Status as of October 19, 2026. Pending bills may have moved since publication.
This fall, three states made changes that will reshape US privacy and AI compliance programs. California’s legislative session closed in September with Governor Newsom signing a broad slate of privacy and AI bills and vetoing several others. In New York, three AI bills cleared both chambers and are awaiting gubernatorial action. Delaware amended its consumer privacy law and lowered the bar for who has to comply. Add Colorado’s open rulemaking and the comprehensive privacy bills pending in Massachusetts and Pennsylvania, and privacy and compliance teams have a lot more to track. Below are selected legislative highlights: what passed, what was vetoed, and when it takes effect.
California: selected highlights
The bill that will touch the most compliance programs is SB 923. It expands the CCPA deletion right to cover all personal information a business holds about a consumer, subject to existing exemptions and deletion exceptions. That includes data the business collected directly, data it sourced from third parties, vendors, and data brokers, and inferences drawn from any of it. Online-only businesses with a direct consumer relationship must also offer an online method, such as a web form or portal, for access, deletion, and correction requests. Email alone no longer satisfies the requirement. Both changes take effect January 1, 2027.
Other bills worth flagging:
- AB 2561 generally bars operating system and app updates from overriding privacy settings a consumer affirmatively selected without obtaining new consent.
- AB 883 requires data brokers to check DROP and process deletion requests every 30 days instead of every 45 days. Separately, it adds notice and enforcement provisions for elected officials and judges, effective July 1, 2027.
- SB 690 reserves specified website- and app-related pen-register and trap-and-trace claims under Penal Code § 638.51 for the attorney general. It does not eliminate private claims under CIPA’s other provisions. It takes effect January 1, 2027, and also reaches specified pending lawsuits filed during the preceding two years.
The vetoes included AB 1542 (sales and sharing of sensitive personal information), SB 1130 (wearable recording devices), SB 903 (AI use by mental health professionals), and AB 2575 (healthcare AI requirements).
Children’s online safety was a major focus. The Governor’s September 10 child-safety package included 13 bills covering design codes, student data, and companion chatbots. Among them is SB 867, which prohibits covered companion-chatbot toys for children under 16 starting January 1, 2027 and sunsetting January 1, 2031. We cover California’s full slate, including the AI-at-work, healthcare, and content rules, in a dedicated post.
New York: three AI bills awaiting the governor
New York did not end its session with a batch of signed laws the way California did. Three AI bills cleared both chambers and are awaiting gubernatorial action:
| Measure | Bill numbers |
|---|---|
| AI Training Data Transparency Act | A 6578-B / S 6955-A |
| Stop Deepfakes Act (AI content provenance) | S 6954-B / A 6540-E |
| Surveillance-pricing prohibition | A 9349-B / S 8623-B |
New York lawmakers also passed a chatbot-toy proposal, S 9408-A / A 11144-B. It shares a goal with California’s SB 867, but the two differ. New York’s version covers toys for children 12 and younger, compared with California’s under-16 scope. It would also start 90 days after enactment and run for five years. A separate proposal, S 9051-B / A 10379-C, addresses unsafe AI-companion features for minors.
None of these pending bills are law yet, so the governor’s decisions are the dates to watch. New York has already enacted its amended frontier AI regime (the RAISE Act), signed in March 2026, and its substantive requirements begin January 1, 2027. More detail is in our New York-focused post.
Delaware: more businesses are now in scope
Delaware’s HB 380 amendments to its Personal Data Privacy Act take effect January 1, 2027, and the headline change is applicability:
- The general applicability threshold falls from 35,000 to 10,000 consumers.
- The alternative threshold falls from 10,000 to 5,000 consumers for businesses that derive more than 20 percent of gross revenue from personal-data sales.
- The consumer-count threshold for data protection assessments falls from 100,000 to 50,000.
The sensitive data definition also expands to include specified sensitive inferences, neural data, financial-account credentials, and government-issued identification numbers. The access right expands too: consumers can confirm whether a business processes inferences derived from their personal data, and whether it uses profiling for decisions that produce legal or similarly significant effects. We break down who is newly in scope in a separate post.
What else is moving
Colorado’s consultation on proposed ADMT and chatbot rules closes October 26, 2026. The drafts contemplate a January 1, 2027 effective date, subject to final adoption. Massachusetts and Pennsylvania both have comprehensive privacy bills pending. If either one passes, add it to your program.
Enacted frontier AI laws in California, Illinois, and New York share common themes with proposals in Massachusetts and Pennsylvania, including compute-based coverage, catastrophic-risk management, and incident reporting. Their detailed requirements differ. For background, California’s frontier law was signed in September 2025. Illinois’s law was signed in July 2026, and its framework obligations begin January 1, 2028. At the federal level, the FRONTIER Act (H.R. 9925) remains a proposal. It includes a provision that would preempt state frontier AI laws.
What to do next
Start with the dates that are already fixed:
- October 26, 2026: Colorado’s consultation on the ADMT and chatbot rules closes.
- January 1, 2027: California’s SB 923 deletion and request-method changes and SB 690 take effect. Delaware’s new thresholds take effect the same day. So do the substantive requirements for covered frontier AI developers under New York’s amended RAISE Act. Map each obligation under the RAISE Act separately, because publishing a framework, issuing deployment transparency reports, and making regulatory disclosure filings are different requirements.
- July 1, 2027: AB 883’s provisions for elected officials and judges take effect.
Next, inventory your chatbots. Sort customer-service bots from companion bots, since different rules apply to each. Then check whether your customer-service bots fall under California’s AB 1609, which covers specified large businesses and includes exemptions. If you have not reviewed Delaware’s new thresholds yet, do it now. Many businesses that were previously exempt are now in scope.
Keeping up with state privacy and AI laws shouldn’t mean reading every bill yourself. See how TrustArc helps privacy teams monitor new requirements, map them to their programs, and stay ready as deadlines approach.
Book a Demo
