Efforts to pass a federal data privacy law have dragged on for many years. During that time, unrelenting technological advancement simultaneously has produced new innovations that amplify calls for clear rules and complicated congressional conversations that might lead to such legislation. Artificial Intelligence (AI) is the latest such instigator/troublemaker.
Generative AI offerings – such as OpenAI's ChatGPT, Google's Gemini, and Meta AI – depend upon Large Language Models (LLMs) trained on massive amounts of data. The more data used to train the LLM, the better the results. Consequently, generative AI raises substantial questions relating to privacy. (By way of example, the image below was created with OpenAI's DALL-E using the prompt "create an image of generative AI and data privacy.")
In her Opening Statement regarding a recent Senate Commerce, Science and Transportation Committee hearing titled "The Need to Protect Americans' Privacy and the AI Accelerant," Chair Maria Cantwell (D-WA) wrote that "[w]e are being surveilled … tracked online in the real world, through connected devices. And now, when you add AI, it is like putting fuel on a campfire in the middle of a windstorm." AI, she argued, "increases the need for passing legislation soon."
This heightened concern, however, to date has not generated legislative progress on data privacy. The American Privacy Rights Act of 2024, about which I wrote in "Congressional Leaders Return Privacy to the Front Burner," an April 2024 Perspectives from FSF Scholars, has yet to advance beyond a discussion draft. It was scheduled for markup by the House Energy and Commerce Committee on June 27, 2024, but that markup was cancelled at the last minute, a development I described in a post to the Free State Foundation's blog.
Prompting an unsettling sense of déjà vu, already one state has taken stalled congressional matters into its own hands. On May 17, 2024, Colorado Governor Jared Polis signed into law Senate Bill 24-205, "Concerning Consumer Protections in Interactions with Artificial Intelligence Systems."
Broadly speaking, Senate Bill 24-205, which goes into effect on February 1, 2026, requires that developers of "high-risk" AI systems "use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination."
We shall see if other states follow Colorado's lead – and, if so, whether another unwanted privacy-related "patchwork" emerges.
Posts
