Illustration: Sarah Grillo/Axios
A host of new AI and privacy laws came into force on Jan. 1 across states as federal regulation lags.
Why it matters: With Republicans in D.C. focused on deregulation, states are likely to continue leading the way on placing guardrails to protect people's privacy and mitigate AI harms.
Several AI measures in California came into force on Jan. 1, including:
- A critical infrastructure law requires a study on potential generative AI threats on critical infrastructure and to disclose when AI is used to communicate government benefits and services.
- A health care law requires health insurance providers to use AI fairly and equitably when assessing coverage.
- A telecommunications law requires a person to say live what a telemarketing call entails before a prerecorded message starts and to disclose if that prerecorded message uses AI.
- Another new law streamlines the definition of AI, impacting laws across social media, community colleges and government operations.
Flashback: California Gov. Gavin Newsom last year vetoed a comprehensive AI bill that would have required AI developers to place security measures on frontier models.
- Newsom said that basing safety measures just on model size wasn't an effective way to mitigate harm.
- Supporters of SB 1047 are likely to try to advance similar proposals again that have a better chance of getting Newsom's sign off.
New privacy measures coming into force this year include:
- A law in Delaware that explicitly calls out pregnancy as sensitive data and gives individuals stronger rights to delete data used by third party sources.
- A law in Iowa that gives consumers the right to access and delete their data but excludes publicly available information from the definition of personal data.
- In New Hampshire, consumers also now have the right to access and erase their data. Nebraska small businesses must obtain opt-in consent to use sensitive personal data.
- New provisions in the California Consumer Privacy Act expand the definition of personal information to include outputs from AI systems, such as biometric data, and sensitive personal information.
What they're saying: BSA | The Software Alliance policy director Meghan Pensyl said the AI amendments to California's privacy law risk creating greater confusion about regulation and called for coordination.
- "General coordination in how states — and world economies — address AI policy helps companies and consumers better understand their obligations and their rights, and ultimately spur adoption of AI."
What we're watching: State efforts could inform what Congress and the incoming Trump administration decide to do on AI and privacy.
- House and Senate blueprints unveiled last year will need to be reconciled or reassessed if there's any chance of federal regulations gaining momentum.
