AI and Data Privacy Laws: CCPA ADMT and Colorado (2027)

As of November 4, 2026, AI and data privacy in the US is mostly a matter of state law: we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems, so the working rules come from state consumer privacy acts, California's CCPA regulations on automated decisionmaking technology (ADMT), Colorado's rewritten automated-decision act (SB 26-189), and FTC enforcement under Section 5 of the FTC Act. Sector statutes such as HIPAA, the Gramm-Leach-Bliley Act and COPPA still apply within their own lanes.

Status as of November 4, 2026: California's ADMT regulations have been in effect since January 1, 2026, but their ADMT duties start January 1, 2027. Colorado's SB 26-189 is signed and scheduled to take effect the same day, and a federal court order bars the Attorney General from starting enforcement for the alleged violations it covers. The FTC's proposed policy statement on AI accuracy is a proposal, and we found no final version in the Federal Register.

This page covers US law and is part of our US data privacy laws guide. For the European rules, see our EU AI Act and data privacy guide. For AI laws beyond privacy, see our US AI laws guide.

US AI Privacy Laws at a Glance

California CCPA ADMT Regulations: What They Require

The California Privacy Protection Agency's board adopted the regulations on July 24, 2025, the Office of Administrative Law approved them on September 22, 2025, and they took effect January 1, 2026. The section numbers below follow the agency's regulations as effective January 1, 2026.

The CPPA and the Attorney General enforce the CCPA. The CCPA applies to for-profit businesses that do business in California and have annual gross revenue over $26,625,000 (the CPPA's adjusted figure effective January 1, 2025, adjusted every odd-numbered year; the Attorney General's CCPA page still showed $25 million on November 4, 2026), buy, sell or share the personal information of 100,000 or more California residents or households, or derive 50% or more of annual revenue from selling such information. The Attorney General's page says the CCPA generally does not apply to nonprofits or government agencies, and that it exempts certain types of information, such as certain medical information and consumer credit reporting information.

What Counts as ADMT Under the CCPA?

Section 7001(e) defines ADMT as "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking."

"Substantially replace" means the business uses the output to make a decision without human involvement. Human involvement requires a reviewer who knows how to interpret and use the output, reviews and analyzes it along with other relevant information, and has the authority to make or change the decision.

So a tool that only assists a real human decisionmaker can fall outside the definition. Profiling counts when it replaces or substantially replaces human decisionmaking. The definition excludes items such as web hosting, firewalls, spam filtering, spellchecking, calculators, databases and spreadsheets, provided they do not replace human decisionmaking.

What Is a Significant Decision?

The duties attach only to a significant decision. Section 7001(ddd) defines that as "a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services."

Insurance is not on the list. Housing excludes a decision "based solely on the availability or vacancy of the housing or the successful receipt of payment."

Pre-Use Notice, Opt-Out, Appeal and Access

A business covered by section 7200 owes three things:

• Pre-use notice (section 7220). It must be presented "prominently and conspicuously" at or before the point the business collects the personal information it plans to process with ADMT. It must state the specific purpose in plain language, not generically, and describe the opt-out or the exception relied on, the right to access ADMT information, and the bar on retaliation.
• Opt-out (section 7221). The business must offer two or more methods. An online business must offer an interactive form through a link in the notice. A cookie banner alone is not an acceptable method, and the business cannot require an account.
• Access (section 7222). On request, the business must explain the specific purpose, the logic of the ADMT, and the outcome for that consumer, in plain language.

Human review is not a separate universal right in this text. It is one way out of the opt-out. Section 7221(b) excuses the opt-out in three situations:

• The business offers an appeal to a human reviewer "who has the authority to overturn the decision," with a designated reviewer and an easy appeal method.
• For admission, acceptance or hiring decisions, the business uses the ADMT solely to assess ability to perform at work or in an educational program, and the ADMT works for that purpose and does not unlawfully discriminate based on protected characteristics.
• For allocation or assignment of work and compensation decisions, the business uses the ADMT solely for that purpose, and it works for that purpose and does not unlawfully discriminate based on protected characteristics.

Risk Assessments and Key California Dates

Section 7150 requires a risk assessment before a business starts processing that presents significant risk. The list includes selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, and certain automated inferences about applicants, students, employees and contractors or based on presence in a sensitive location. It also includes the training uses described in the training data section below.

For the rest of California's AI statutes, see our California AI laws guide.

State Privacy Laws and AI: Which States Give a Profiling Opt-Out?

The table below lists only acts whose text was read for this page. It is not a list of every state privacy law, and a state's absence, New Jersey's for example, means nothing about what its law says. For the wider comparison, see our state privacy laws comparison.

The standard clause lets a consumer opt out of profiling "in furtherance of decisions that produce legal or similarly significant effects." The words around that phrase set its reach, and so does each act's definition of profiling. An opt-out limited to "solely automated" decisions, or to profiling defined as "solely automated processing", may not reach a decision where a person takes part. These acts are privacy laws, and most of them never use the term AI.

Two texts we read do not have this opt-out:

• Iowa. Iowa Code 715D.3 ends its list of rights with an opt-out of the sale of personal data.
• Utah. Utah Code 13-61-201, in the version effective July 1, 2026, gives an opt-out of targeted advertising and sale.

Extra Rights in Some States

Minnesota and Connecticut go past the opt-out. Minn. Stat. 325M.14 subd. 1(g) gives a right to question the result of profiling, to be informed of the reason for the decision and, if feasible, what could have been done differently, and to review the data used. Inaccurate data can be corrected and the decision reevaluated, as the subdivision provides.

Connecticut's PA 25-113 adds a right to question the result of such profiling and be informed of the reason. It also allows review of the personal data used and, if the decision concerned housing, correction of incorrect data.

Who These Acts Leave Out

Thresholds and exclusions are part of the rule. Virginia's act, for example, reaches a business that controls or processes the personal data of at least 100,000 consumers in a year, or 25,000 consumers plus over 50 percent of gross revenue from selling personal data (Va. Code 59.1-576).

Virginia's "consumer" does not include a person "acting in a commercial or employment context" (Va. Code 59.1-575). Delaware's definition uses the same words. So an opt-out in those acts is not a general right for workers or job applicants.

Virginia's definition of a qualifying decision lists financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, and access to basic necessities such as food and water. That list includes insurance, which California's list does not.

Colorado SB 26-189: The Automated Decision Law

SB 26-189 (Ch. 131, Laws 2026), signed May 14, 2026, repeals and reenacts Colorado's 2024 AI Act (SB 24-205), effective January 1, 2027. It applies to consequential decisions made on or after that date. As of November 4, 2026, Colorado is the only state we found with a cross-sector statute on automated decisions, among the state laws reviewed for our national guide. That review was not a full-text search of every state code.

The rewritten law covers automated decision-making technology used to materially influence a consequential decision in seven domains: education, employment, residential real estate, financial or lending services, insurance, health care, and essential government services. Its definition of ADMT reaches output used to "make, guide, or assist" a decision, a wider phrase than California's "replace" test.

Duties under the act include:

• Notice before a deployer uses covered ADMT to materially influence a consequential decision.
• Adverse-outcome explanation "within thirty days after making the decision."
• Consumer rights after an adverse outcome to get instructions for requesting and correcting personal data, with correction not reaching opinions, predictions or scores, plus "meaningful human review and reconsideration" to the extent commercially reasonable.
• Developer documentation for deployers, and record retention for at least three years.

The Attorney General enforces the act, and it says it creates no new private right of action. A 60-day cure applies only if a cure is deemed possible, and that subsection is repealed January 1, 2030. HIPAA covered entities and business associates are outside sections 6-1-1701 to 6-1-1706, except for employment decisions, and insurers subject to C.R.S. 10-3-1104.9 are treated as compliant in the practice of insurance. A covered entity must still give patients a general notice of its use of advanced technologies, including covered ADMT, and specific disclosures when covered ADMT determines eligibility for financial assistance.

The law is scheduled to take effect January 1, 2027, but a stipulated federal court order in X.AI LLC v. Weiser (D. Colo. 1:26-cv-01515) bars the Attorney General from starting enforcement, including investigations, for alleged violations that occurred or may occur on or before 14 days after a ruling on xAI's expected preliminary injunction motion. The order made no finding on the law's validity. The Attorney General's rules (4 CCR 904-6) were heard October 26, 2026, and that page showed no adoption as of November 4, 2026.

Colorado's general privacy act is separate and already has the profiling opt-out in the table above. Full detail is in our Colorado AI laws guide.

FTC Enforcement: Algorithm Deletion Orders and the Rytr Reversal

The FTC acts case by case under Section 5 of the FTC Act, and under COPPA for children's data. Its best-known privacy remedy requires a company to delete algorithms built from the data at issue. Commentators call this algorithmic disgorgement, and the FTC used that phrase, with a broader meaning, in a 2022 rulemaking notice. These are the terms of particular orders, not a general rule.

• WW International and Kurbo (2022). The order required the company to "destroy any algorithms derived from the data," with a $1.5 million penalty.
• Rite Aid (2023-2024). The FTC's December 2023 release said Rite Aid would be barred from using facial recognition for surveillance purposes for five years. It would also have to delete images collected through the system and any algorithms developed from them. This is a stipulated federal court order in FTC v. Rite Aid, No. 2:23-cv-5023 (E.D. Pa.).
• Amazon and Alexa (2023). The FTC's release describes a $25 million civil penalty and a bar on using certain children's data "to train its algorithms."

The Rytr Reversal

Rytr was one of five cases in Operation AI Comply, announced September 25, 2024. The FTC issued a final order on December 18, 2024. On December 22, 2025, it reopened and set aside that order, saying "the complaint failed to satisfy the legal requirements of the FTC Act" and that the order "unduly burdens artificial intelligence (AI) innovation."

That action concerned Rytr's order. Rite Aid, WW and Amazon are separate matters. The FTC said it will still pursue those who use AI to break the law or who misrepresent generative AI capabilities.

Other Recent FTC AI Actions

The FTC's AI page lists these, among others:

• A Workado final order, dated August 21, 2025 and announced August 28, over claims about the accuracy of an AI content detector.
• Orders to AI companion chatbot companies on September 11, 2025, under Section 6(b), an information-gathering power.
• An Air AI settlement on March 24, 2026.
• Settlements over "Active Listening" claims with Cox Media Group and two other firms on May 21, 2026, made final August 27, 2026.

AI Training Data and Consent in the US

No single US rule answers whether a company needs consent to train AI on personal data. We found no federal statute in the public laws of the 119th Congress setting general rules for private AI systems, so the answer depends on the data, the company and the state.

• Connecticut. Under PA 25-113, effective July 1, 2026, a privacy notice must include "a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models." That is a disclosure duty, not a consent rule. The act applies only to controllers that meet its thresholds.
• California risk assessments. Section 7150(b)(6) lists processing personal information the business intends to use to train ADMT for a significant decision, or to train facial-recognition, emotion-recognition or other technology that verifies identity or conducts physical or biological identification or profiling.
• California AB 2013. Developers of generative AI systems must post training-data documentation (Civ. Code 3110-3111). A federal judge denied xAI a preliminary injunction on March 4, 2026, and the Ninth Circuit has set argument in No. 26-1591 for November 18, 2026, on the docket entries we read through October 21, 2026.
• Oregon guidance. The Attorney General's December 24, 2024 guidance says entities "must first obtain explicit consent from consumers before using that data to develop or train AI models," speaking of sensitive data. That is the agency's reading, not a separate statute.

Copyright claims over AI training are a different question, covered in our US AI laws guide.

HIPAA and GLBA: Where Health and Financial Data Fit

HIPAA. Under 45 CFR 164.502(a), a covered entity or business associate may use or disclose protected health information only as the Privacy Rule permits or requires, which includes treatment, payment and health care operations as the rule provides. Section 164.508(a)(1) generally requires a valid authorization for other uses. Those two sections, in the 2024 CFR edition we read, do not mention artificial intelligence, so whether a given AI use fits depends on the rule's existing categories.

GLBA. Under 15 U.S.C. 6802, a financial institution generally may not disclose nonpublic personal information to a nonaffiliated third party without giving notice and a chance to opt out, subject to the exceptions in the statute.

State carve-outs. Many state privacy rights stop where these laws begin, and the design varies. Virginia excludes any financial institution or data subject to GLBA and any HIPAA covered entity or business associate. Connecticut's PA 25-113 deleted the phrase covering a "financial institution or data" under GLBA, kept an exclusion for data subject to GLBA, and added listed insurers, banks and securities firms. Our US AI laws guide covers state laws on AI in health care.

Federal Preemption Pressure on State AI Laws

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems or generally preempts state AI laws. In December 2025, Executive Order 14365 directed federal agencies to challenge or discourage state AI laws the administration views as conflicting with national policy, and called for a federal framework from Congress. The order itself does not declare any state law invalid.

The Justice Department formed an AI Litigation Task Force in January 2026, the White House issued legislative recommendations in March 2026, and the FTC proposed a policy statement in July 2026. Separately, in April 2026 the Justice Department intervened in a lawsuit against Colorado's AI law under the Civil Rights Act of 1964. We did not find a published Commerce evaluation of state laws in the Federal Register or on ntia.gov, or a BEAD notice carrying the order's AI condition on NTIA's sites.

The FTC's proposed statement, 91 FR 41638, says "State law is impliedly preempted to the extent it conflicts with a Federal regulatory scheme," and it names "Colorado's recently revised Artificial Intelligence Act." That is a proposed statement of the agency's views. Details are on our pages on Trump's AI executive orders and state AI law preemption.

What Changes in AI Privacy Law in 2027

These dates come from the laws and dockets cited above. Each is scheduled, not yet in effect, as of November 4, 2026.

Pending items have no fixed date. Colorado's final rules start a 28-day clock for xAI's injunction motion once adopted. The FTC could finalize its proposed statement. Our AI hiring laws guide tracks the employment dates.

What You Can Do If AI Made a Decision About You

Start with the company's privacy notice, which should explain how to send a privacy request. In a state with a profiling opt-out, ask to use it and ask which data was used.

California's Attorney General says consumers cannot sue businesses for most CCPA violations, with a limited exception for certain data breaches, and points to complaints with the Attorney General and the CPPA. Colorado's act also creates no new private right of action. A state attorney general's consumer office is the usual place to report a problem, and a local bar referral service may help if the decision raises an employment, housing or lending claim.

Our guide on how to file a data privacy complaint walks through the steps.

Change Log

• November 4, 2026: Rewrote this page around US rules. Added the state profiling opt-out table, California's ADMT dates and exceptions, the Rytr reversal, HIPAA and GLBA carve-outs, and corrected statements on Colorado's 2024 act, California's insurance coverage, and Amazon's order. Moved EU material to our EU guide.
• August 28, 2026: Clarified that California's automated-decision opt-out comes from the CPPA regulations and does not bind businesses until January 1, 2027.
• August 14, 2026: Corrected citations for Connecticut and Texas AI laws and replaced dead source links.

This page is general legal information, not legal advice, and covers US federal and state law as read on November 4, 2026. For advice on your situation, speak with a lawyer licensed in your state.

Related news

• Supreme Court Upholds FCC Fines Over Carrier Location Data (2026)

Frequently Asked Questions

Is there a federal AI privacy law in the US?

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems. Sector laws such as HIPAA, the Gramm-Leach-Bliley Act and COPPA still apply, and the FTC acts under Section 5 of the FTC Act.

When do California's ADMT regulations take effect?

The regulations took effect January 1, 2026. A business already using ADMT for a significant decision must comply with the ADMT duties by January 1, 2027, and a later user must comply whenever it uses ADMT for a significant decision.

What is ADMT under the CCPA?

ADMT is technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. A tool used with genuine human involvement, by a reviewer who can interpret the output and has authority to change the decision, does not substantially replace human decisionmaking.

Does the CCPA ADMT rule cover insurance decisions?

Insurance is not listed in the regulation's definition of a significant decision, which covers financial or lending services, housing, education, employment or independent contracting, and healthcare services.

Can I opt out of AI decisions in the US?

It depends on the state and the decision. From January 1, 2027, California's rules give an opt-out for significant decisions, subject to exceptions including a human appeal. Many state privacy acts give an opt-out of profiling for decisions with legal or similarly significant effects, and some reach only solely automated decisions or solely automated profiling. We found no federal opt-out right in the statutes we reviewed.

Does every state privacy law include a profiling opt-out?

No. The Iowa Code section we read has no profiling opt-out, and Utah Code 13-61-201 gives an opt-out of targeted advertising and sale only.

When does the Colorado AI law take effect?

SB 26-189 is scheduled to take effect January 1, 2027, for consequential decisions made on or after that date. A stipulated federal court order bars the Attorney General from starting enforcement for alleged violations occurring on or before 14 days after a ruling on xAI's expected injunction request, so that date is not the start of enforcement.

What is algorithmic disgorgement?

It is a label used by commentators, and by the FTC in a 2022 rulemaking notice with a broader meaning, for orders requiring a company to delete algorithms derived from the data at issue, as in the WW International matter. Rite Aid's order reached algorithms developed from images collected through its facial recognition system. Each requirement is a term of a particular order. No general rule applies it to every company.

Why did the FTC set aside the Rytr order?

On December 22, 2025, the FTC reopened and set aside its 2024 order, saying the complaint failed to satisfy the legal requirements of the FTC Act and that the order unduly burdened AI innovation. The FTC said it would still pursue those who use AI to break the law or misrepresent generative AI capabilities.

Can companies use my data to train AI without my consent?

No single US rule answers this. It depends on the data, the company and the state. Connecticut requires a privacy-notice statement about training large language models, California requires risk assessments for certain training, and Oregon's Attorney General says sensitive data needs explicit consent first.

Do HIPAA and GLBA apply to AI?

They apply to the data and entities they cover, whatever tool is used. The HIPAA sections we read do not mention AI. Many state privacy acts carve out HIPAA entities or GLBA data, but the design varies by state.