Good decisions depend on good data. Football coaches study film to learn what an opponent calls on third-and-long so they can deploy the right defense. Businesses collect vast amounts of data to develop and market new products. No general counsel (GC) would approve a major business decision without first gathering the available facts and conducting the necessary legal research. Yet GCs make high-stakes regulatory decisions every day without a complete, data-driven picture of the enforcement landscape. Sometimes the gamble pays off, but when it does not, it can cause serious problems for the company.

KEYPOINT: A recent putative class action filed in the U.S. District Court for the Northern District of California against OpenAI highlights the challenges artificial intelligence (AI) providers face in restricting minors’ access to their services, and underscores the importance of maintaining guardrails that actually enforce a service’s terms and conditions.

Key Point: In a significant ruling for the AI industry, the Ninth Circuit vacated a preliminary injunction against Perplexity AI, holding that Amazon was unlikely to succeed on its Computer Fraud and Abuse Act (CFAA) and California Comprehensive Data Access and Fraud Act (CDAFA) claims. The court concluded that Perplexity’s AI Assistant is a “tool, not a person” for statutory purposes, and that it is the user who “accesses” websites visited using the AI-powered Comet browser. The decision provides the first major appellate guidance on how the CFAA applies to agentic AI systems, though the court was careful to cabin its holding to the specific facts presented.

We have now had a bit of time to work with clients on the new Colorado Automated Decision-Making Technology in Consequential Decisions Bill (SB 26-189) (ADMT law” — replacing the CO AI Act). The sausage making and behind-the-scenes political machinations were interesting to watch unfold. Ultimately, the ADMT law succeeds in narrowing or eliminating many of the more onerous requirements of the CO AI Act, including disparate impact risk assessment requirements, notification obligations to the Attorney General upon discovery of algorithmic discrimination (within 90 days), and the AI framework-compliance affirmative defense.

Key point: Vermont’s legislature passed a consumer data privacy bill, Illinois’ legislature passed an AI frontier model bill, and eight bills crossed chambers in California.

Below is the 20th update on the status of proposed state privacy and AI legislation in 2026. With state legislative activity slowing, we have combined our weekly privacy and AI posts.

In this episode of The Consumer Finance Podcast, Chris Willis and Kim Phan unpack Colorado’s brand-new Automated Decision-Making Technology (ADMT) Act, which repeals and replaces the state’s much-criticized 2024 AI law. They explain the shift from “high-risk AI systems” to the broader ADMT framework, what it means for consequential decisions in lending and financial services, and how the statute’s “material influence” standard can sweep in tools that do far more than make final credit determinations.

Key point: Connecticut’s new AI law adds to the growing complexity of state laws directed at commonly used automated employment decision tools.

On May 27, 2026, Connecticut Governor Ned Lamont signed SB 5 into law. Connecticut Senator James Maroney authored the bill, which covers several different areas involving the regulation of artificial intelligence (AI), including frontier models, chatbots, employment, and provenance. Lamont also signed into law a companion bill, SB 4, which amends Connecticut’s consumer data privacy law and establishes a data broker registration law. Altogether, the two bills significantly redefine the state’s privacy law and introduce requirements for the use of AI.

In the coming weeks, we will be posting articles analyzing several of the key aspects of these bills. In this first article, we analyze SB 5’s provisions as they relate to the use of automated employment decision technologies (AEDT).

Key point: Louisiana’s legislature passed a consumer data privacy bill, five bills crossed chambers in Illinois, nine bills crossed chambers in California, and Delaware’s House passed a bill to significantly amend the state’s consumer data privacy law.

Below is the 19th update on the status of proposed state privacy and AI legislation in 2026.