Key point: Louisiana becomes the 22nd state — and third this year — to enact a consumer data privacy law, adopting a law similar to Texas’ law.
On May 29, 2026, Louisiana Governor Jeff Landry signed the Louisiana Data Privacy Act (SB 386) into law. Louisiana is the 22nd state to pass a broad consumer data privacy law. It is the third state — following Oklahoma and Alabama — to pass a law this year.
The new law largely tracks Texas’ law but with some notable differences we identify below.
Key point: Vermont’s legislature passed a consumer data privacy bill, Illinois’ legislature passed an AI frontier model bill, and eight bills crossed chambers in California.
Below is the 20th update on the status of proposed state privacy and AI legislation in 2026. With state legislative activity slowing, we have combined our weekly privacy and AI posts.
On May 26, 2026, a bipartisan coalition of 44 attorneys general (AGs) issued a letter opposing the federal Kids Internet and Digital Safety Act (KIDS Act), H.R. 7757. The AGs assert that the KIDS Act would preempt their ability to enforce child online safety laws at the state level.
Key point: Connecticut’s new AI law adds to the growing complexity of state laws directed at commonly used automated employment decision tools.
On May 27, 2026, Connecticut Governor Ned Lamont signed SB 5 into law. Connecticut Senator James Maroney authored the bill, which covers several different areas involving the regulation of artificial intelligence (AI), including frontier models, chatbots, employment, and provenance. Lamont also signed into law a companion bill, SB 4, which amends Connecticut’s consumer data privacy law and establishes a data broker registration law. Altogether, the two bills significantly redefine the state’s privacy law and introduce requirements for the use of AI.
In the coming weeks, we will be posting articles analyzing several of the key aspects of these bills. In this first article, we analyze SB 5’s provisions as they relate to the use of automated employment decision technologies (AEDT).
Key point: In response to an open records request submitted by Troutman Pepper Locke, the New Jersey Attorney General’s office provided copies of all cure letters sent pursuant to New Jersey’s consumer data privacy law and resolved by the recipient.
As shown by recent enforcement actions in California, including its most recent $12.5 million fine, the risk for companies that are out of compliance with state consumer data privacy laws has never been higher. As more state laws go into effect and cure periods sunset, the risk will only grow. One state where the enforcement risk may be higher is New Jersey.
Key point: Louisiana’s legislature passed a consumer data privacy bill, five bills crossed chambers in Illinois, nine bills crossed chambers in California, and Delaware’s House passed a bill to significantly amend the state’s consumer data privacy law.
Below is the 19th update on the status of proposed state privacy and AI legislation in 2026.
Key point: Colorado repealed and replaced the Colorado AI Act, Georgia enacted a chatbot law, and California and New York advanced numerous bills.
Below is the 18th update on the status of proposed state privacy and AI legislation in 2026. With the state legislative activity slowing, we have combined our weekly privacy and AI posts.
On May 12, the Colorado legislature passed a bill to replace Colorado’s existing artificial intelligence (AI) law with a more business-friendly regulatory regime focused on disclosures and limited consumer rights but, in doing so, added to the growing complexity of state AI regulation.
On May 18, 2026, from 12:00-1:00 ET
This article was republished on IAPP on May 12, 2026.
Key point: The Colorado legislature passed a bill to replace Colorado’s existing artificial intelligence (AI) law with a more business-friendly regulatory regime focused on disclosures and limited consumer rights but, in doing so, added to the growing complexity of state AI regulation.
On May 12, the Colorado legislature passed SB 189, which repeals and replaces the Colorado AI Act. The bill will next head to Colorado Governor Jared Polis, who is expected to sign it, having been a driving force in the drafting of the bill.
SB 189 removes many of the hallmarks of the Colorado AI Act — such as a duty of care, risk management programs, and impact assessments — in favor of a disclosure-based framework with limited rights in narrow circumstances. That said, the bill’s January 1, 2027, effective date means that it will go into effect — the legislature will not reconvene until January 11, 2027 — thereby ending the uncertainty as to whether a Colorado AI law will go into effect.
The bill is complex, with many intertwined definitions and numerous exceptions. The article below provides an overview of the bill, digging into its many nuances. In addition, on May 18 from 12-1 p.m. ET, David Stauss will be hosting a webinar analyzing the bill. Click here to register.
Although the bill removes and narrows obligations under the existing law, Colorado still will have the most far-reaching legislatively enacted deployer/private sector AI law of any state. Further, the bill’s passage only adds to an increasingly complex state regulatory regime for businesses to navigate when deploying AI systems, including the California Consumer Privacy Act’s risk assessment and automated decision-making technology (ADMT) regulations and, in the employment context, laws in Illinois, New York City, and soon-to-be Connecticut.
Key point: Last week, Connecticut’s legislature passed a bill to amend the state’s consumer data privacy law and establish a data broker registration law, Iowa’s governor signed a chatbot bill into law, Colorado’s legislature passed a pricing bill and is poised to pass a bill to repeal and replace the Colorado AI Act, and Vermont’s legislature passed a health care AI bill.
Below is the 17th update on the status of proposed state privacy and AI legislation in 2026. With the state legislative activity slowing, we have combined our weekly privacy and AI posts.