<\/p>\n
For data privacy laws outside the United States, see our World Data Privacy Laws guide covering GDPR, national data protection laws, and regulatory frameworks in 70+ countries. A privacy impact assessment (PIA) is a critical tool to determine where data is processed, stored, and who has access to it. As part of this exercise, organizations should map data flows and identify service providers that may be subject to foreign legal regimes. The Office of the Privacy Commissioner of New Zealand also released specific guidance on the intersection of AI and the 13 information privacy principles enshrined in its Privacy Act 2020. Building upon its earlier statement of expectations around the use of generative AI, the OPC’s full set of guidance is based on the principle that “privacy is a good starting point” when an organization is considering uptake of any new AI tool. Before turning to AI, organizations should do a preliminary assessment of necessity and proportionality and consideration of alternatives.<\/p>\n<\/p>\n
So, healthcare organizations should monitor state legislative developments closely and build processes capable of accommodating stricter standards before they become legally required, Levine said. Data privacy risk is increasing in 2026, even as the pace of new legislation slows. While no new comprehensive state privacy laws were enacted in 2025, state regulators are shifting their focus to refining and enforcing the laws already on the books. Two data privacy bills set to be introduced Wednesday and shared first with CNBC would preempt nearly two dozen state laws to create a national standard limiting how tech and finance companies handle user data. Because the Act is still in discussion draft, the next steps are not yet set. Because of the implication for both companies and consumers, Americans should carefully follow the discussions, and companies should begin preparing to follow the regulations if passed, which would go into effect 180 days after approval.<\/p>\n<\/p>\n
<\/p>\n
Your team gets flexibility and convenience, and you can reduce the cost and admin of issuing and maintaining company-owned… The right set depends on what you collect, how you use it, and what systems you rely on. This is also a good time to check your contracts and ensure you have clear terms about confidentiality, security, and responsibility if there\u2019s a breach. This inventory becomes the foundation for your Privacy Policy, collection notices, retention plan, and breach response plan.<\/p>\n<\/p>\n
2 The Minnesota Consumer Data Privacy Act extends the right to opt-out of profiling by affording consumers the right to access and question the results of a controller’s profiling. Also, Minnesota’s law only exempts non-profit organizations established to detect and prevent fraudulent acts in connection with insurance. Other non-profits may fall within the scope of the law, but further guidance is necessary. Senate Bill S8391 strengthens New York\u2019s right of publicity protections for deceased performers in the AI era. Critically, the law now requires prior consent from a deceased performer\u2019s heirs before using their digital replica in audiovisual works, sound recordings, or live musical performances\u2014replacing the previous framework that merely required disclaimers. Platforms displaying such works must remove unauthorized content upon receiving good-faith notice from rights holders.<\/p>\n<\/p>\n
That said, a number of the states\u2019 regulations don\u2019t specify how consent or opting out must be handled, what form that needs to take, etc. A high performance Consent Management Platform, like Usercentrics CMP, can help companies flexibly and scalably provide the required notifications and consent options for states where they need to comply with privacy regulations. Each state manages enforcement of the data privacy law, including investigations and penalties. The creation of the California Privacy Protection Agency (CPPA), now publicly known as CalPrivacy, was included in the CPRA. To date it is the only state with a separate agency to enforce privacy law, though it does work in conjunction with the California Attorney General\u2019s office. All the other states have these functions solely under the Attorney General\u2019s office.<\/p>\n<\/p>\n
On December 11, 2025, President Trump signed an executive order establishing federal policy to preempt state AI regulations deemed to obstruct national competitiveness. The order directs the Attorney General to establish an AI Litigation Task Force to challenge state laws on grounds including unconstitutional regulation of interstate commerce. The Secretary of Commerce must evaluate existing state AI laws within 90 days, identifying those requiring AI models to alter truthful outputs or compelling disclosures that potentially violate the First Amendment. The order conditions certain federal funding on states not enacting conflicting AI laws and directs the FTC to issue guidance on when state laws mandating alterations to AI outputs are preempted by federal prohibitions on deceptive practices.<\/p>\n<\/p>\n
<\/p>\n
<\/p>\n
These bills largely mimic existing comprehensive privacy laws passed since 2018. However, states can still pass their own privacy laws in some instances, such as civil rights and consumer protections. When crafting the APRA, lawmakers preserved standards from key states, such as California, Illinois and Washington. A sweeping new federal legislative proposal could reshape how American companies collect, use, and profit from consumer data.<\/p>\n<\/p>\n