy law. It is the least restrictive state privacy law regarding profiling and ADM among comparable statutes: it includes opt-out for targeted advertising and sale of personal data, but does not include a general profiling opt-out or ADM impact assessment requirement. No universal opt-out mechanism requirement. Trackers sometimes incorrectly list Utah as having ADM provisions similar to other states.
Effective December 31, 2023Risk weight 3

Virginia

(1 tracked)

VirginiaIn Effect
Virginia Consumer Data Protection Act (VCDPA, Profiling Provisions)
Grants Virginia consumers the right to opt out of profiling in furtherance of decisions that produce legal or significant effects. The VCDPA excludes employee and HR data and B2B data from scope; profiling opt-out applies to consumer data only. Permanent 30-day cure period with no sunset: unlike most states, Virginia does not phase out the cure opportunity. Virginia does not require universal opt-out mechanisms (UOOMs). Virginia does not grant the Attorney General rulemaking authority. In March 2025, Governor Youngkin vetoed HB 2094, a comprehensive AI act that would have materially expanded the privacy and AI framework. Virginia is the most business-friendly state privacy law among comparable statutes: permanent cure, no UOOMs, no AG rulemaking, and a high revenue threshold (50% for the 25,000-consumer applicability tier).
Effective January 1, 2023Risk weight 6

100Regulations tracked

24Jurisdictions

88In effect

OnePath from scan to export

Numbers reflect the live catalog and site configuration.

See the match before you commit

Lead with the scan. Add a work email only if you want updates. Nothing here blocks the free exposure path.

Regulation catalog

Colorado Privacy Act (CPA profiling and ADM)

CCPA/CPRA Automated Decision-Making Technology Regulations

Delaware Personal Data Privacy Act - Profiling Provisions

Maryland Online Data Privacy Act (MODPA), ADM and profiling provisions

Minnesota Consumer Data Privacy Act - ADM and profiling provisions

Montana Consumer Data Privacy Act - Profiling Provisions

Nebraska Data Privacy Act - ADM and profiling provisions

New Jersey Data Privacy Act (Profiling Provisions)

Oregon Consumer Privacy Act - Profiling Provisions

Rhode Island Data Transparency and Privacy Protection Act - ADM provisions

Texas Data Privacy and Security Act, Profiling Provisions (HB 4)

Utah Consumer Privacy Act, Profiling Provisions (SB 227)

Virginia Consumer Data Protection Act (VCDPA, Profiling Provisions)

See the match before you commit