Artificial intelligence privacy in the United States is not governed by a single statute. Instead, the AI privacy laws that apply to you are a layered mix: the Federal Trade Commission Act at the federal level, sector-specific rules for children’s and health data, roughly 20 state comprehensive privacy statutes, a smaller set of AI-specific and biometric state laws, and international frameworks like the EU’s GDPR and AI Act that reach any company processing data across borders. Which protections you can actually use depends on where you live, what kind of data is involved, and how the AI system uses it.
The Federal Baseline
The Federal Trade Commission is the closest thing the country has to a federal AI privacy regulator, even though its authority predates machine learning by decades. Section 5 of the FTC Act prohibits unfair or deceptive business practices, and the agency uses that mandate against companies that misrepresent how their algorithms collect, store, or use personal data.1Office of the Law Revision Counsel. 15 U.S. Code 45 – Unfair Methods of Competition Unlawful; Prevention by Commission If a company advertises privacy protections that its AI product doesn’t actually deliver, the FTC can investigate and sue.
The financial stakes are real. Violating a final FTC order carries an inflation-adjusted civil penalty of $53,088 per violation as of 2025, and each day of ongoing noncompliance counts separately.2Federal Register. Adjustments to Civil Penalty Amounts In a 2024 enforcement sweep, the FTC targeted businesses selling AI tools that supposedly generated legal documents, detected business opportunities, or substituted for professional expertise but failed to deliver.3Federal Trade Commission. FTC Announces Crackdown on Deceptive AI Claims and Schemes The agency’s position is straightforward: there is no AI exemption from existing consumer protection law.
Children Under 13
The Children’s Online Privacy Protection Act requires any online service to get verifiable parental consent before collecting personal information from a child under 13.4Office of the Law Revision Counsel. 15 U.S.C. Chapter 91 – Children’s Online Privacy Protection The FTC finalized major updates in 2025. Companies now need separate opt-in consent before disclosing a child’s data to third parties for targeted advertising, must limit data retention to what is reasonably necessary, and must treat biometric identifiers as personal information subject to the full protections of the rule.5Federal Trade Commission. FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data The biometric expansion matters for AI systems that process children’s faces, voices, or other physical characteristics.
Health Records
Health data processed by AI falls under the Health Insurance Portability and Accountability Act whenever a covered entity or its business associate is involved. HIPAA’s Security Rule requires technical safeguards including access controls, audit trails, data integrity protections, and encryption for electronic protected health information.6eCFR. 45 CFR Part 164 – Security and Privacy The rule doesn’t mention AI, but it applies to any system handling protected health information, including machine learning models trained on patient records.
Where Your State Falls
States have moved faster than Congress. Roughly 20 states have enacted comprehensive consumer data privacy laws, and more have bills in progress. They vary in scope, but they share a structure: personal data is defined broadly, consumers get specific rights, and businesses must conduct risk assessments before high-risk processing like automated profiling.
California’s Consumer Privacy Act and its 2020 amendment, the California Privacy Rights Act, are the most expansive. Personal information covers anything that identifies, relates to, or could reasonably be linked to you or your household, which captures the behavioral patterns, device identifiers, and inferences AI systems routinely generate.7Office of the Attorney General – State of California – Department of Justice. California Consumer Privacy Act (CCPA) California also created a dedicated regulator, the California Privacy Protection Agency, which handles rulemaking and consumer complaints directly.8CA.gov. California Privacy Protection Agency Intentional violations carry inflation-adjusted penalties of up to $7,988 per violation, with higher exposure for a minor’s data.9California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
Virginia’s Consumer Data Protection Act places obligations on both data controllers and data processors and requires data protection assessments before processing that involves profiling or automated decision-making.10Virginia Code Commission. Virginia Code Title 59.1 Chapter 53 – Consumer Data Protection Act Colorado’s Privacy Act adds similar requirements and took effect in July 2023.11Colorado Attorney General. Colorado Privacy Act Connecticut, Oregon, Montana, and more than a dozen others have followed. If you live in a state without a comprehensive privacy law, your ability to challenge how an AI company uses your data is weaker, typically limited to general consumer protection rules.
State Laws Written for AI and Biometrics
A newer wave of state legislation targets AI systems directly. Colorado’s SB 24-205, which takes effect February 1, 2026, is the most significant example. It requires both developers and deployers of high-risk AI systems to use reasonable care to protect consumers from algorithmic discrimination.12Colorado General Assembly. Senate Bill 24-205 Deployers must run a risk management program, complete impact assessments at least annually, and keep them for at least three years after final deployment. Violations count as unfair trade practices enforceable by the state attorney general. The law does not create a private right of action.
Biometric statutes are a separate track. Illinois’s Biometric Information Privacy Act is the most consequential because it lets individuals sue directly, with statutory damages of $1,000 per negligent violation and $5,000 per intentional one. For AI companies running facial recognition or voice analysis at scale, those per-scan damages have produced settlements in the hundreds of millions of dollars. Texas and Washington have biometric protections too, but enforcement runs through their attorneys general rather than private suits.
When AI Decides About Your Credit or Job
Two areas of daily life already have federal law that reaches AI, even though the statutes predate it.
Credit Denials
When a lender uses an AI model to deny your application, the Equal Credit Opportunity Act still requires a specific explanation. The Consumer Financial Protection Bureau has said algorithmic complexity is not a defense for vague denial letters. A creditor cannot cite “internal standards” or tell you that you “failed to achieve a qualifying score” and leave it at that.13Consumer Financial Protection Bureau. Adverse Action Notification Requirements in Connection With Credit Decisions Based on Complex Algorithms The notice must identify the actual factors the model weighed against you. If a lender relies on a post-hoc interpretation tool to reverse-engineer that explanation from an opaque model, the CFPB expects the lender to validate that the approximation is accurate.
Hiring and Screening
Employers using AI to screen resumes, score interviews, or monitor workers face exposure under Title VII of the Civil Rights Act. If an AI hiring tool disproportionately filters out applicants from a protected group, the employer can be liable for disparate impact discrimination even when the bias was unintentional. Responsibility sits with the employer, not the AI vendor. Some states are adding requirements on top, including mandatory bias audits for automated employment decision tools.
International Rules That Reach US Companies
If an AI system touches data from people outside the United States, foreign privacy rules apply regardless of where the company is headquartered.
The GDPR
The EU’s General Data Protection Regulation limits personal data collection to what is necessary for a specific, disclosed purpose.14General Data Protection Regulation (GDPR). Art. 5 GDPR Principles Relating to Processing of Personal Data For AI developers, data minimization means you cannot vacuum up everything available and sort out what you need later. Purpose limitation adds another constraint: data collected for one reason cannot be repurposed for training a different model without a fresh legal basis. Many American companies adopt GDPR-level protections globally rather than run separate compliance regimes.
The GDPR also gives individuals the right not to be subject to decisions based solely on automated processing when those decisions produce legal effects or similarly significant consequences.15General Data Protection Regulation. Art. 22 GDPR – Automated Individual Decision-Making, Including Profiling The main text does not use the phrase “right to explanation,” though Recital 71 references a right to obtain an explanation of an automated decision. Whether that recital creates an enforceable standalone right remains debated among legal scholars.
The EU AI Act
The EU AI Act sorts systems into risk tiers. Systems deemed an unacceptable risk, like real-time biometric identification in public spaces, are banned outright. High-risk systems face documentation, transparency, and oversight requirements.16Shaping Europe’s digital future. AI Act Penalties are tiered: violations involving prohibited AI practices can draw fines of up to 7% of worldwide annual turnover or €35 million, whichever is higher. Other violations reach 3% of turnover, and supplying misleading information to regulators can cost up to 1%.17EU Artificial Intelligence Act. Article 99 Penalties The 7% tier is larger than the GDPR’s 4% maximum.
The Rights You Can Actually Exercise
Across these frameworks, a common set of rights recurs. Which ones you have depends on your jurisdiction, but these are the tools you’re most likely to encounter.
- Opt out of profiling. Most state comprehensive privacy laws and the GDPR let you tell a company to stop using AI to analyze your behavior for predictions about your preferences, creditworthiness, or other characteristics. Under the GDPR, you have the right not to be subject to solely automated decisions with legal consequences unless you consented or the decision is necessary for a contract.
- Access and transparency. You can request that a company disclose what personal data it holds about you and how it uses that data. In lending, AI-driven credit denials must include the specific factors the model used against you, not a generic form letter.
- Data portability. Several frameworks let you request your data in a format you can move to a different provider.
- Deletion. Often called the “right to be forgotten,” this lets you request that a company erase your personal data. How thoroughly a company can remove your data from a model that has already trained on it is a genuine technical challenge, but the obligation to provide deletion mechanisms is clear under the GDPR and most state privacy laws.
How These Laws Get Enforced
Enforcement comes from several directions. The FTC handles federal consumer protection cases and has focused increasing resources on AI-related deception and unfair data practices. State attorneys general enforce state privacy statutes and can also bring actions under general consumer protection laws. California’s Privacy Protection Agency is the only dedicated state-level privacy regulator with both rulemaking and enforcement power.8CA.gov. California Privacy Protection Agency
Penalty amounts vary widely. FTC order violations exceed $53,000 per violation.2Federal Register. Adjustments to Civil Penalty Amounts California’s CCPA imposes up to roughly $2,700 per unintentional violation and nearly $8,000 per intentional one, adjusted annually for inflation.9California Privacy Protection Agency. Updated Monetary Thresholds in CCPA Under the EU AI Act, the ceiling reaches 7% of global revenue for the most serious violations. Biometric claims in states with private rights of action generate damages of $1,000 to $5,000 per individual incident, which aggregates quickly.
Investigations usually begin after consumer complaints or when regulators spot a pattern of concerning behavior. Enforcement actions frequently end in consent orders that impose years of third-party monitoring on the company’s data practices. If you believe an AI system has misused your information, your practical routes are a complaint to the FTC, a complaint to your state attorney general or privacy agency, and, in the handful of jurisdictions that permit it, a private lawsuit.