Photo of David Stauss

David Stauss

Subscribe to David Stauss's Posts

David guides clients as they navigate the complexities of privacy and cyber law. His straightforward advice and thorough approach are a benefit to clients as they confront their toughest challenges.

Follow:Read more about David StaussDavid's Linkedin Profile

Key point: The Colorado legislature passed a bill to replace Colorado’s existing artificial intelligence (AI) law with a more business-friendly regulatory regime focused on disclosures and limited consumer rights but, in doing so, added to the growing complexity of state AI regulation.

On May 12, the Colorado legislature passed SB 189, which repeals and replaces the Colorado AI Act. The bill will next head to Colorado Governor Jared Polis, who is expected to sign it, having been a driving force in the drafting of the bill.

SB 189 removes many of the hallmarks of the Colorado AI Act — such as a duty of care, risk management programs, and impact assessments — in favor of a disclosure-based framework with limited rights in narrow circumstances. That said, the bill’s January 1, 2027, effective date means that it will go into effect — the legislature will not reconvene until January 11, 2027 — thereby ending the uncertainty as to whether a Colorado AI law will go into effect.

The bill is complex, with many intertwined definitions and numerous exceptions. The article below provides an overview of the bill, digging into its many nuances. In addition, on May 18 from 12-1 p.m. ET, David Stauss will be hosting a webinar analyzing the bill. Click here to register.

Although the bill removes and narrows obligations under the existing law, Colorado still will have the most far-reaching legislatively enacted deployer/private sector AI law of any state. Further, the bill’s passage only adds to an increasingly complex state regulatory regime for businesses to navigate when deploying AI systems, including the California Consumer Privacy Act’s risk assessment and automated decision-making technology (ADMT) regulations and, in the employment context, laws in Illinois, New York City, and soon-to-be Connecticut.

Key point: Last week, Connecticut’s legislature passed a bill to amend the state’s consumer data privacy law and establish a data broker registration law, Iowa’s governor signed a chatbot bill into law, Colorado’s legislature passed a pricing bill and is poised to pass a bill to repeal and replace the Colorado AI Act, and Vermont’s legislature passed a health care AI bill.

Below is the seventeenth update on the status of proposed state privacy and AI legislation in 2026. With the state legislative activity slowing, we have combined our weekly privacy and AI posts.

Key point: Connecticut’s AI bill passed the legislature, Maryland’s pricing bill was signed into law, Colorado’s AI Act replacement bill was introduced, and chatbot bills advanced in several states.

Below is the 16th update on the status of proposed state AI legislation in 2026. These posts track state AI bills that can directly or indirectly affect private-sector AI developers and deployers. These posts do not track AI bills that focus on government use of AI; insurance; workgroups; education; legal settings; name, image, and likeness; deepfakes; CSAM and sexual material; and election interference. As always, the contents provided below are time-sensitive and subject to change.

Key point: Colorado’s legislature passed an age attestation bill while Michigan’s Senate passed a Kids Code Act.

Below is the 16th update on the status of proposed state privacy legislation in 2026. This post covers updates on proposed bills dealing with consumer data privacy, children’s privacy, biometric privacy, data brokers…

Key point: Bills advanced last week in Connecticut, Colorado, and California while Florida lawmakers will return for a special session this week and consider an AI Bill of Rights.

Below is the fifteenth update on the status of proposed state AI legislation in 2026. These posts track state AI bills that can directly or indirectly affect private-sector AI developers and deployers. These posts do not track AI bills that focus on government use of AI; insurance; workgroups; education; legal settings; name, image, and likeness; deepfakes; CSAM and sexual material; and election interference. As always, the contents provided below are time-sensitive and subject to change.

Key point: Connecticut’s Senate passed a bill to amend the state’s consumer data privacy law and create a new data broker registration law while bills advanced in California, Colorado, Delaware, and Louisianna.

Below is the fifteenth update on the status of proposed state privacy legislation in 2026. This post covers updates on proposed bills dealing with consumer data privacy, kid’s privacy, biometric privacy, data brokers, and consumer health data privacy. As always, the contents provided below are time-sensitive and subject to change.

Nebraska State Flag, United States, 3D Render

Key point: The amendment significantly expands the existing law’s applicability, redefines “covered design feature,” creates two new prohibitions, and adds a new deletion right.

On April 17, 2026, Nebraska Governor Jim Pillen signed LB 838 into law. The omnibus bill addresses several different topics but, as is relevant here, it amends Nebraska’s Age-Appropriate Online Design Code Act, Neb. Rev. Stats. § 87-1301, et seq, which only went into effect on January 1, 2026. We provided an overview of the existing law here. The amendment goes into effect three months after the legislature’s April 17 adjournment date, on July 17, 2026.

The article below provides a summary of the changes.

Key point: Nebraska (chatbot) and Maine (health) enacted laws last week, while more than a dozen bills advanced in other states.

Below is the 14th update on the status of proposed state AI legislation in 2026. These posts track state AI bills that can directly or indirectly affect private-sector AI developers and deployers. These posts do not track AI bills that focus on government use of AI; insurance; workgroups; education; legal settings; name, image, and likeness; deepfakes; CSAM and sexual material; and election interference. As always, the contents provided below are time-sensitive and subject to change.