On August 21, members of Troutman’s Privacy + Cyber + AI team hosted the first of two webinars analyzing the new California Consumer Privacy Act (CCPA) regulations. This webinar focused on the CCPA’s new automated decision-making technology and risk assessment regulations. The webinar recording and slide deck are now available here and here, respectively.
Twenty-three privacy and AI-related bills are set for appropriations committee hearings on August 29 – the deadline for bills to advance out of fiscal committees – while three other bills have passed out of committee and are set for floor votes.
Key point: Starting August 21, Colorado lawmakers will consider four bills that significantly amend the Colorado AI Act.
On August 21, Colorado lawmakers will reconvene for a special legislative session. Earlier this month, Governor Jared Polis called the special session to deal with a nearly $1 billion hole in Colorado’s state budget created by the federal government’s One Big Beautiful Bill (H.R. 1) and to consider amendments to Colorado’s first-in-the-nation Colorado AI Act.
Key point: The scope of Texas’ data broker registration law will change on September 1, 2025.
Two changes to Texas’ data broker registration law go into effect on September 1, 2025.
Key point: The Colorado attorney general’s (AG’s) office is considering amendments to its Colorado Privacy Act (CPA) rules to provide further guidance to controllers subject to the law’s children’s privacy protections.
In late July, the Colorado AG’s office circulated draft amendments to the CPA rules. The draft amendments modify and supplement the existing CPA rules in reaction to the Colorado legislature passing two bills amending the CPA over the prior two sessions. Below, we provide an overview of the draft amendments and relevant context for the rulemaking.
Key point: While no state has passed a new consumer data privacy law in 2025, five states passed bills amending their existing laws.
In recent years, the number of states passing consumer data privacy laws has steadily risen. However, as of today, no state has passed a consumer data privacy law in 2025 (although a handful of states could still do so before year-end). Meanwhile, five states — Colorado, Connecticut, Kentucky, Montana, and Oregon — passed legislation amending their existing laws. Of those five, Connecticut and Montana enacted significant and far-reaching amendments.
Key point: The California legislature is currently considering several privacy-related bills that could impact the private sector.
The California legislature is currently in its summer recess, returning on August 18. Once it returns, it will have approximately five weeks to pass bills prior to closing for the year on September 12.
We are currently tracking 23 private sector AI-related bills and eight privacy-related bills that crossed chambers at the legislature’s deadline. If passed and signed into law, these bills could significantly impact companies doing business in California.
In this two-part series, we provide a brief summary of the bills and their current status. This article focuses on the privacy bills. Our prior article focused on the AI bills. Once the legislature reconvenes, we will provide regular updates on the status of the bills. If you are not already subscribed to this blog, we encourage you to do so to stay up to date.
Key point: Colorado lawmakers will have another opportunity to amend the Colorado AI Act.
On August 6, Colorado Governor Jared Polis announced that he is calling back the Colorado legislature for a special session starting Thursday, August 21, at 10:00 a.m. The special session is primarily directed at dealing with
Key point: The California legislature is considering more than 20 AI-related private sector bills.
The California legislature is currently in its summer recess, returning on August 18. Once it returns, it will have approximately five weeks to pass bills prior to closing for the year on September 12.
Key point: At its July 24 board meeting, the California Privacy Protection Agency Board authorized agency staff to finalize regulations on automated decision-making technology, risk assessments, cybersecurity audits, insurance, and changes to the existing regulations.
At its July 24 meeting, the California Privacy Protection Agency Board authorized agency staff to finalize and submit to the Office of Administrative Law the rulemaking package on various new California Consumer Privacy Act (CCPA) regulations. The new regulations are on automated decision-making technology, risk assessments, cybersecurity audits, insurance, and changes to existing regulations.
In this article, we provide an overview of some of the more notable aspects of the regulations. We also will be hosting a two-part webinar series on August 21 and September 25 to provide a more in-depth analysis of the regulations. Click here for more information and to register.