Twenty states now have privacy laws that touch AI training data, and they don't agree with each other

Twenty US states now have comprehensive privacy laws in effect in 2026, and a growing subset of them specifically reach into how companies collect and use data for AI training — not as a future promise, but as enforceable law today. Connecticut's disclosure mandate took effect July 1. California's automated decision-making rules are phasing in through 2027. None of these laws use the same definitions, thresholds, or enforcement mechanisms, which means a single AI product can be legal in one state and non-compliant in another using the exact same data pipeline.

Connecticut just made AI training data a disclosure requirement, not just a privacy issue

As of July 1, 2026, any company subject to the Connecticut Data Privacy Act must state in its privacy notice whether it collects, uses, or sells personal data to train large language models — including indirect use through vendors. This is a transparency requirement, not an opt-out right: companies can still use consumer data for AI training, but they can no longer do it silently. The indirect-use clause is the sharper edge here. It closes the loophole where a company claims it doesn't train models itself while quietly supplying data to a vendor who does — a structure several AI-adjacent businesses have relied on precisely because it kept them a step removed from training-data obligations.

Connecticut residents also gained a broader right starting the same date: the ability to opt out of any automated profiling that produces a legal or similarly significant effect on them, covering credit decisions, insurance underwriting, housing eligibility, employment screening, and fraud flags. Critically, this opt-out applies even when a human is nominally in the loop — a provision aimed directly at companies that use "human review" as a compliance shield for what is functionally an automated decision.

California is building something more structural

California's approach layers two separate mechanisms. AB 2013 requires generative AI developers to publish detailed dataset disclosures on their public websites — covering whether training data includes personal information or copyrighted material, what time range it spans, and known limitations — with enforcement by the state Attorney General and penalties up to $5,000 per violation. Separately, the California Privacy Protection Agency finalized Automated Decisionmaking Technology (ADMT) regulations that took effect January 1, 2026, giving consumers rights to access, opt out of, and demand human review of automated decisions, with specific provisions covering technology used to generate deepfakes or perform biometric identification.

The CPPA's functional definition of ADMT — any technology using computation to replace or substantially replace human decision-making — is deliberately broad, and it's the piece most likely to catch AI products that weren't explicitly built with California compliance in mind. Businesses using ADMT for significant decisions must be compliant by January 1, 2027, and risk assessment obligations for covered businesses started January 1, 2026, with attestation deadlines running through April 2028.

Why fragmentation is the actual problem, not any single law

Individually, none of these twenty state laws is unreasonable. The problem is that they don't share a common framework. Connecticut requires disclosure of indirect AI training use; California requires disclosure of direct dataset composition plus a separate ADMT opt-out regime; other states layer on their own sensitive-data consent requirements. A company operating nationally now has to either build the most restrictive common denominator into every product regardless of where a user is located, or maintain genuinely different data pipelines and disclosure language by state — both of which are expensive, and the second of which is operationally fragile at scale.

This is a materially different compliance environment than GDPR, which at least gave companies a single unified standard to build against. Twenty different state standards, evolving on different timelines with different enforcement bodies, is closer to running twenty separate compliance programs that happen to overlap.

What this means if you're building or buying AI products

If your company trains models on user data or buys data from vendors who do, audit your indirect-use chain now — Connecticut's disclosure requirement specifically closes the "we don't train, our vendor does" defense, and other states are likely to copy that language given how directly it targets a known compliance workaround. If you operate in California, treat the ADMT regulations as the wider net: the functional definition is broad enough to cover products your team may not think of as "automated decision-making" in the colloquial sense — recommendation engines, risk scoring, and eligibility screening tools are all plausible targets.

For consumer-facing teams: your privacy notice is no longer a legal formality you can copy-paste across states. Given how specific Connecticut's and California's requirements already are, and how many more states are expected to add similar language through 2027, building state-by-state disclosure logic now is cheaper than retrofitting it after an enforcement action defines the boundaries for you.