Last month, we attended the IAPP Global Privacy Summit in Washington, DC. Of the panels we attended, one of them was States and Forging Ahead: Trends and Emerging Frameworks in State AI Legislation. The panel highlighted the evolving landscape of state-level AI laws.
When asked about common themes in AI legislation, panelists indicated that states are introducing bills that intertwine privacy and consumer protection. Matthew Scherer of CDT stated that “a lot of companies don’t realize how much privacy and autonomy matters” to employees and consumers. He cited a CDT study which indicated that 70% of people oppose rewards programs offering discounts in exchange for personal data. He also noted that employers are commonly “trying to collect more and more data that may indicate how someone will perform,” which he described as a flawed practice since human behavior is unpredictable and performance cannot be measured through one’s personal data. This disconnect has fueled public demand for stronger safeguards.
Transparency is another priority. Many consumers and workers are unaware that AI influences decisions like job or housing opportunities. Scherer argued that transparency requirements—mandating disclosures when AI makes consequential decisions—are essential. Without them, public frustration could lead to overly stringent laws down the line. Christina Montgomery added that at IBM, they proactively disclose AI use on their websites, hoping to set a precedent for other companies. Ultimately, not all thought leaders in the AI space share this viewpoint. During Sam Altman’s presentation during the closing ceremony, he stated that lawmakers and companies should take a dynamic response to AI regulation because “it’s difficult to predict the negative risks in advance. Technology and society evolve together and even while trying to put up guardrails in advance, people’s behaviors are going to change.”
When asked which state is leading the charge in AI legislation, Scherer voted Colorado. Since the passage of the Colorado AI Act last year, 18 bills have been introduced across 13 states modeling the Colorado legislation. Unlike narrower regulations, Colorado’s law protects consumers and workers broadly, focusing on mitigating harm from AI applications. While tech lobbyists put the pressure on Denver to weaken the law, the bill’s amendment introduced earlier this month ultimately failed to pass, leaving the bill in its current form.
With federal inaction persisting, it is up to states like Colorado to lead the charge in AI governance. The panelists agree that federal inaction will likely persist and that a massive backlash against big tech would be the only way to spur Congress to act.