Key point: Colorado repeals and replaces the Colorado AI Act, Georgia enacts a chatbot law, and California and New York advance numerous bills.
Below is the eighteenth update on the status of proposed state privacy and AI legislation in 2026. With the state legislative activity slowing, we have combined our weekly privacy and AI posts.
What’s New
The big news last week was the Colorado legislature passing a bill to repeal and replace the Colorado AI Act, which the governor quickly signed into law. You can read our analysis of the new law here. Before closing for the year, Colorado’s legislature also passed a chatbot bill and two health care related AI bills.
Moving east, Georgia became the most recent state to enact a chatbot bill with Governor Brian Kemp signing SB 540 into law.
In California, May 15 was the last day for fiscal committees to hear and report to the floor bills introduced in their house. That led to a flurry of activity with 17 bills advancing out of Appropriations committees. Full details on those bills below. Meanwhile, the California Assembly passed a bill to prohibit an operating system or an application from undoing a user’s affirmative configuration of a user’s privacy setting without the user’s consent. Looking ahead, May 29 is the deadline for bills to pass out of their chamber of origin.
With the New York legislature closing early next month, numerous bills advanced. New York’s Senate passed three bills. One requires retailers to post warning signs of the tracking and collection of customers’ biometric data through electronic devices. The other two bills deal with pricing. Six bills also advanced out of committees. Full details on those bills below.
More details on those bills plus updates on all bill movements last week in the below post.
Privacy Updates
Consumer Data Privacy
Two bills to amend the California Consumer Privacy Act (CCPA) passed out of Appropriations committees. In the Senate, SB 923 amends the CCPA’s deletion provisions. In the Assembly, AB 1542 prohibits selling or sharing sensitive personal information to a third party.
In Illinois, SB 340 was amended and is now a consumer data privacy bill.
Kid’s Privacy
In California, two bills advance out of the Assembly Appropriations Committee: AB 1709 (covered platforms: age restriction: e-Safety Advisory Commission) and AB 2246 (online service, product, or feature: access by children).
Louisianna’s bill (HB 977) to repeal and replace its app store law passed the legislature.
Biometric Privacy
New York’s S 2539 passed the Senate. The bill requires retailers to post warning signs of the tracking and collection of customers’ biometric data through electronic devices.
Meanwhile, the New York Senate Consumer Protection Committee voted out S 1422. That bill establishes the Biometric Identifier Privacy Act.
Consumer Health Data Privacy
New York’s A 10357 passed out of the Assembly Science and Technology Committee.
Other
California’s AB 2561 unanimously passedthe Assembly. This bill prohibits an operating system or an application from undoing a user’s affirmative configuration of a user’s privacy setting without the user’s consent. The bill defines “privacy setting” to mean any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information.
AI Updates
High Risk / Consequential Decisions
Colorado’s bill (SB 189) to repeal and replace the Colorado AI Act passed the legislature and was signed into law. You can read our analysis of the law here.
In New York, S 8115 was voted out of the Senate Banks Committee and referred to the Internet and Technology Committee. Its Assembly companion (A 773) is on a third floor reading. The bills relate to the use of automated lending decision-making tools by banks for the purposes of making lending decisions.
A new bill (S 4279) was filed in New Jersey to prohibit a covered entity or a covered entity’s agent, third-party vendor, model developer, or external data source from using an automated decision system in a manner that results in a disparate impact on a protected class.
Chatbot
Georgia’s chatbot bill (SB 540) was signed into law.
Colorado’s chatbot bill (HB 1263) passed the legislature.
Five California chatbot bills passed out of Appropriations committees: AB 1988 (companion chatbots: crisis interruption pauses); SB 867 (toys: companion chatbots); AB 2023 (companion chatbots: children’s safety); SB 1119 (companion chatbots: children’s safety); and AB 1609 (customer service chatbots).
A New York bill (S 4279) to impose liability for damages caused by a chatbot impersonating certain licensed professionals unanimously passed out of Assembly Science and Technology Committee.
Pricing
Two New York bills passed the Senate – S 8616 (Protecting Consumers and Jobs from Discriminatory Pricing Act) and S 8483 (prohibits online retailers from basing prices on certain criteria) – while two bills passed out of the Assembly Consumer Affairs and Protection Committee – A 9396 (electronic shelving labels) and A 9349 (surveillance pricing).
California’s AB 2564 (surveillance pricing) passed out of the Assembly Appropriations Committee.
Disclosures
California’s SB 1000 (amends California AI Transparency Act) passed out of the Senate Appropriations Committee.
Employment
In California, two bills passed out of Appropriations committees: SB 947 (employment: automated decision systems) and AB 1883 (workplace surveillance tools).
Health
Two Colorado bills passed the legislature: HB 1139 (Use of AI in Health Care) and HB 1195 (Psychotherapy AI Restrictions).
In California, four bills passed out of Appropriations committees: SB 903 (mental health professionals: AI); SB 1146 (advertisement claims: health-related consumer products and services: digital replicas and synthetic performers); AB 2575 (health care services: AI); and AB 1979 (health care services: AI).