By Katrina Zhu, EPIC IPIOP Clerk
The 2023 legislative session has seen a surge in state AI laws proposed across the U.S., surpassing the number of AI laws proposed or passed in past legislative sessions. Ten states included AI regulations as part of larger consumer privacy laws that were passed or are going into effect in 2023, and even more states have proposed similar bills. Several states proposed task forces to investigate AI, and others expressed concern about AI’s impact on services like healthcare, insurance, and employment. Below is a list of state laws going into effect, passed, or proposed for the current legislative session.
Laws going into effect in 2023
Of the AI-related laws going into effect in 2023, most of them are part of comprehensive consumer privacy laws. These laws regulate AI and automated decision-making by allowing users to opt-out of profiling and requiring impact assessments. One law in New York City stands out as it “blazes a path for A.I. regulation” in hiring, attracting national attention.
State/City | Name | Date passed | Date in effect | Description |
California | California Privacy Rights Act (CPRA) | November 3, 2020 | January 1, 2023 | CPRA amends the California Consumer Privacy Act, introducing provisions impacting AI like additional limitations on data retention, data sharing, and use of sensitive personal information. |
Colorado | Colorado Privacy Act (CPA) | July 7, 2021 | July 1, 2023 | The CPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling. |
Connecticut | Connecticut Data Privacy Act (CTDPA) | May 10, 2022 | July 1, 2023 | The CTPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling. |
New York City | Automated Employment Decision Tools | December 11, 2021 | January 1, 2023 | AEDT regulates the use of AI in hiring. It requires employers to notify candidates about the use of such tools, allows candidates to request what data is used, and requires an annual audit to evaluate the tool for bias. |
Virginia | Virginia Consumer Data Privacy Act (VCDPA) | March 2, 2021 | January 1, 2023 | The VCDPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling. |
Utah | Utah Consumer Privacy Act (UCPA) | March 24, 2022 | December 31, 2023 | The UCPA gives consumers the ability to opt-out of profiling using personal data. Notably, it does not require impact assessments for data controllers. |
This legislative session, Montana, Indiana, Oregon, Tennessee, and Texas passed comprehensive consumer privacy laws that includes provisions regulating AI, mirroring laws that California, Colorado, Connecticut, and Virginia have previously passed. Most notably, the law (1) gives consumers the right to opt out of automated profiling and (2) mandates data protection assessments if the automated decision-making poses a heightened risk of harm. Iowa also passed a consumer privacy law, but it does not grant…