Litigation Minute: State Generative AI Statutes And The Private Right Of Action - Generative AI Series: Part Two Of Three

K&L Gates


At K&L Gates, we foster an inclusive and collaborative environment across our fully integrated global platform that enables us to diligently combine the knowledge and expertise of our lawyers and policy professionals to create teams that provide exceptional client solutions. With offices spanning across five continents, we represent leading global corporations in every major industry, capital markets participants, and ambitious middle-market and emerging growth companies. Our lawyers also serve public sector entities, educational institutions, philanthropic organizations, and individuals. We are leaders in legal issues related to industries critical to the economies of both the developed and developing worlds—including technology, manufacturing, financial services, health care, energy, and more.
Class action litigation challenging generative artificial intelligence (AI) has rapidly become a familiar feature of the legal landscape.
United States Technology
To print this article, all you need is to be registered or login on


Class action litigation challenging generative artificial intelligence (AI) has rapidly become a familiar feature of the legal landscape. While early, headline-grabbing complaints were largely based on traditional theories of recovery, many of these have been dismissed, with courts commenting that the lawsuits presented "policy grievances that are not suitable for resolution by federal courts."1

At the same time, multiple states have enacted statutes addressing the development and deployment of generative AI. These different statutory regimes present familiar questions as to whether the new statutory requirements can be enforced through private rights of action (PRA).

In a minute or less, we provide an overview of different state approaches, as well as early suggestions for companies deploying generative AI for consumer or customer-facing uses.

How Are States Addressing Enforcement of Generative AI Statutes?

Broadly speaking, those states that have enacted generative AI statutes have provided exclusive enforcement authority to designated state agencies, consistent with a deliberate, considered approach to evaluating AI risks and enforcement priorities. Two prominent examples are Utah and Colorado, discussed below.

The exceptions to this trend are state statutes (either proposed2 or enacted) that authorize a PRA. While no class action litigation has been launched to date, early signs suggest that any private litigation will be necessarily limited in scope, subject to multiple defenses, and uniquely unsuited for class litigation.

Utah's AI Enforcement Regime and Regulatory Sandbox

With an effective date of 1 May 2024, Utah's Artificial Intelligence Policy Act (UAIPA) now requires companies in regulated industries (such as accounting and healthcare) to prominently disclose that a consumer is interacting with AI; non-regulated companies must disclose the use of AI if directly asked. Further, companies deploying AI cannot disclaim responsibility for content of responses provided by AI tools.

The UAIPA commits enforcement solely to Utah's Division of Consumer Protection (UDCP), while expanding the latter's enforcement authority to include administrative fines, declaratory and injunctive relief, and monetary disgorgement. Notably, algorithmic disgorgement3 is not among the expanded remedies provided by the UAIPA. The UAIPA also creates an Office of AI Policy and AI Lab, through which companies can apply for regulatory mitigation (such as reduced fines and cure periods) while they develop and deploy AI tools.

ELVIS Has Left the Building, But Not Entered the Courthouse

Tennessee is the first state to prohibit unauthorized use of artificial intelligence to replicate an individual's likeness, image, and voice. The Ensuring Likeness, Voice, and Image Security Act (known as the ELVIS Act), which goes into effect on 1 July 2024, creates three separate civil PRAs. As it relates to AI, the ELVIS Act authorizes individuals to sue when defendants employ an "algorithm, software, tool, or other technology service, or device," the primary purpose of which is the unauthorized reproduction of the plaintiffs' "photograph, voice, or likeness." The PRA is subject to certain fair use exceptions, while remedies include injunctive relief, actual damages (but not statutory damages), and court orders requiring the destruction of materials made in violation of the statute.

Colorado's Approach

Colorado's Artificial Intelligence Act, SB 205 (CO AI Act), effective 1 February 2026, regulates high-risk AI systems by establishing multiple requirements on developers and deployers of such systems, including notice to consumers, impact assessments, and anti-discrimination duties.

A violation of the CO AI Act is designated a "deceptive trade practice" under Part 1 of the Colorado Consumer Protection Act (CCPA). Although the CCPA provides for a PRA generally, the PRA is carved out of the CO AI Act. It not only grants the Attorney General exclusive authority to enforce and promulgate rules under the CO AI Act, but also explicitly states that it does not provide a PRA. Developers or deployers can assert an affirmative defense based on discovery and cure of an alleged violation.


The deliberate approach taken by Utah—including the opportunity to mitigate risks of generative AI through the Utah AI Lab's regulatory sandbox—is a promising sign that generative AI will be regulated in the first instances through tailored agency action, rather than through private litigants. Even under Tennessee's ELVIS Act, the PRA by definition appears limited to specific individuals, rather than the basis of putative class action litigation. Other states will continue to enact statutes or promulgate regulations in this area—including California, through its ongoing assessment of automated decision technology regulations.

Against this evolving backdrop, companies considering deploying generative AI should consider compliance focused on an appropriate disclosure regime, development of internal AI policies, and internal training programs. Ongoing assessment of the company's terms and policies applicable to consumer interaction with generative AI tools may be warranted, particularly for companies that are subject to new or pending state statutes.


1 Order Granting Motion to Dismiss, Cousart, et al. v. OpenAI LP, et al., Case 3:23-cv-04557-VC (N.D. Cal. May 25, 2024).

2 For example, New York Governor Kathy Hochul proposed AI regulatory measures that would establish a private of action for voters and candidates subject to deceptive AI-generated election materials. In New Hampshire, proposed HB 1432-FM would provide a private right of action for damages resulting from the fraudulent use of artificial intelligence to create a deep fake recording of an individual.

3 Algorithmic disgorgement has been described as a "novel" remedy in which algorithms developed based on illegally obtained data may be ordered deleted. Rebecca K. Slaughter et al., Algorithms and Economic Justice: A Taxonomy of Harms and a Path Forward for the Federal Trade Commission, 23 YALE J. L. & TECH. (SPECIAL ISSUE) 1, 39 (2021).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See More Popular Content From

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More