What are the main data privacy laws relevant to AI?

The data privacy legal landscape relevant to Artificial Intelligence (AI) is complex, consisting of established, comprehensive privacy laws that impact AI’s data handling, and new, AI-specific regulations.

The main data privacy laws relevant to AI can be grouped into global comprehensive laws and emerging AI-specific regulations.

1. Global Comprehensive Privacy Laws (The Foundation)

These existing laws govern the collection, processing, and use of personal data, directly impacting how data can be used for AI training and operation.

Law	Jurisdiction	Key Implications for AI
General Data Protection Regulation (GDPR)	European Union (EU) & EEA	Legal Basis: Requires a lawful basis (like consent or legitimate interest) for all personal data used in AI. Right to Explanation (Art. 22): Grants individuals the right not to be subject solely to an automated decision (including profiling) that produces legal effects or significantly affects them, and a right to obtain meaningful information about the logic involved. Data Minimization: AI systems must only use the minimum data necessary.
California Consumer Privacy Act (CCPA), as amended by CPRA	California, USA	Right to Opt-Out: Gives consumers the right to opt-out of the “sale or sharing” of their personal information, which is broadly interpreted to include sharing for cross-context behavioral advertising (often AI-driven). Automated Decision-Making: CPRA provisions address profiling and automated decision-making technologies (ADMTs), granting consumers the right to opt-out of their use.
China’s Personal Information Protection Law (PIPL)	China	Strict Consent: Requires separate and explicit consent for processing sensitive personal information and transferring data outside of China. Automated Decision-Making:Mandates transparency and fairness, and prohibits the use of automated decision-making that leads to “unreasonable differentiated treatment” of individuals.
US State Laws	Various US States (e.g., Virginia’s CDPA, Colorado’s CPA)	Most comprehensive state laws include provisions that grant consumers the right to opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Export to Sheets

2. Emerging AI-Specific Regulations

These are new laws specifically designed to govern AI systems, regardless of whether they handle personal data, often by classifying them based on risk.

Law	Jurisdiction	Key Implications for AI
EU Artificial Intelligence (AI) Act	European Union	Risk-Based Framework: The first comprehensive, horizontal AI law globally. It classifies AI systems into four risk tiers: Unacceptable Risk (Banned): Systems that manipulate or exploit individuals. High Risk: Systems used in critical sectors (e.g., medical devices, hiring, law enforcement). These systems face strict requirements for data quality, documentation, human oversight, and testing. Limited Risk: Chatbots must disclose that a person is interacting with an AI.
Colorado AI Act (Upcoming)	Colorado, USA	Focus on Algorithmic Discrimination: This law places a duty of reasonable care on developers and deployers of High-Risk AI to protect against algorithmic discrimination. Consumer Rights: Grants consumers rights to notice, correction, and appeal for decisions made by high-risk AI systems.
State AI Governance Legislation (US)	Various US States	Numerous states (like Illinois, New York, Texas, etc.) are introducing laws focusing on specific AI applications, such as: AI in Employment: Requiring notice and consent when AI is used in hiring. Deepfakes: Criminalizing the creation or distribution of unauthorized deceptive deepfakes (especially in political or sexual contexts).