Question 1

What are AI data privacy laws in the United States?

Accepted Answer

AI data privacy laws in the United States regulate how businesses use artificial intelligence and automated decision-making technology (ADMT) to process personal data. California's CCPA/CPRA includes ADMT regulations requiring disclosure, opt-out rights, and access to logic for automated decisions. The Colorado AI Act (SB 24-205) imposes duties on deployers of high-risk AI systems including impact assessments and consumer notifications. Over 20 states with comprehensive privacy laws require opt-out rights for profiling that produces legal or similarly significant effects, and most classify data used in AI systems (biometric, health, financial) as sensitive data requiring opt-in consent.

Question 2

Do I need to disclose AI use to consumers under state privacy laws?

Accepted Answer

Yes, several states require disclosure of AI and automated decision-making. California's ADMT regulations (effective 2026) require businesses to disclose the use of automated decision-making technology in pre-use notices and privacy policies. Colorado's AI Act requires transparency disclosures when high-risk AI makes consequential decisions. Maryland, Minnesota, and Connecticut also require disclosure of profiling activities. Even in states without explicit ADMT disclosure requirements, transparency about AI use is considered a best practice for compliance with general privacy notice obligations.

Question 3

Which states require opt-out rights for AI profiling?

Accepted Answer

Nearly all US states with comprehensive privacy laws require opt-out rights for profiling that produces legal or similarly significant effects. This includes California, Colorado, Connecticut, Virginia, Montana, Oregon, Texas, Delaware, New Jersey, Nebraska, New Hampshire, Indiana, Kentucky, Rhode Island, Tennessee, Iowa, Utah, Maryland, and Minnesota. California and Colorado have the most extensive requirements, with California's ADMT regulations adding specific opt-out mechanisms for automated decision-making and Colorado's AI Act imposing additional duties for high-risk AI systems.

Question 4

What is automated decision-making technology (ADMT) under CCPA?

Accepted Answer

Under California's CCPA/CPRA, automated decision-making technology (ADMT) is defined as any system, software, or process that processes personal information and uses computation to produce decisions that replace or substantially facilitate human decision-making. The ADMT regulations require businesses to: (1) provide pre-use notices describing the ADMT, (2) offer opt-out rights for profiling and ADMT, (3) grant consumers access to the logic of automated decisions, (4) conduct cybersecurity audits for ADMT processing, and (5) provide human review of significant decisions upon request.

Question 5

Does the Colorado AI Act affect my business?

Accepted Answer

The Colorado AI Act (SB 24-205) affects businesses that deploy high-risk AI systems making consequential decisions in areas like employment, education, financial services, healthcare, housing, insurance, and legal services. Deployers must: conduct impact assessments, implement risk management policies, provide transparency disclosures to consumers, and notify consumers when high-risk AI is used for consequential decisions. The law applies in addition to the Colorado Privacy Act's existing profiling opt-out and data protection assessment requirements. If your AI system makes decisions that significantly affect consumers in these areas, the Colorado AI Act likely applies to your business.

AI Privacy Compliance Checker

Where Does Your AI System Operate?

AI Privacy Compliance Checker

Where Does Your AI System Operate?