As AI becomes more embedded in everyday life and business operations, companies are facing a growing regulatory maze at the intersection of state privacy laws and emerging AI standards. This article explores the privacy laws that impact the use of AI and automated decision making and offers a practical guide for business leaders that aligns AI innovation with privacy expectations.
Large amounts of data including personally identifiable information can be compromised in the event that debtors file for bankruptcy, and sell the information to pay back creditors.
Five new state privacy laws took effect in January 2025 — Delaware (DPDPA), Iowa (ICDPA), Nebraska (NDPA), New Hampshire (NHPA), and New Jersey (NJDPA) — adding to the compliance maze for businesses operating across state lines. This latest wave of legislation creates a patchwork of requirements that include critical variations in three key areas: applicability thresholds, covered data categories and enforcement protocols.
In a show of continuity between administrations, the Biden-era Executive Order 14117 — designed to restrict foreign access to Americans’ most sensitive personal data — has been allowed to take effect in the second Trump administration.The Department of Justice’s implementing regulation for this Order, finalized in late December 2024, became enforceable in April 2025.
The New Jersey Data Privacy Act (NJDPA), went into effect this past Jan. 15. The NJDPA represents New Jersey’s entry into the burgeoning field of data privacy laws, as it joins 18 other states that have passed such laws.
While the amount of AI legislation introduced in various states is relatively limited, the scope of issues being legislated is quite broad. Despite the many uncertainties that remain to be clarified, there are actually many parallels between how data privacy laws took shape five years ago, and how AI legislation is developing today.
The VPPA may be nearly four-decades old and video-rental stores largely a thing of the past, but the rise of online content, streaming services and ancillary activities has brought with it frequent litigation based on the VPPA. The key challenge in these litigations is how to interpret the VPPA’s 1980s terms in light of today’s digital advances.
The VPPA may be nearly four-decades old and video-rental stores largely a thing of the past, but the rise of online content, streaming services and ancillary activities has brought with it frequent litigation based on the VPPA. The key challenge in these litigations is how to interpret the VPPA’s 1980s terms in light of today’s digital advances.
For decades, the Children’s Online Privacy Protection Act has been the only law to expressly address privacy for minors’ information other than student data. In the absence of more robust federal requirements, states are stepping in to regulate not only the processing of all minors’ data, but also online platforms used by teens and children.
Plaintiff’s lawyers struggling to find another nuisance suit cash grab in a desert of privacy laws without a private right of action appear to have found their oasis. Like a hiker desperate for water in the Valley of the Sun, plaintiff’s firms are desperately trying to tie a little-known state law to common email tracking pixel technologies. With the potential for class-action litigation and significant financial exposure, companies relying on these technologies must reassess their risk.
