6 New State Privacy and AI Laws Businesses Need to Know in 2026

At a Glance

• • • Privacy and AI are no longer separate compliance tasks. State privacy laws are getting stricter when it comes to AI.
      
    • California, Colorado, Connecticut, Maryland, and New York are enforcing stricter data inventories, notices, assessments, deletion processes, and AI vendor controls.
      
    • Compliance is operational. That means knowing which AI tools are in use at any given time, what data flows through them, what your contracts promise.

When companies approve an AI-enabled platform, the infosec team and AI Governance committee typically gives the green light to proceed with the tool. Procurement negotiates the costs and the business team launches the tool. A common scenario: six months later, legal discovers that personal data is flowing into the system in ways no one discussed before the vendor was approved. Employees are also using the tool for purposes that weren’t originally considered. Meanwhile, the contract doesn’t have the right language on model training, data deletion, or cooperation with regulators.

Then there’s a new state law that just came into effect.

It’s not that one person or business unit made the mistake. The real issue is that AI governance, product review, and vendor contracts have been handled as separate projects. And doing that these days is going to hinder privacy compliance.

This article explains the state privacy and AI developments that matter most, along with the steps companies should take now to build a program that can adapt to the evolving laws over the next couple of years.

Why Privacy and AI Have Become One Legal Issue

Have you ever noticed that the hardest AI questions usually become data privacy questions within a few minutes?

• • What information is the tool collecting?
  • Where did the platform’s training data come from?
  • Can the AI vendor reuse prompts?
  • Is the output tied to an identifiable person?
  • Does the AI tool profile people, rank, recommend, or decide?

The AI compliance and privacy law overlap is driving the next standard of regulation. Privacy laws govern how personal information is collected, used, shared, retained, and deleted. AI laws govern how personal information is used to train systems, generate output, profile individuals, and make decisions.

In other words, AI governance and data privacy are not two compliance programs. They make up one connected risk system.

Omnibus Privacy Laws Set the Baseline

Omnibus privacy laws are broad, cross-industry rules that govern how businesses collect, use and share personal information. Unlike healthcare, financial, or education privacy laws, they’re not limited to one specific sector.

Most omnibus privacy laws allow consumers some combination of the right to access, correct, delete, and obtain copies of their data. They also allow consumers to opt out of sales, targeted advertising, and certain profiling. Critically important is that omnibus privacy laws create obligations for businesses around providing privacy notices, data minimization, safeguarding sensitive data, diligent vendor contract reviews, security, and robust risk assessments.

A deletion request may require a company to understand whether the information sits in a primary database, a vendor platform, or a model input log. The information may simply be in a transcript or via a data broker relationship with a third party.

California Data Broker Deletion Requests

California now shifts deletion from a company-by-company exercise to a centralized consumer right. That means businesses should look beyond their direct consumer relationships.

That further shifts the operational burden on businesses. Now service providers can’t wait for consumers to identify every company that holds their information. Data brokers have to know what data they have and where it sits. They also have to know all the service providers that hold the data, and how to keep deleted data from quietly reappearing.

No Longer Just a Privacy Notice Drafted Once a Year

Do you sell, share, license, enrich, or obtain data through third parties? Is it possible that you or an affiliate fall within a state’s definition of data broker? Can your service providers execute and preserve deletion across systems?

Those are questions for data governance and vendor management that have to be asked more than once a year.

Deletion Rights Become Operational

California continues to be the front runner in privacy law. The California Consumer Privacy Act and California Privacy Rights Act created an extensive consumer privacy framework. Now the Delete Act takes the next step by giving California consumers a simpler, more direct way to direct registered data brokers to delete their personal information.

Consumers can just use the Delete Request and Opt-Out Platform, known as DROP, to submit a single request. Starting August 1, 2026, covered data brokers have to access the platform every 45 days to process qualifying deletion requests.

Colorado: Privacy Preferences Must Travel With the Consumer

The Colorado Privacy Act requires covered businesses to provide material information about their data practices and conduct assessments for processing that presents a higher risk. The Colorado Privacy Act also requires businesses to get consent before processing sensitive data.

Colorado’s privacy law mandates that controllers adhere to universal opt-outs. In other words, a consumer shouldn’t need to visit every website and do the same privacy choice for every vendor.

Businesses should be getting a very clear message by now. A consumer’s privacy preferences need to flow through the technology stack. A consumer preference that’s on the front end but never reaches analytics tools, advertising partners, or AI vendors isn’t really a preference.

What This Means for Your Business – A Truly Useful Data Map

It all goes back to knowing your data. Which is not a simple concept. You need a truly useful data map that:

1. Shows what information the company collects;
2. Why it uses it;
3. Which AI systems touch it;
4. Where data is stored;
5. Who receives it; and
6. How long it’s retained
7. Which contractual or legal restrictions are attached to the data

The issue isn’t that companies don’t have good policies. The issue is that their privacy policies, as polished as they are, don’t match how the business’s actual operations.

State AI Laws Are Moving From Suggestions to Obligations

AI governance discussions used to focus on ethics principles, voluntary standards, and internal committees. While those things still matter, states are creating legal duties for specific AI uses, including employment decisions, AI companions, synthetic content, frontier models, and systems used by minors.

Connecticut Regulates AI Across the Business

In 2026, Connecticut passed the Connecticut Artificial Intelligence Responsibility and Transparency Act, or CART Act. Among other things, the law addresses AI companions, automated employment decisions, AI content, online safety for minors. It also encompasses education and public-sector AI initiatives. The CART Act will be enacted in phases starting on October 1, 2026, and continuing through 2028.

This is a very robust law. A company can be subject to the law through use of hiring technology, a consumer chatbot, content-generation features, or the way it markets AI-enabled services. 

New York Zeroes in on Frontier AI Developers

New York has taken a different approach. The state signed the Responsible AI Safety and Education Act, or RAISE Act, on December 19, 2025. Later in 2026, the framework was updated and changed the effective date to January 1, 2027.

The New York RAISE Act targets large developers of frontier AI models. It requires businesses to have written safety and security protocols, public disclosures, incident reporting, and regulatory oversight. Large developers must report certain “critical-harm” incidents to the state within 72 hours after determining that an incident occurred.

How does that impact the customers of such AI tools?

A majority of businesses subscribe or license the sort of AI tools that the RAISE Act targets. That makes vendor diligence and contractual information rights more and more critical.

AI Vendor Diligence Businesses Should Focus On

Have procurement teams ask the right questions. Have Legal work with them to make sure those questions are answered fully and correctly from the intake stage. Examples of key questions:

• Are you developing the AI system?
• Deploying it?
• Integrating it into a product?
• Allowing employees to use it?

The legal obligations, and the questions you ask the vendor, can change depending on the answers to intake questions.

AI Vendor Product Lifecycle
Every legal team should be reviewing with the business units to determine the full lifecycle of the product. That means understanding the training data, intended use, testing, notices, and human review. That also means output monitoring, incident escalation, model updates, recordkeeping, and contract termination.

You Can’t Separate Children’s Privacy and AI Safety Anymore

It’s true that many companies don’t market to children. They don’t see themselves as a child-directed platform. But that’s not the full analysis anymore. The question is much broader.

State laws are focusing on whether minors are likely to access a product and whether the business knows or should know about it. States such as Maryland are also requiring review of whether certain features are present, such as profiling, targeted advertising, rewards, or conversational AI that create amplified risk.

Maryland Builds Privacy Into Products Likely to Be Accessed by Children

Maryland’s Kids Code applies to online products reasonably likely to be accessed by children and requires data protection impact assessments and child-specific privacy safeguards. This privacy framework is separate from the Maryland Online Data Privacy Act which gives robust consumer privacy rights and imposes stringent obligations on both controllers and processors.

The lesson is that businesses need a product-level privacy review.

1. Who is likely to use the service?
2. What age signals exist?
3. Are privacy settings protective by default?
4. Does the product nudge users to stay engaged, disclose more information, or accept profiling they may not understand?

Connecticut Targets AI Companions and Youth Safety

Connecticut’s CART Act also regulates AI companions and their use by minors.

Chatbots can prompt users to disclose deeply personal information, build trust, and, in some cases, foster emotional dependence. A standard privacy notice alone does not address these risks.

Companies offering AI companions, wellness bots, virtual assistants, or AI-powered customer support should ask:

• Could a minor reasonably be expected to use this product?
• How does the system respond when a user shares sensitive or concerning information?
• When does a human intervene?
• Does the product design encourage users to remain engaged longer than is healthy?

As you can see, we’re not just talking about product design questions. They are becoming legal and regulatory ones.

We can’t just ask whether a product is marketed to children.

Businesses need to identify whether existing privacy notices and product controls are actually built for minors.

New Privacy Laws Are Regulating How Data Creates Value

Traditional privacy programs focused on how data was collected, secured, disclosed, and deleted.

Now the laws are changing to look much deeper into the data lifecycle and what it does within the business.

How is the data used to set prices? Train models? Infer behavior? Steer automated decisions?

The focus used to be on whether a company has the right to collect the data, now it’s also on what the company does with the data once it collects it.

Surveillance Pricing

A hot topic now is whether a company’s data-driven pricing treats consumers differently.

We’re talking about “surveillance pricing,” which is when a company uses things like behavioral information, demographics, browsing history, location, or inferred characteristics to offer customized pricing to a user.

We’re keeping an eye on how Maryland will address surveillance pricing laws through future legislation. Maryland considered several surveillance-pricing proposals in 2026, including limiting the ways companies use surveillance data and automated decision systems when it comes to pricing.

Businesses using dynamic pricing should know exactly which data points affect the price, whether comparable consumers receive different offers, and whether this is being disclosed to users.

The bottom line on surveillance pricing is that if the company can’t explain its pricing decisions, they’re probably not in compliance.

AI Training Data and Synthetic Data

Developers now have to publish required information about the data used to train generative AI systems per California’s Generative AI Training Data Transparency Act.

Developers must disclose where the data came from, whether it was licensed, whether it contains personal information or intellectual property, and whether synthetic data was used.

While the law is meant for developers, enterprise customers should pay attention.

Training-data transparency affects vendor diligence, intellectual property, and privacy risk.

It also affects marketing claims and what the business represented to its own customers.

Vendors that claim they use industry-standard data isn’t enough. They need to represent in the service contract where the data came from, whether it was properly licensed, and promising to notify the customer if the model, dataset, or training approach materially changes.

That is where vendor diligence has to be translated into contract language.

6 Things Companies Should Do Now

1. Inventory real-life AI use, not just approved AI use.

Shadow AI is a huge exposure. You need to identify and document enterprise tools, including embedded AI features, accounts, pilot programs, browser extensions, and systems your customers use.

2. Connect the AI inventory to the data map.

For each system, identify the inputs, outputs, users, affected individuals, data categories, storage locations, vendors, retention periods, and decision points.

3. Revisit vendor contracts and AI addenda

Your vendor contract and AI addendum may need to be amended to address training rights, prompt and output use, model changes, compliance, audit support, incident reporting, warranties, indemnification, and liability.

4. Review products and vendor approvals for minor’s use.

Ask whether minors are likely to use the product, what age information is available, whether targeted advertising occurs, how conversational AI behaves, and whether protections and escalation protocols are in place.

5. Assign an attorney to have ownership for state-law monitoring.

A dedicated lawyer or legal team should be responsible for knowing the new regulations and identifying which new laws impact the business. That person needs to track when the new laws come into effect, and edit the contracts and workflows that are involved.

6. Make your privacy policy defensible.

Privacy policy reviews aren’t narrow exercises. You have to keep detailed records of approvals, testing, training, and remediation. Not only regulators but also your customers won’t base compliance on your privacy policy alone. They will look closely at how your business actually operates.

In Conclusion

It’s clear that privacy laws span several business teams, from Legal, and Infosec to Procurements, Marketing, and Product Engineering. While we know state laws are going to keep changing, we need to keep in mind federal proposals could change the bigger picture over the next year.

Lawyers now need to build data privacy review processes and compliance program building that can adapt to those changes. You shouldn’t have to start over every time a new privacy law passes.

We Help Businesses Connect the Pieces

At Gouchev Law, we help companies align privacy, AI governance, commercial contracts, and product strategy. We advise on AI and privacy frameworks, vendor agreements, data practices, internal policies, and the legal systems needed to adopt technology with confidence.

If your AI inventory, privacy program, and vendor terms have developed separately, now is the time to bring them into one clear framework.

Disclaimer: The information in this article is for general information purposes only. Nothing in this article should be taken as legal advice for any individual case or situation. This information is not intended to create and viewing it does not constitute an attorney-client relationship.

About the Author

More Resources For You