Careful consideration and close collaboration between your organization's business departments are watchwords for 2025. AI tools in performance management and other areas present both opportunities and risks as increased regulation and enforcement at the state level proliferate — along with the rise of related class actions. On the privacy front, a focus on data minimization and thoughtful implementation and governance of new technologies and their data, both within the organization and across its vendors, will all help to avoid unintended consequences.
Takeaways
- Unclear how change in administration will impact federal government guidance on AI.
- 2025 will likely bring more state laws on AI regulation for developers and deployers, as well as more state-level enforcement actions of state privacy and security laws.
- Privacy litigation will continue to grow.
- Organizations should take stock of data they maintain to determine how to ensure privacy law compliance.
- Organizations should take preventative measures to protect personal data they maintain (including data processed by their vendors).
State Privacy Laws Taking Effect in 2025
January 1
- Delaware Personal Data Privacy Act
- Iowa Consumer Data Protection Act
- Nebraska Data Privacy Act
- New Hampshire Consumer Data Protection Act
January 15
- New Jersey Data Privacy Act
July 1
- Tennessee Information Protection Act
July 31
- Minnesota Consumer Data Privacy Act
October 1
- Maryland Online Data Privacy Act
State AI Developments
California | Effective 01.01.26
- Creates California AI Transparency Act to ensure transparency in the training data used for generative AI systems. The Act applies to developers of generative AI systems or services, including substantial modifications.
- Sets disclosure requirements, including:
- High-level summary of datasets used.
- Sources or owners of the datasets.
- Description of how datasets further the AI system's purpose.
- Number and types of data points in the datasets.
- Information on whether datasets include copyrighted, trademarked, or patented data.
- Details on whether datasets are purchased, licensed or include personal information.
- Description of any data cleaning, processing or modifications.
- Time period of data collection and notice, if ongoing.
- Comprehensive proposed AI regulations under the California Consumer Privacy Act move forward concerning Automated Decision-Making Technology (ADMT).
- Civil Rights Council examining comments to Initial Text for
Proposed Modifications to Employment Regulations Regarding
Automated-Decision Systems.
Colorado | Effective 02.01.26
- Defines high-risk AI systems as systems making consequential decisions affecting areas like employment, education, healthcare and more.
- Identifies role-specific obligations.
- Developers: Must provide necessary documentation and mitigate algorithmic discrimination.
- Deployers: Required to conduct risk management and impact assessments and to provide consumer rights.
- Emphasizes consumer rights, including the right to notice, explanation, correction and appeal for decisions made by high-risk AI systems.
- Includes algorithmic discrimination: Duty of care to prevent both intentional discrimination and disparate impact.
- Gives Colorado Attorney General significant authority to
enforce the law.
Illinois
- New laws address use of generative AI and digital likeness, publicity rights.
- Updates its civil rights law to make clear that uses of artificial intelligence, including generative AI, could constitute civil rights violations.
Trends in Data Privacy and Security Litigation + Regulatory Enforcement
- Increase in data breach class actions.
- Website tracking technology claims.
- Illinois Biometric Information Privacy Act and Genetic Information Privacy Act claims.
- AI and data privacy actions: Legal challenges to AI's use of personal data and decisions made with assistance from AI.
- Regulatory enforcement actions: Aggressive enforcement by state AGs and industry regulators.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.