U.S. Privacy And AI Regulations: What International Companies Need To Know

While the U.S. federal government has not yet enacted comprehensive protective data privacy and artificial intelligence ("AI") laws or regulations, U.S. state governments have continued to regulate and update their laws in these areas. The White House is pushing for federal preemption of state laws through executive action and legislative recommendations to guide Congress, but any actual federal legislation would still require bipartisan congressional support. For now, compliance professionals are navigating a state-by-state patchwork while watching whether Congress moves on the White House's national policy framework¹ for AI.

State Data Privacy Developments

Currently, twenty U.S. states have enacted comprehensive privacy laws setting limits on how companies can collect, use, and disclose consumers' personal data. Since California passed the first data privacy law in 2018, many states have started putting in place similar protections. While state privacy laws enacted in recent years have similarities, there are unique aspects to many of them.

Oklahoma became the twentieth state to enact a comprehensive consumer privacy law. On March 20, 2026, Oklahoma's Act Relating to Data Privacy (the "Oklahoma Privacy Law") was signed into law and is set to take effect on January 1, 2027. Compared to states such as California and Maryland, which have more stringent regimes, the Oklahoma Privacy Law is considered to be more business friendly. In fact, the Oklahoma Privacy Law has a narrower definition of a "sale" of personal information to include only the "exchange" of data for "monetary consideration" as opposed to any "valuable" consideration. In addition, there is no private right of action, and the Oklahoma Attorney General has the exclusive authority to enforce the Oklahoma Privacy Law, which includes a cure period of thirty days for companies to fix potential violations.

California, which has been a leader on privacy law issues, has recently proposed a law to create financial incentives and anti-retaliation protections for workers who blow the whistle on potential data misuse. On February 17, 2026, the Whistleblower Protection and Privacy Act was introduced as a further effort to strengthen enforcement of the California Consumer Privacy Act. The proposal would enable whistle-blowers to share a portion of an enforcement award, and employers would be barred from retaliating against these individuals for their reports.

State AI Regulation

As of today, five U.S. states have passed comprehensive AI laws. Colorado was one of the first U.S. states to enact an AI law on May 17, 2024, also known as the Colorado Anti-Discrimination in AI Law, or ADAI or the Colorado Artificial Intelligence Act. It became the first comprehensive state law attempting to regulate AI systems used in employment, education, housing, education, credit, and healthcare decisions, which included protections for consumers from any known or reasonably foreseeable risks of algorithmic discrimination. However, its implementation has been complicated, and Colorado is currently revising the law in an effort to remove certain burdens and to strike a better balance between regulation and innovation. On March 17, 2026, the governor's AI Policy Working Group released a proposed revised version of the law, which aims to increase consumers' protections and recordkeeping while scaling back certain requirements. The proposal would introduce a transparency-and-notice model related to the use of automated decision-making technology that is used to materially influence a consequential decision while eliminating certain obligations relating to AI impact assessments, risk management, and required reports to the Colorado Attorney General. It would also push the Act's effective date from June 30, 2026, to January 1, 2027, giving employers additional time to prepare.

Other states with comprehensive AI laws include California, New York, Utah and Texas.

Conclusion

Many states have not been deterred by the Trump administration's efforts to preempt state regulations of AI. Considering that Congress has yet to enact a nationwide AI privacy framework, there is still time for other states to join the AI regulation scene. And Colorado may provide an example of how to balance the need for regulation, the reasonable compliance concerns of businesses, and the need to foster innovation.

In the absence of an omnibus federal privacy and AI law, companies should continue monitoring legislative developments in the U.S. Companies operating in the U.S. should conduct a data inventory to identify personal data that they store or process, assess how AI is being used and the associated risks, identify all applicable laws, and consider whether actions are needed to ensure compliance (for example, with internal controls, notice and transparency, and updates to privacy policies).

Footnote

1 The Trump administration issued an Executive Order dated December 11, 2025, directing the U.S. Attorney General to establish an AI Litigation Task Force to preempt state AI laws (EO 14365). Recently, on March 20, 2026, the White House released a National Policy Framework for Artificial Intelligence that directed Congress to preempt the growing patchwork of "burdensome" state AI legislation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.