Which AI tools comply with US privacy law? It depends on the use

No AI tool complies with US privacy law by brand. There is no federal privacy law to comply with, and no US regulator certifies ChatGPT, Claude, Copilot or Gemini. What the law judges is how your business uses them: the account, the contract behind it, the data that goes in and what the output decides. The same tool can be a sound choice under one plan and a problem under another.

What governs that use is a patchwork: 20 state privacy laws in force on October 13, 2026, California’s CCPA, enforced by a privacy agency of its own as well as the attorney general, HIPAA for health information, and the FTC Act for promises a company breaks. On top sit a few state AI laws aimed at automated decisions about people, starting with Colorado’s rewritten AI Act.

This guide walks through those layers of AI privacy law in the order a US office meets them, ends with a five question test you can run on any tool, and links to the state pages for the detail. Our map of state privacy and AI laws has every state on one page.

Which AI tools comply with US privacy law? The question is about the use

A privacy law in the United States puts duties on the business that collects and uses personal information, and it treats the AI vendor as one of the parties that business hands information to. So the useful question is never whether ChatGPT is compliant. It is whether your business, using ChatGPT this way, on this plan, with this data, meets the duties your laws place on you.

Four facts decide most of it. Whether the account is a personal one on consumer terms or a business plan with a data processing agreement. Whether the vendor may train on what you type. Whether the data is sensitive, such as health details or a Social Security number. And whether the output is used to decide something about a person.

What a regulator looks at	Where you find the answer
The plan and its terms	The invoice, and the vendor’s business terms
The processing contract	A DPA or BAA you accepted or signed
Training on your content	The vendor’s data controls and help pages
The data that went in	Your own staff, and your AI policy
What the output decided	Your hiring, lending, leasing or care process

Our summary of how US privacy laws allocate duties; each layer is sourced in the sections below.

A compliance badge is advertising

No federal agency approves AI tools for privacy. HHS says plainly that neither it nor its Office for Civil Rights certifies any person or product as “HIPAA compliant”, and no other federal agency runs a certification for privacy law either. A vendor page that calls a chatbot “CCPA compliant” or “HIPAA compliant” is describing features that let a customer comply, not a certificate. Our HIPAA compliant AI guide goes through that wording vendor by vendor.

No federal privacy law: what the US has instead

In its August 2025 report on preemption and privacy, the Congressional Research Service put it in one line: rather than adopting a single comprehensive consumer privacy law, Congress has enacted various privacy statutes for particular industries and kinds of data. It names health, financial, children’s, telecommunications and credit report data among them.

Those sectoral laws leave most office data outside federal privacy rules. A real estate brokerage’s client list, a staffing agency’s résumés and a marketing firm’s customer file fall under no federal privacy statute at all. They fall under state law, if the state has one and the business meets its thresholds, and under the FTC’s general power over unfair and deceptive practices.

At least 19 states

Why that matters for an AI rollout

Without one national rule, a business with staff or customers in several states inherits several sets of duties at once, with different thresholds, definitions and enforcers. A national firm cannot write one AI policy from a single statute. It writes one that meets the strictest rule it is under, and our US AI policy template is built that way.

The count has also grown since that report. By October 2026 the number in force had reached 20, with more passed and waiting, which is why the next section dates every row.

The 20 state privacy laws in force in October 2026

These are the comprehensive consumer privacy laws in force on October 13, 2026, in the order they took effect. Each was checked against the state’s own legislature, attorney general or code site; the sources list says where.

State	Law	In force
California	California Consumer Privacy Act (CCPA)	January 1, 2020; CPRA amendments January 1, 2023
Virginia	Consumer Data Protection Act (VCDPA)	January 1, 2023
Colorado	Colorado Privacy Act (CPA)	July 1, 2023
Connecticut	Connecticut Data Privacy Act (CTDPA)	July 1, 2023
Utah	Utah Consumer Privacy Act	December 31, 2023
Texas	Texas Data Privacy and Security Act	July 1, 2024
Oregon	Oregon Consumer Privacy Act	July 1, 2024; nonprofits July 1, 2025
Florida	Florida Digital Bill of Rights	July 1, 2024

Each state’s attorney general, legislature or official code; see the sources list.

The second wave arrived in under a year, between the fall of 2024 and the summer of 2025:

State	Law	In force
Montana	Consumer Data Privacy Act	October 1, 2024
Delaware	Personal Data Privacy Act	January 1, 2025
Iowa	Iowa Code chapter 715D	January 1, 2025
Nebraska	Data Privacy Act	January 1, 2025
New Hampshire	RSA 507-H	January 1, 2025
New Jersey	P.L. 2023, c. 266	January 15, 2025
Tennessee	Tennessee Information Protection Act	July 1, 2025
Minnesota	Minnesota Consumer Data Privacy Act	July 31, 2025

Each state’s attorney general, legislature or official code; see the sources list.

And four more since the fall of 2025, three of them on the same day:

State	Law	In force
Maryland	Maryland Online Data Privacy Act	October 1, 2025
Indiana	Indiana Consumer Data Protection Act	January 1, 2026
Kentucky	Kentucky Consumer Data Protection Act	January 1, 2026
Rhode Island	Data Transparency and Privacy Protection Act	January 1, 2026

Each state’s attorney general, legislature or official code; see the sources list.

Dates are when the main obligations started. Several states phased in pieces later, such as universal opt out signals, which Oregon and Delaware required from January 1, 2026.

The ones that are passed and not yet in force

Four more states enacted comprehensive laws in 2026 that are not in force yet: Oklahoma (SB 546) and Louisiana (SB 386) from January 1, 2027, Alabama (HB 351) from May 1, 2027, and Vermont (S.71) from January 1, 2028. A business that plans an AI rollout over the next year should count them now, because a tool contract signed today will still be running when they start.

The other point the dates make is that the landscape is not settled. Several of the older laws have been amended since they took effect, so treat any list, this one included, as dated. Connecticut’s has changed twice in 2026: Public Act 25-113 lowered its threshold to 35,000 consumers from July 1, and Public Act 26-64 amended it again from October 1. The Connecticut page goes through the act as it stands today.

What the 20 laws share

The Congressional Research Service describes these laws as giving a broadly similar set of rights, such as getting a copy of your data and having it corrected or deleted. Colorado’s is a typical example. It distinguishes a controller, which decides why and how personal data is processed, from a processor, which processes it on the controller’s behalf, lets residents opt out of sale, targeted advertising and certain profiling, and requires consent before sensitive data is processed.

For AI use, the processor relationship is the part to get right. A vendor handling your customers’ data for you is a processor only if a contract makes it one. A personal chatbot account, used under the vendor’s consumer terms, is a different relationship, and the state law then looks at what you disclosed and to whom. What to take out before AI lists the details that do the most damage.

Thresholds decide whether yours applies at all

Every state sets its own test for who is covered, and they are not interchangeable. Colorado’s applies to a business that processes the data of 100,000 or more Colorado residents in a year, or sells data of 25,000 or more. California’s applies to a for profit business with annual gross revenue over $26,625,000, as adjusted for 2025, or one that buys, sells or shares data of 100,000 or more consumers or households.

A small office can fall below every threshold and still be bound by HIPAA, a professional confidentiality rule or the FTC Act. Falling outside a state law is not the same as being free to paste anything anywhere. The state pages for California, Texas and Connecticut give each test in full.

Is ChatGPT CCPA compliant? What the contract and the plan decide

The CCPA was the first of the state laws, in force since January 1, 2020, and it has a regulator of its own, the California Privacy Protection Agency, alongside the attorney general. It is also where the question “is ChatGPT CCPA compliant” is usually asked, so it is worth answering precisely.

Under Civil Code 1798.140(ag), a service provider is a person that processes personal information on behalf of a business, for a business purpose, under a written contract that forbids selling or sharing the information and using it outside the business relationship. A vendor that meets that definition receives the data without it counting as a sale.

What OpenAI’s business terms say

OpenAI’s Data Processing Addendum, updated December 1, 2025 and effective January 1, 2026, supplements its Services Agreement for business customers. In it OpenAI agrees not to sell or share customer personal data in the CCPA’s sense, and, where the CCPA applies, to process it only for the business purposes in the agreement. The customer, in turn, agrees not to do anything that would make OpenAI not a service provider under the CCPA or a processor under other US privacy laws.

OpenAI’s help center adds that by default it does not use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu or the API to improve its models. On individual plans, Free, Plus and Pro, conversations may be used to improve models if Improve the model for everyone is on, and a thumbs up or down can send the whole conversation for that purpose.

	Personal Free, Plus or Pro	Business, Enterprise, Edu, API
Terms	Consumer terms	Services Agreement with the DPA
CCPA role	No service provider contract with you	Service provider under the DPA
Training on content	Possible, unless switched off	Off by default

OpenAI Data Processing Addendum and OpenAI Help Center, read October 13, 2026.

What the business still owes under the CCPA

A service provider contract moves one problem, not all of them. The CCPA treats a Social Security number, a driver’s license number, a person’s health and the contents of their messages as sensitive personal information, and employees are consumers too, because the statute defines a consumer as any natural person who is a California resident. What ChatGPT does with your data covers OpenAI’s own policies plan by plan.

$26,625,000revenue threshold for a CCPA business in 2025

$2,663fine per violation

$7,988per intentional violation or one involving a minor under 16

The California Privacy Protection Agency’s newer regulations, approved September 22, 2025, add duties around automated decisions. Businesses must do risk assessments starting January 1, 2026 and submit them by April 1, 2028, and those using automated decision making technology for significant decisions must comply from January 1, 2027. The California page goes through them.

Claude, Copilot and Gemini: the same three questions

Every major vendor separates consumer and business offerings in the same way, and the analysis does not change with the logo. For each, find the business plan your organization actually pays for, the processing terms that come with it, and the setting that controls training on your content. If staff use personal accounts for work, none of the business terms apply to what they type there.

The detail differs, and it changes often enough that we keep one guide per vendor: Claude and training on your data, Microsoft Copilot and what Gemini does with your data. Each sets out the plans, the defaults and where the switch lives.

The work account nobody set up

The most common gap is not a vendor’s terms. It is an employee who signed up with a work email on a free plan because the company never chose one. That account sits outside any contract the business has, and the vendor treats it as a consumer. An AI policy that names the approved account closes most of it, and the root AI policy template has the clause.

HIPAA: the federal rule for health information, and where it stops

HIPAA is the federal privacy law most offices meet first, and it is narrower than people think. It binds covered entities, meaning health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with covered transactions, and their business associates. Under 45 CFR 164.502(e), a covered entity may let a business associate handle PHI only after getting satisfactory assurance that it will safeguard it, which in practice means a signed business associate agreement.

For AI, that turns into a short rule. Patient details go only into a tool covered by a BAA, on the plan the BAA names, with the uncovered features left off. Our HIPAA compliant AI guide lists which plans OpenAI, Anthropic, Google and Microsoft will sign for.

Health data outside HIPAA

Plenty of health information is not PHI. A wellness app, a gym, an employer’s own HR file or a non covered clinic can hold health details that HIPAA never touches. Washington’s My Health My Data Act was built for that space, and Nevada has its own law on consumer health data.

Washington’s attorney general says the act’s main duties have applied since March 31, 2024, and since June 30, 2024 for small businesses, with its ban on geofencing around health care facilities in force since July 23, 2023. Nevada’s consumer health data law, SB 370, took effect March 31, 2024.

The Washington page covers what it asks before health details go into an AI tool, and PHI versus PII explains why an HR file with a doctor’s note is not PHI.

The FTC Act: a privacy promise is a legal promise

The Federal Trade Commission is the closest thing the US has to a general privacy regulator. The FTC Act empowers it to prevent unfair or deceptive acts or practices in or affecting commerce, which is Section 5, and it applies to every business the Commission has jurisdiction over, AI vendors and their customers alike.

In January 2024, FTC technology staff wrote that companies offering AI models must honor their privacy and confidentiality commitments, and that AI is not exempt from existing law. The same post notes that the Commission has required businesses that obtained data unlawfully to delete products built with it, models and algorithms included.

The Rite Aid order and what it says to buyers

On December 19, 2023, the FTC announced a proposed order banning Rite Aid from using facial recognition for surveillance for five years. The charges were unfair practices: the FTC said the technology falsely tagged consumers, particularly women and people of color, as shoplifters, and that Rite Aid deployed it without reasonable safeguards.

The point for an office is that the FTC went after the business using the AI. Rite Aid had bought the technology from vendors, and the release faults it for failing to seek information from either vendor about the technology.

The same logic applies to your own privacy notice. If it says client information never leaves the firm, pasting a client file into a personal chatbot account makes that sentence untrue. Our breach guide covers what to do if it already has.

State breach laws: when a paste turns into a notice

Privacy laws decide what you may do with personal data. Breach notification laws decide what you owe people when it goes somewhere it should not, and they run on their own clock. California’s, Civil Code 1798.82, was amended by SB 446 with effect from January 1, 2026, and now requires notice within 30 calendar days of discovering a breach, with delays allowed for law enforcement or to determine its scope.

The California statute is triggered when unencrypted personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person. Encrypted data counts only if the key or credential went with it. A business that notifies more than 500 California residents must also send the attorney general a sample copy within 15 calendar days.

30 calendar days

Is an AI vendor an unauthorized person?

Whether a paste into a chatbot is a breach depends on the facts, and above all on whether the recipient was authorized. A vendor under a business contract that limits what it may do with the data is in a different position from a consumer service the business never contracted with. That is one more reason the account and the contract, not the brand, decide most of these questions.

The answer also varies by state, because each state’s statute defines personal information and its triggers differently. Our breach guide walks through how to decide, and the California page covers California’s rules in full.

State AI laws: when the output decides something about a person

A handful of states now regulate AI itself, mostly where software helps decide something about a person. They sit on top of the privacy laws and are triggered by the use, not by the data volume.

State	Law	In force	What it is about
Colorado	SB 26-189	January 1, 2027	Notice, explanation and review for automated consequential decisions
California	CPPA regulations	January 1, 2027 for ADMT	Notice and opt out for significant automated decisions
Texas	HB 149	January 1, 2026	Rules on the use of AI systems, with civil penalties
Illinois	Human Rights Act amendment	January 1, 2026	AI in employment decisions
Connecticut	PA 26-15, the CART Act	October 1, 2026; notices from October 1, 2027	AI in employment decisions

Colorado General Assembly, California Privacy Protection Agency, Texas Legislature Online, Illinois Public Act 103-0804 and Connecticut General Assembly, read October 13, 2026.

Colorado’s law was rewritten this year

Colorado is the example most articles still get wrong. SB 24-205, with its impact assessments, was repealed and reenacted by SB 26-189, signed May 14, 2026, which keeps notice, an explanation within 30 days of an adverse outcome, correction and human review. Drafting with a chatbot is expressly outside; ranking applicants with one may not be. The Colorado AI Act page has the detail and the rules still pending.

Hiring is where the AI laws cluster

Employment is where these laws meet most often. Colorado’s law names employment as a covered domain and counts employees and Colorado resident applicants as consumers. California and Illinois have their own rules on AI in employment decisions, and since October 1, 2026 Connecticut’s CART Act says using such a tool is no defense to a discrimination claim.

An AI tool that screens résumés or scores interviews can sit under several of them at once. Our guide to AI in HR and employee data sets them side by side, and the Illinois page covers the state with the longest record on AI in hiring.

A five question test before staff use an AI tool with personal data

None of these laws asks for perfection, and most ask for the same handful of decisions. Run these five on any tool before it touches customer, patient or staff data:

1. Which laws cover us? List the states where your customers and staff live, check each threshold, and add HIPAA, financial privacy rules or professional confidentiality duties if they apply.
2. Which account and which contract? Name the approved business plan, and confirm it comes with a DPA or service provider terms, or a BAA for health information. Personal accounts are out.
3. Is the data sensitive? Social Security numbers, health details, biometrics, children’s data and precise location carry extra duties in most state laws. Decide whether they may go in at all.
4. Does the output decide something? If the tool scores or ranks people for a job, a home, credit, insurance or care, a state AI law may apply on top of the privacy law.
5. Can the identifiers come out first? The less personal data reaches the vendor, the less every one of those laws has to say about it. Data anonymization before AI explains what removing identifiers does and does not achieve legally.

Write the answers into one page of policy, train staff on it and keep the record. For a firm that holds client files, our page for law firms shows how that looks in practice.

Nonimo on the computer, before the text leaves

Nonimo is an app for Mac and Windows. Whoever is drafting highlights the text and presses one key, and the names, Social Security numbers, phone numbers, addresses and other identifiers it recognizes become placeholders on that computer, before ChatGPT, Claude or Copilot receive anything. When the answer comes back, the real details are put back on the same machine.

Typed                                   What reached the AI tool
Client: Harlan Vossberg                 Client: [PERSON_1]
SSN: 000-45-6789                        SSN: [REFERENCE_1]
Email: hvossberg@example.com            Email: [EMAIL_1]
Phone: (512) 555-0163                   Phone: [PHONE_1]

The client is invented, Social Security never issues area 000, example.com is reserved for documentation, and the number sits in the 555-0100 to 555-0199 block kept for fiction.

That does not replace the business plan, the DPA or the BAA; it works alongside them and reduces what the vendor holds under each. The apps keep each conversation encrypted on your disk, and what leaves once a day is a usage count with no text, as the security page sets out. The app for US offices is the place to start, with the pricing page for the plans and higher limits and central rollout for organizations.

Sources

All read October 13, 2026.

• Congressional Research Service, Preemption and Privacy Law, R48667, August 29, 2025: no single comprehensive federal consumer privacy law; sectoral statutes; at least 19 states with comprehensive laws since 2018; similar sets of consumer rights.
• California Privacy Protection Agency, CCPA updates, cybersecurity audits, risk assessments and ADMT and announcement of September 23, 2025: OAL approval September 22, 2025; effective January 1, 2026; risk assessments from January 1, 2026, submissions by April 1, 2028; ADMT for significant decisions from January 1, 2027.
• California Privacy Protection Agency, updated monetary thresholds: $26,625,000 revenue threshold, fines of $2,663 and $7,988, effective January 1, 2025.
• California Legislature, Civil Code 1798.140: definitions of business, consumer, service provider and sensitive personal information; Civil Code 1798.82: 30 calendar day breach notice and 15 day sample to the attorney general, as amended by SB 446, effective January 1, 2026.
• California Attorney General, CCPA: CPRA amendments effective January 1, 2023; CCPA in effect since January 1, 2020.
• State dates in the three tables: Virginia AG summary; Colorado AG; Connecticut AG; Utah Legislature, SB 227 (2022); Texas AG; Oregon DOJ FAQ; Florida Senate, SB 262 (2023); Montana Code 30-14-2801; Delaware AG FAQ; Iowa Code ch. 715D; Nebraska AG; New Hampshire DOJ; New Jersey Cybersecurity and Communications Integration Cell; Tennessee AG; Minnesota Statutes 325M.10; Maryland, 2024 Chapter 454; Indiana AG; Kentucky AG; Rhode Island General Laws 6-48.1.
• Laws passed and not yet in force: Oklahoma SB 546, enrolled; Louisiana SB 386; Alabama HB 351, enrolled; Vermont Act 145 summary.
• OpenAI, Data Processing Addendum, updated December 1, 2025, effective January 1, 2026: supplements the Services Agreement; no sale or sharing of customer data; processing limited to the agreement’s business purposes where the CCPA applies; the customer’s own commitment, in section 5.2, not to make OpenAI something other than a service provider.
• OpenAI Help Center, how your data is used to improve model performance: no training by default on Business, Enterprise, Edu and the API; Free, Plus and Pro when the setting is on; feedback.
• HHS, what you should know about OCR guidance materials: HHS and OCR do not certify persons or products as HIPAA compliant.
• eCFR, 45 CFR 160.103 (covered entity) and 45 CFR 164.502 (satisfactory assurance from a business associate, paragraph (e)).
• Washington Attorney General, My Health My Data Act: duties from March 31, 2024, June 30, 2024 for small businesses, geofencing ban from July 23, 2023. Nevada Legislature, SB 370 (2023): effective March 31, 2024.
• FTC, Federal Trade Commission Act: the power to prevent unfair or deceptive acts or practices. FTC Office of Technology, AI companies: uphold your privacy and confidentiality commitments, January 9, 2024. FTC, Rite Aid press release, December 19, 2023: proposed order, five year ban.
• Colorado General Assembly, SB 26-189: signed May 14, 2026, in force January 1, 2027. Texas Legislature Online, HB 149 history: signed June 22, 2025, effective January 1, 2026. Illinois General Assembly, Public Act 103-0804: AI in employment under the Human Rights Act, effective January 1, 2026.
• Connecticut General Assembly, Public Act 25-113: 35,000 consumer threshold, effective July 1, 2026; Public Act 26-64: further amendments, effective October 1, 2026; Public Act 26-15: automated employment decision technology, notices for tools deployed on or after October 1, 2027, and no defense to a discrimination complaint from October 1, 2026.