Dive Brief:
- In the absence of a federal law regulating companies’ use of artificial intelligence, states have stepped in with their own laws, most of them to curb profiling — the use of the technology to sort people into categories to make it easier to sell them products or services or to make hiring, insurance coverage and other business decisions about them, an interactive compilation by the law firm Bryan Cave Leighton Paisner shows.
- “Companies stepping into the AI stream face an uncertain regulatory environment that must be closely monitored and evaluated to understand its impact on risk and the commercial potential of proposed use cases,” BCLP says in introducing its tracker.
- Roughly a third of states have enacted at least one AI law, several of them have more laws in the works, and another third are looking to pass their first law. This means some 30 states could have an AI law on the books soon. The roughly third of states that have no law and none in the works are mostly in the South, Midwest and some Mountain states.
Dive Insight:
California and Colorado lead states with two AI laws each, both of them with AI provisions in broader data privacy laws they’ve passed as well as in stand-alone laws.
California’s 2018 consumer privacy law, the first comprehensive data privacy law enacted in the United States, includes a provision that regulates companies’ use of AI in profiling by allowing consumers to opt out of having the technology make decisions about them based on an analysis of their personal data. It could be in a hiring or other context, like whether they should get health insurance. The opt-out right applies to profiling based on people’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements, BCLP says in its summary of the law.
California’s Bolstering Online Transparency Act, also passed in 2018, regulates a different aspect of AI by prohibiting companies from using a bot to incentivize a sale or transaction of goods or services.
Colorado’s broad data privacy law, which went into effect last year, includes an opt-out provision that’s similar to California’s. “Consumers [have] the right to opt-out of the processing of their personal data for purposes of ‘profiling in furtherance of decisions that produce legal or similarly significant effects,’” the BCLP summary says. The law applies to decisions that impact people’s ability to get insurance, housing or a loan, among other things.
Colorado also has an insurance-specific law that regulates against using AI in a way that would discriminate in coverage decisions.
About a third of states have enacted a comprehensive data privacy law, and most of them — California, Colorado, Connecticut, Delaware, Indiana, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas and Virginia — include a provision that in some way regulates the use of AI in profiling.
Many of the laws under consideration also target profiling, although they don’t all use that term. Georgia, Maine, Maryland, Massachusetts, Pennsylvania, South Carolina, Vermont and Washington are among the states with AI profiling bills pending. A proposed bill in New Mexico would regulate the profiling of children.
Several of the states that have tried and failed to pass an AI bill also focus on profiling. These include Minnesota and Rhode Island. The District of Columbia is among the group, too.
Among other types of AI provisions under consideration are requirements for AI generated products to have a watermark (Ohio) and for the use of AI to be disclosed (Utah) and a restriction on the use of AI generated content in political campaigns within a certain window before an election (Florida). Oklahoma has an AI bill of rights pending that is focused mainly on disclosure — giving consumers the right to be told when AI is in use.
