Analysis

The State of State AI Laws: 2023

August 3, 2023 | Katrina Zhu, EPIC IPIOP Clerk

The 2023 legislative session has seen a surge in state AI laws proposed across the U.S., surpassing the number of AI laws proposed or passed in past legislative sessions. Ten states included AI regulations as part of larger consumer privacy laws that were passed or are going into effect in 2023, and even more states have proposed similar bills. Several states proposed task forces to investigate AI, and others expressed concern about AI’s impact on services like healthcare, insurance, and employment. Below is a list of state laws going into effect, passed, or proposed for the current legislative session.

Laws going into effect in 2023
Of the AI-related laws going into effect in 2023, most of them are part of comprehensive consumer privacy laws. These laws regulate AI and automated decision-making by allowing users to opt-out of profiling and requiring impact assessments. One law in New York City stands out as it “blazes a path for A.I. regulation” in hiring, attracting national attention.

State/CityNameDate passedDate in effectDescription
CaliforniaCalifornia Privacy Rights Act (CPRA)November 3, 2020January 1, 2023CPRA amends the California Consumer Privacy Act, introducing provisions impacting AI like additional limitations on data retention, data sharing, and use of sensitive personal information. 
ColoradoColorado Privacy Act (CPA)July 7, 2021July 1, 2023The CPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling.
ConnecticutConnecticut Data Privacy Act (CTDPA)May 10, 2022July 1, 2023The CTPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling.
New York CityAutomated Employment Decision ToolsDecember 11, 2021January 1, 2023AEDT regulates the use of AI in hiring. It requires employers to notify candidates about the use of such tools, allows candidates to request what data is used, and requires an annual audit to evaluate the tool for bias.
VirginiaVirginia Consumer Data Privacy Act (VCDPA)March 2, 2021January 1, 2023The VCDPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling.
UtahUtah Consumer Privacy Act (UCPA)March 24, 2022December 31, 2023The UCPA gives consumers the ability to opt-out of profiling using personal data. Notably, it does not require impact assessments for data controllers.

Laws passed this legislative session

This legislative session, Montana, Indiana, Oregon, Tennessee, and Texas passed comprehensive consumer privacy laws that includes provisions regulating AI, mirroring laws that California, Colorado, Connecticut, and Virginia have previously passed. Most notably, the law (1) gives consumers the right to opt out of automated profiling and (2) mandates data protection assessments if the automated decision-making poses a heightened risk of harm. Iowa also passed a consumer privacy law, but it does not grant consumers the right to opt-out of profiling.

Other states have also passed more laws that specifically address AI, which are listed in the table below.

StateNameDate passedDate in effectDescription
ArizonaBallot Processing and Electronic Adjudication Limit (SB1565)April 10, 2023N/A (governor veto)Ballot processing would not be able to use AI or learning software.
ConnecticutAn Act Concerning Artificial Intelligence, Automated Decision-Making and Personal Data Privacy (S1103)June 5, 2023Starting from July 1, 2023This law establishes an Office of Artificial Intelligence, protects children from targeted advertising, and establishes a task force to study AI and develop an AI Bill of Rights.
Delaware Delaware Personal Data Privacy Act (HB154)June 30, 2023January 1, 2025This law allows consumers to opt-out of profiling in furtherance of automated decisions and requires a data protection assessment for activities that pose a “heightened risk of harm.”
GeorgiaHB203May 2, 2023July 1, 2023This law regulates automated eye assessments; among other things, automated eye assessments shouldn’t replace eye exams that are done in “real time.”
HawaiiSR123/SCR179April 2023April 2023This resolution warns against the unintended consequences of AI and urges Congress to discuss the benefits and risks of AI.
IndianaIndiana Data Privacy Act (SB5)May 1, 2023January 1, 2026This law allows consumers to opt-out of profiling in furtherance of automated decisions and requires a data protection assessment for activities that pose a “heightened risk of harm.”
MarylandHB622May 8, 2023October 1, 2023This law establishes a grant program that funds small and medium-sized businesses that will implement “Industry 4.0 Technology,” which includes AI.
MontanaMontana Consumer Data Privacy Act (SB 384)April 21, 2023October 1, 2024This law allows consumers to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm.”
North DakotaHB 1361April 12, 2023April 12, 2023This act amends the North Dakota Code to clarify that AI is not a person.
OregonOregon Consumer Privacy Act (SB619)June 23, 2023July 1, 2024This act allows consumers to opt-out of profiling and requires a data protection assessment for some controllers that pose a “heightened risk of harm.”
TennesseeTennessee Information Protection Act (SB0073)May 11, 2023July 1, 2025This act allows consumers to opt-out of targeted advertising and profiling, and it requires data protection impact assessments for activities that pose a “heightened risk.”
TexasTexas Data Privacy and Security Act (HB4)June 18, 2023July 1, 2024This act allows consumers to opt-out of targeted advertising and profiling, and requires data protection assessments for certain controllers.
TexasArtificial Intelligence Advisory Council (HB 2060)June 13, 2023June 13, 2023This act creates an advisory council to study the effects of AI and report findings to the legislature.

Laws proposed this legislative session

AI Regulation as part of Comprehensive Consumer Privacy Bills

Several states have proposed comprehensive consumer privacy bills, following in the footsteps of Colorado, California, Connecticut, and other states. These bills include provisions regulating AI that mirror those in other states’ privacy laws.

StateNameDate introducedDescription
HawaiiHawaii Consumer Data Protection Act (SB974 or SB1110/HB1497)January 20, 2023This bill would allow users to opt-out of profiling that uses their personal data, and would require data protection assessments for processing activities posing a “heightened risk to consumers.”
IllinoisIllinois Data Privacy and Protection Act (HB3385)February 17, 2023This bill would regulate collection and processing of personal information through algorithms.
MaineMaine Data Privacy and Protection Act (HB1270)May 19, 2023This bill prohibits discrimination through data processing, regulates targeted advertising, and requires an impact assessment for “high risk” algorithms.
MassachusettsMassachusetts Data Privacy Protection Act (MDPPA), Massachusetts Information Privacy Protection Act (MIPSA), and the Internet Bill of Rights (H.1555)January 18- 20, 2023Three competing consumer privacy bills all would consumers the right to know about or opt-out of automated profiling, and require impact assessments for controllers engaged in automated decision making.
MinnesotaMinnesota Consumer Data Privacy Act (HF2309/SF2915)March 15, 2023This bill would allow consumers to opt-out of profiling and would require data protection assessments.
New HampshireConsumer Data Privacy Act (SB255)January 19, 2023This bill would allow consumers to opt-out of profiling and would require data protection assessments.
New YorkNew York Privacy Act (SB365 or AB3593)January 4 and February 3, 2023These alternative versions of a New York comprehensive privacy law give consumers more control over automated decisions used for profiling and require impact assessments.
PennsylvaniaConsumer Data Protection Act (HB708)March 27, 2023This bill would allow consumers to opt-out of profiling and would require data protection assessments.
Rhode IslandRhode Island Data Transparency and Privacy Protection Act (HB6236)March 30, 2023This bill would allow consumers to opt-out of profiling and would require data protection assessments.
WashingtonPeople’s Privacy Act (SB5643/HB1616)January 31, 2023This bill would restrict the use of AI profiling and facial recognition in public accomodations.

AI Regulation to Prevent General Harms

Several states have proposed bills that guard against general harms of AI. All bills express concern for discrimination resulting from AI use. Some bills seem more concerned about harms within specific industries, like hiring, healthcare, voting, or insurance.

State/DistrictNameDate introducedDescription
CaliforniaAutomated Decision Tools (AB 331)January 30, 2023This bill would require impact assessments for automated decision making tools, and it would give consumers the right to request manual review for consequential decisions. Specifically, it expressed concern for decisions made in employment, education, housing, healthcare, utilities, family planning, financial services, and the criminal justice system.
District of ColumbiaStop Discrimination by Algorithms Act (B25-0114)February 2, 2023This bill would stop algorithms from making decisions based on individuals’ protected personal traits.
New JerseyS1402February 10, 2023This bill would make it unlawful for an automated decision system to discriminate against members of a protected class in loans, insurance, or healthcare settings.
New YorkDigital Fairness Act (S2277)January 19, 2023This bill would require automated decision system impact assessments, prevent discriminatory practices with targeted advertising, and regulate the use of biometric data, among other provisions.

Regulating AI in Employment Settings

Following in the footsteps of New York City, several states have proposed bills regulating AI use in employment settings, often around making hiring decisions.

StateNameDate introducedDescription
IllinoisHB 3773February 17, 2023This bill would restrict employers from using race, or zip code as a proxy for race, when making automated hiring decisions.
MassachusettsAn Act Preventing a Dystopian Work Environment (H.1873)February 16, 2023This bill would require employers to provide employees with notice about algorithmic decisions and monitoring. It would also give employees the right to request information processed through algorithms. 
New JerseyA4909December 5, 2022This bill would require bias audits for automated decision tools used for hiring and would require employers to notify candidates that they were screened using an automated tool.
New YorkS5641/A567March 10, 2023This bill would amend labor law to include criteria for automated decision making tools. It would also require disparate impact analysis.
New YorkA7858July 7, 2023This bill would require employers to give notice to candidates if they use automated decision tools to make employment decisions.
VermontH114January 25, 2023This bill would restrict the electronic monitoring of employees for employment-related decisions.

Regulating AI in Healthcare

Expressing their skepticism that algorithms can make better decisions than medical professionals when it comes to healthcare, states have proposed bills that regulate the use of AI in physical and mental health services.

StateNameDate introducedDescription
CaliforniaAB1502February 17, 2023This bill would prevent healthcare providers using automated decision systems from discriminating based on race, color, national origin, sex, age, or disability.
IllinoisHB1002January 11, 2023This bill would require that algorithms used to diagnose patients are certified and shown to achieve accurate results. It also would give patients the right to know that an algorithm diagnosed them, and opt-out of its use.
IllinoisHB3338February 17, 2023This bill would prevent hospitals from adopting policies that prevent nurses from substituting their judgment for the automated recommendations of AI systems.
MaineSB656aApril 12, 2023This bill would prevent hospitals from adopting policies that prevent nurses from substituting their judgment for the automated recommendations of AI systems.
MassachusettsHB1974February 16, 2023This bill would require that AI used for mental health patients be pre-approved and monitored, and that patients would be informed about and must consent to AI use.
Rhode IslandHB6285April 19, 2023This bill would require that AI used for mental health services be pre-approved, and that patients are informed about AI use and can opt for mental health treatment from a professional instead.
TexasHB4695March 10, 2023This bill would only allow mental health professionals to administer mental health care through AI, and requires that the mental health professional be available to monitor progress or communicate with the patient.

Regulating AI in Insurance

Legislators have expressed concerns about AI decision-making in insurance contexts.

StateNameDate introducedDescription
New JerseyA537January 11, 2022This bill would require automobile insurers using AI to provide documentation that shows a lack of discriminatory outcomes. 
New YorkAB843January 11, 2023This bill would prevent automobile insurers from using factors like age, sex, marital status, sexual orientation, income level, or employment and education status to determine insurance rates.
Rhode IslandH5734February 21, 2023This bill would prohibit unfair discrimination in the insurance context, requiring insurers using AI to provide data sources they use and conduct a risk management assessment.

Regulating AI Used by the Government

Expressing their concern for bias in automated decision making used by state actors, states have proposed bills that would require government actors to follow responsible AI procurement and implementation practices. Several bills hold AI to a set of standards, but several others merely call for investigation of government AI use without implementing any regulations yet.

StateNameDate introducedDescription
CaliforniaA302January 26, 2023This bill would require the Department of Technology to take inventory of all high-risk automated decision systems used by state agencies.
CaliforniaS398February 9, 2023This bill would require the Department of Technology to develop a research plan to investigate potential new uses of technology for the state, including “virtual assistants powered by AI.”
CaliforniaCalifornia AI-ware Act (S313)February 6, 2023This bill would require any state agency using generative AI to communicate to disclose to that person that the communication is through generative AI.
MassachusettsH64/S33February 16, 2023This bill would establish a State Commission on Automated Decision Making to investigate Massachusetts’s AI use.
MissouriH311January 4, 2023This bill would establish the Missouri State Technology Task Force which would investigate AI used by the state, among other technologies.
New JerseySB3876May 22, 2023This bill would appoint an Artificial Intelligence Officer to oversee state agencies’ uses of AI.
New YorkA5309March 7, 2023This bill would require state units purchased products that use automated decision making to adhere to responsible AI standards.
Rhode IslandS117February 1, 2023This bill would establish a commission to study and regulate the use of AI by the state government.
Rhode IslandH6423May 19, 2023This bill requests that the government review the extent of automated decision making used by the state of Rhode Island and its impacts.
WashingtonS5356January 12, 2023This bill would require government agencies to follow responsible methods for procuring AI, assess the impacts of automated decision making systems they use, and conduct ongoing monitoring to uncover bias or discrimination. 

Regulating Generative AI

In addition to the California AI-ware Act (mentioned above) which regulates the government’s use of generative AI, the below bills also attempt to mitigate generative AI harms. Many focus on harms caused by AI-generated images or videos.

StateNameDate introducedDescription
MassachusettsAn Act drafted with the help of ChatGPT to regulate generative artificial intelligence models like ChatGPT (S.31)February 16, 2023This bill would prohibit bias in generative AI models, and would require safeguards against plagiarism and consumer privacy protections for those using generative AI, as well as registration with the attorney general.
New YorkS6859/A216AJanuary 2, 2023This bill would require advertisers to disclosure their use of “synthetic media.” 
New YorkA7106/S7592May 10, 2023This bill would require political communications to disclose the use of synthetic media. 
New YorkA7634/S7422May 25, 2023This bill would prevent film production companies receiving production credit from using AI to replace actors in their productions.
PennsylvaniaH1063April 28, 2023This bill would criminalize disseminating AI-generated sexually explicit images of people without their consent. 
Rhode IslandHB6286April 19, 2023This bill would hold generative AI models to certain operating standards, and it would require them to register with the attorney general.

Bills to Increase Transparency and Understanding Around AI

Several states proposed bills that would track AI use or establish commissions to study AI’s effects. Many asked the commissions to recommend how to best regulate AI.

StateNameDate introducedDescription
CaliforniaS721February 16, 2023This bill would establish a California Interagency AI Working Group to deliver a report on AI.
CaliforniaAB1282February 16, 2023This bill would establish a commission to report on the mental health risks associated with children’s use of social media and artificial intelligence.
IllinoisH3563February 17, 2023This bill would establish a Generative AI and Natural Language Processing Task Force.
MarylandH1068February 10, 2023This bill would create a Commission on Responsible AI in Maryland.
MarylandH1034February 10, 2023This bill would establish an AI Impact Advisory Board.
NevadaS165February 16, 2023This bill would create an Emerging Technologies Task Force.
New JerseyA168January 11, 2022This bill would require a report on AI’s impact on the economy and workforce.
New JerseyA5150February 6, 2023This bill would require those applying for unemployment benefits to designate whether their job loss was related to automation or other technological advances.
New MexicoHM75/SM63February 28, 2023This bill requests that a task force convene to study automated decision making’s impact on children when those tools are used to analyze child abuse and neglect.  
New YorkA4969/S6402February 27, 2023This bill would create a commission to study AI, robotics, and automation.
New YorkA7501May 25, 2023This bill would create an office of algorithmic innovation, which would create policies and standards that ensure AI is fair.
New YorkA7838July 7, 2023This bill would require a long-term study on the impacts of AI on the state’s workforce, and would deter AI from replacing state employees’ jobs.
North CarolinaS460April 3, 2023This bill would establish a committee on automation and the workforce.
PennsylvaniaHB49March 7, 2023This bill would create a registry of all businesses using AI in the state.
PennsylvaniaHR170/SR143June 29, 2023This resolution urges the state to establish an advisory committee to investigate AI’s impacts on the state.
TexasH3633March 6, 2023This bill would establish a committee to decide whether to establish a program that would train individuals in the workforce on the use of AI.

Other AI-related Bills

StateNameDate introducedDescription
IllinoisAnti-Click Gambling Data Analytics Collection Act (H2570)February 15, 2023This bill would prevent data collection on gambling platforms that would be used to predict how a player might gamble.
PennsylvaniaHB1380June 12, 2023Among other things, this bill would explicitly authorize using AI to determine eligibility or fraud for public benefits.
Rhode IslandS0146February 1, 2023This bill would prohibit the use of AI in sports betting applications.
South CarolinaSB404January 18, 2023This bill would prohibit targeted advertising using automated decision making for a user under 18. It would require the platform to perform age verification to ensure the user is 18 or older.

Support Our Work

EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.

Donate