State AI laws and US state privacy laws: what applies to you
· Written and maintained by Nonimo
Twenty US states have a comprehensive consumer privacy law in force on October 13, 2026, and there is still no federal one. State AI laws are fewer, and only a handful reach an ordinary business: Texas since January 1, 2026, Illinois for employment decisions since the same day, Utah for generative AI disclosures, and Colorado from January 1, 2027. Washington, Nevada and Connecticut add rules for health data that HIPAA never reaches.
This page is the map: every law with its date, which ones say something specific about AI, and where we have a state guide with the detail. Why no AI tool is compliant by brand, and what HIPAA and the FTC Act add on top, is in our guide to which AI tools comply with US privacy law. The state that changed most this year is Colorado, covered in our Colorado AI Act guide.
US state privacy laws in force: the 20 states in October 2026
These are the comprehensive consumer privacy laws in force on October 13, 2026, in the order they took effect. The dates are when the main obligations started, as checked against each state’s legislature, attorney general or official code in our national guide, which lists every source.
| State | Law | In force | Our guide |
|---|---|---|---|
| California | CCPA, amended by the CPRA | January 1, 2020; CPRA January 1, 2023 | California |
| Virginia | Consumer Data Protection Act | January 1, 2023 | National guide |
| Colorado | Colorado Privacy Act | July 1, 2023 | Colorado |
| Connecticut | Connecticut Data Privacy Act | July 1, 2023; amended July 1 and October 1, 2026 | Connecticut |
| Utah | Utah Consumer Privacy Act | December 31, 2023 | National guide |
| Texas | Data Privacy and Security Act | July 1, 2024 | Texas |
| Oregon | Oregon Consumer Privacy Act | July 1, 2024; nonprofits July 1, 2025 | National guide |
| Florida | Florida Digital Bill of Rights | July 1, 2024 | National guide |
Each state’s attorney general, legislature or official code; see the sources list.
The second wave came between the fall of 2024 and the summer of 2025, and none of these states needs a page of its own for AI use yet:
| State | Law | In force |
|---|---|---|
| Montana | Consumer Data Privacy Act | October 1, 2024 |
| Delaware | Personal Data Privacy Act | January 1, 2025 |
| Iowa | Iowa Code chapter 715D | January 1, 2025 |
| Nebraska | Data Privacy Act | January 1, 2025 |
| New Hampshire | RSA 507-H | January 1, 2025 |
| New Jersey | P.L. 2023, c. 266 | January 15, 2025 |
| Tennessee | Tennessee Information Protection Act | July 1, 2025 |
| Minnesota | Minnesota Consumer Data Privacy Act | July 31, 2025 |
Each state’s attorney general, legislature or official code; see the sources list.
And four since the fall of 2025, three of them on the same day:
| State | Law | In force |
|---|---|---|
| Maryland | Maryland Online Data Privacy Act | October 1, 2025 |
| Indiana | Indiana Consumer Data Protection Act | January 1, 2026 |
| Kentucky | Kentucky Consumer Data Protection Act | January 1, 2026 |
| Rhode Island | Data Transparency and Privacy Protection Act | January 1, 2026 |
Each state’s attorney general, legislature or official code; see the sources list.
Passed in 2026 and not yet in force
Four more states enacted comprehensive laws in 2026: Oklahoma (SB 546) and Louisiana (SB 386) from January 1, 2027, Alabama (HB 351) from May 1, 2027, and Vermont (S.71) from January 1, 2028. An AI tool contract signed this year will still be running when they start, so a business with customers in those states should count them now.
The thresholds are not interchangeable
Whether any of these laws applies depends on its own test, and the tests differ more than the names suggest. Four of them, as our state guides set them out:
| State | Who is covered |
|---|---|
| California | Revenue over $26,625,000 (2025 figure), or data of 100,000 consumers or households |
| Colorado | Data of 100,000 or more Colorado residents a year, or 25,000 with revenue from selling data |
| Connecticut | From July 1, 2026: 35,000 consumers, any sensitive data, or any sale of personal data |
| Texas | No revenue or headcount test; businesses that are small under SBA rules are out |
California Privacy Protection Agency, Colorado and Texas attorneys general, Connecticut Public Act 25-113.
Falling below every threshold does not mean a free hand. HIPAA, the FTC Act and professional confidentiality rules apply regardless, and what to take out before AI applies to every office.
State AI laws that bind ordinary businesses
Some state AI laws are aimed at the companies that run public chatbots, such as Colorado’s Chatbot Safety Act, which starts January 1, 2027. A few reach the ordinary business whose staff use ChatGPT, Claude or Copilot, and almost all of them are triggered by what the AI is used for, not by how much data the business holds.
| Where | Law | From | What it asks |
|---|---|---|---|
| Colorado | SB 26-189 | January 1, 2027 | Notice, explanation, correction and review for automated consequential decisions |
| Texas | HB 149, TRAIGA | January 1, 2026 | Bans certain intended uses; health care providers disclose AI |
| Utah | Utah Code chapter 13-77 | May 7, 2025 | Disclose generative AI when asked, or upfront in regulated services |
| Illinois | HB 3773, Human Rights Act | January 1, 2026 | Notice of AI in employment decisions; no discriminatory effect |
| California | CPPA regulations | January 1, 2027 for ADMT | Notice and opt out for significant automated decisions |
| Connecticut | PA 25-113; PA 26-15 (CART Act) | August 1, 2026; October 1, 2026 | Profiling impact assessments; notice of AI in job decisions for tools deployed from October 1, 2027 |
| New York City | Local Law 144 (city law) | Enforced July 5, 2023 | Bias audit, public summary and notice for hiring tools |
Colorado General Assembly, Texas Legislature Online, Utah Code, Illinois Public Act 103-0804, CPPA, Connecticut General Assembly, NYC DCWP.
Colorado: rewritten in May 2026
SB 26-189, signed May 14, 2026, repealed and reenacted the original Colorado AI Act, SB 24-205, before its duties started. The new law drops the duty of care and the impact assessments.
From January 1, 2027, a business that uses automated decision making technology to materially influence a decision about employment, housing, lending, insurance, health care, education or government services owes notice, an explanation within 30 days of an adverse outcome, correction and human review. The attorney general’s rules are proposed, with a hearing on October 26, 2026, and are not final. The Colorado guide has the detail.
Texas: TRAIGA since January 1, 2026
The Texas Responsible Artificial Intelligence Governance Act is mostly a list of prohibited purposes: developing or deploying AI with the intent to incite harm, infringe constitutional rights or unlawfully discriminate. Its only disclosure duty on private businesses falls on health care providers, who must tell patients when AI is used in their care. The attorney general enforces it. The Texas guide sets it beside the TDPSA and HB 300.
Utah: disclosure when the customer asks
Utah’s rules on generative AI are about telling people they are talking to a machine. Since May 7, 2025, chapter 13-77 of the Utah Code requires a supplier that uses generative AI to interact with someone in a consumer transaction to disclose that it is AI and not a human, if the person clearly asks.
People in a regulated occupation, those licensed or state certified through the Department of Commerce, must disclose prominently without being asked when the use is what the statute calls a high-risk artificial intelligence interaction: one that collects health, financial or biometric data, or gives personalized financial, legal, medical or mental health advice. The disclosure is spoken at the start of a verbal interaction and written before a written one.
The chapter defines generative AI as a system designed to simulate human conversation with a consumer, so it is aimed at the AI that talks to customers. The separate Artificial Intelligence Policy Act, which created the state’s Office of Artificial Intelligence Policy and its learning laboratory, is scheduled for repeal on July 1, 2027.
Illinois and New York City: hiring
Illinois amended its Human Rights Act so that, since January 1, 2026, an employer with one or more employees in the state must not use AI that has the effect of discriminating in employment decisions, must not use ZIP codes as a proxy for a protected class, and must tell employees when AI is used. The rules meant to explain the notice are not in place yet. The Illinois guide covers it with the Video Interview Act and BIPA.
New York City’s Local Law 144 is a city law, not a state one. It requires a bias audit within the past year, a public summary and candidate notice before an employer uses an automated employment decision tool for a job in the city. How these rules compare is in our guide to AI for HR and employee data.
Health data outside HIPAA: Washington, Nevada and Connecticut
HIPAA binds health plans, clearinghouses, most providers and their business associates. A wellness app, a gym, an employer’s HR file or a clinic outside HIPAA can hold health details it never touches, and three states have written laws for that space. The federal rule itself is in our guide to HIPAA compliant AI.
Washington’s My Health My Data Act applies to anyone who does business in Washington or targets Washington consumers and handles consumer health data, with no revenue or volume threshold. It requires consent to collect and share that data and a valid authorization to sell it. The attorney general enforces it through the Consumer Protection Act, and so can individuals through private action. The Washington guide covers what it asks before health details go into an AI tool.
Nevada’s consumer health data law, SB 370, took effect on March 31, 2024. Connecticut put consumer health data inside its privacy act as sensitive data that needs consent, and its attorney general says those rules apply to every consumer health data controller doing business in the state, with no revenue or processing threshold and no nonprofit exemption. The Connecticut guide goes through it.
Two older state laws also reach past HIPAA: California’s Confidentiality of Medical Information Act, which tells every employer that receives medical information to protect it, and Texas’s HB 300, which covers anyone who collects, uses, stores or simply comes into possession of protected health information for gain or on a nonprofit basis. Both are in their state guides.
Why some states have their own guide and others don’t
A state gets its own page here only where its law says something different about using AI with personal data. Most of the 20 privacy laws share the same skeleton: rights to access, correct and delete, an opt out of sale and targeted advertising, consent for sensitive data, and a controller and processor split that decides what your AI vendor’s contract must say. For those, the national guide is the page.
The six with their own guide each add something an AI policy has to answer:
- California. Employees are consumers, risk assessments have been required since January 1, 2026, and ADMT rules start January 1, 2027.
- Colorado. The only state AI law with duties for every automated consequential decision.
- Connecticut. Since July 1, 2026 the privacy notice must say whether personal data is used to train large language models, and since October 1, 2026 a new incompatible purpose needs consent and the CART Act covers AI in employment decisions.
- Texas. A privacy law with no revenue test, an AI law in force, and a breach notice to the attorney general within 30 days once 250 Texans are affected.
- Illinois. AI in hiring, video interviews and biometrics, each under its own statute.
- Washington. Health data with a private right of action.
The rest of the work is the same everywhere: an approved business account, a processing contract, and less personal data in the prompt. Our US AI policy template turns the state rules into clauses, and data anonymization before AI explains what removing identifiers does and does not achieve under these laws.
Driver’s license copies: a watermark tool for every state
The document a US office copies most often is a driver’s license, for a lease, an account, a hire or a notarization. We have a free watermark page for each of the 50 states and Washington, D.C.: write who the copy is for and the month, then download a PDF, PNG or JPG. The photo is processed in your browser and does not leave your device.
All 51 are listed on the tools page. The ones that match our state guides are California, Texas, Colorado, Illinois, Connecticut and Washington. If the copy is going into an AI tool rather than to a person, redacting the license copy is the better step.
Nonimo on the computer, before the text leaves
Nonimo is an app for Mac and Windows. Whoever is drafting highlights the text and presses one key, and the names, Social Security numbers, phone numbers, addresses and other identifiers it recognizes become placeholders on that computer, before ChatGPT, Claude or Copilot receive anything. When the answer comes back, the real details are put back on the same machine.
It does not replace the business plan or the processing contract each state law expects; it reduces what the vendor holds under all of them. The apps keep each conversation encrypted on your disk, and what leaves once a day is a usage count with no text, as the security page sets out. The app for US offices is the place to start.
Sources
All read October 13, 2026.
- State dates in the three privacy tables: Virginia AG summary; Colorado AG, Colorado Privacy Act (also the thresholds of 100,000 residents or 25,000 with revenue from sales, C.R.S. 6-1-1304); Connecticut AG, CTDPA (also consumer health data as sensitive data, consent, no threshold, no nonprofit exemption); Utah Legislature, SB 227 (2022); Texas AG, TDPSA; Oregon DOJ FAQ; Florida Senate, SB 262 (2023); Montana Code 30-14-2801; Delaware AG FAQ; Iowa Code ch. 715D; Nebraska AG; New Hampshire DOJ; New Jersey Cybersecurity and Communications Integration Cell; Tennessee AG; Minnesota Statutes 325M.10; Maryland, 2024 Chapter 454; Indiana AG; Kentucky AG; Rhode Island General Laws 6-48.1.
- California: California AG, CCPA (in effect January 1, 2020, CPRA amendments January 1, 2023); CPPA, updated monetary thresholds ($26,625,000 from January 1, 2025); CPPA, CCPA updates, risk assessments and ADMT (risk assessments from January 1, 2026, ADMT from January 1, 2027).
- Laws passed and not yet in force: Oklahoma SB 546, enrolled; Louisiana SB 386; Alabama HB 351, enrolled; Vermont Act 145 summary.
- Colorado General Assembly, SB 26-189: signed May 14, 2026; repeal and reenactment of SB 24-205; covered domains; notice, 30 day explanation, correction and human review for decisions from January 1, 2027. Colorado Department of Law, ADMT rulemaking: proposed rules filed August 11, 2026, hearing October 26, 2026.
- Texas Legislature Online, HB 149, enrolled and its history: signed June 22, 2025, effective January 1, 2026; prohibited purposes; disclosure by health care providers, 552.051(f). HB 4, TDPSA, enrolled: 541.002, no revenue test, SBA small businesses excluded. Texas AG, data breach reporting: 250 Texans, 30 days.
- Utah Code, Title 13, Chapter 77, current version effective May 7, 2025, and Utah Legislature, SB 226 (2025), enrolled: definition of generative AI and of high-risk artificial intelligence interaction; disclosure on request in consumer transactions; prominent disclosure in regulated occupations, verbal or written; fine up to $2,500 per violation. Utah Code 63I-2-213 and SB 332 (2025), enrolled: Artificial Intelligence Policy Act repealed July 1, 2027.
- Illinois General Assembly, Public Act 103-0804 (HB 3773): 775 ILCS 5/2-102(L), effective January 1, 2026. ilga.gov did not respond on October 13, 2026; read through the Internet Archive copy. Illinois Department of Human Rights, legislative updates: no rule in a comment period.
- NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools: Local Law 144 of 2021; bias audit within one year, public summary, notices; enforcement from July 5, 2023.
- Connecticut General Assembly, Public Act 25-113: 35,000 consumer threshold, privacy notice statement on training large language models, impact assessments from August 1, 2026; effective July 1, 2026. Public Act 26-64 and Public Act 26-15, both approved May 27, 2026: consent for any new incompatible purpose, effective October 1, 2026; the CART Act’s notices for automated employment decision tools deployed on or after October 1, 2027. Connecticut AG, new and updated privacy laws, September 16, 2026: the CART Act name and the October 1, 2026 date.
- Washington Attorney General, My Health My Data Act: who is a regulated entity; consent and authorization to sell; enforcement by the attorney general and private action under the Consumer Protection Act; July 23, 2023, March 31, 2024 and June 30, 2024. Nevada Legislature, SB 370 (2023): effective March 31, 2024.
Common questions
How many US states have a comprehensive privacy law?
Twenty have one in force on October 13, 2026, from California's CCPA, in effect since January 1, 2020, to Indiana, Kentucky and Rhode Island, whose laws took effect on January 1, 2026. Oklahoma, Louisiana, Alabama and Vermont passed laws in 2026 that start between January 1, 2027 and January 1, 2028. Each state sets its own thresholds, so being covered in one says little about the next.
Which states have AI laws that apply to ordinary businesses?
Four stand out. Texas's TRAIGA has applied since January 1, 2026, Illinois has regulated AI in employment decisions since the same day, Utah's current generative AI disclosure rules have applied since May 7, 2025, and Colorado's rewritten AI Act, SB 26-189, applies to decisions from January 1, 2027. New York City's Local Law 144 on hiring tools is city law, not state law, and has been enforced since July 5, 2023.
Is there a federal privacy law or a federal AI law in the US?
There is no comprehensive federal privacy law. Congress has passed sectoral statutes instead, such as HIPAA for health information, and the FTC polices unfair and deceptive practices across the economy. FTC staff warned in January 2024 that AI is not exempt from existing law, but for most office data the state laws on this page do most of the work. Our national guide covers the federal layer in full.
Do state privacy laws apply to small businesses?
Most do not, because they apply only above a threshold. Colorado's covers businesses processing data of 100,000 or more Colorado residents a year, and California's applies above $26,625,000 in annual revenue, as adjusted for 2025, or 100,000 consumers or households. Texas has no revenue or headcount test, though it excludes businesses that are small under SBA rules. Health data laws such as Washington's have no threshold.
Does the Colorado AI Act still apply after it was repealed?
It was repealed and rewritten, not dropped. SB 26-189, signed May 14, 2026, replaced SB 24-205 with a narrower law on automated decision making technology. From January 1, 2027, a business using it in decisions about jobs, housing, credit, insurance, health care or education owes notice, an explanation after an adverse outcome, correction and human review. The attorney general's rules are still proposed, with a hearing on October 26, 2026.
Which states protect health data that HIPAA does not cover?
Washington, Nevada and Connecticut have the clearest rules. Washington's My Health My Data Act has applied to most regulated entities since March 31, 2024, and individuals can sue under it. Nevada's SB 370 took effect the same day. Connecticut treats consumer health data as sensitive data that needs consent, with no revenue or processing threshold. California's CMIA and Texas's HB 300 also reach businesses HIPAA does not.
Does Nonimo make my business compliant with state privacy laws?
No tool does that, and Nonimo does not claim to. What it does is narrower: on the computer where the text is typed, it replaces names and identifiers with placeholders before the text reaches ChatGPT, Claude or Copilot, and puts the real details back in the answer. Less personal data reaches the AI vendor, which is useful under every state law listed here, whatever plan and contract you have.