AI discourse hasn’t totally eclipsed data-privacy efforts, as some had worried

Last year, experts at The Software Alliance, also known as BSA, predicted there would be a wave of state artificial intelligence legislation this year, similar to state efforts to regulate data privacy. While the number of AI bills introduced this year has spiked, several experts said that work hasn’t completely overshadowed conversations about regulating data privacy.

There have so far been 1,080 bills related to AI introduced across the 50 states during this year’s legislative session. That’s a rise over last year, when lawmakers in 45 states introduced 635 AI-related bills. Of those, only 99 were enacted, according to one analysis.

Also this year, lawmakers in 49 states and Washington, D.C., have considered more than 800 consumer privacy bills, at least 100 new laws were enacted across at least 30 states, according to the National Conference of State Legislatures. (That’s in addition to the 20 states that have already passed comprehensive consumer data privacy laws over the last several years.)

According to the NCSL, “consumer privacy legislation continues to grow in importance in state legislatures recently,” and measures introduced this year focused on regulating a variety of types of data that governments and commercial entities collect. 

Craig Albright, senior vice president of U.S. government relations at BSA, told StateScoop that this is evidence his organization’s 2024 report detailing the predicted of a wave of AI legislation this year was accurate. And, he said, it seems that despite states mirroring their all-out efforts to get data privacy regulated with AI, it doesn’t appear that work is overshadowing data privacy legislation in the states.

Albright pointed out that what counts as AI legislation could be anything that includes the term “AI” and that because there are different types of AI, there were different types of bills introduced for each type. When it comes to the number of laws actually passed — not just introduced — at the state level, it seems that the wave hasn’t broken just yet.

“I think if you asked us a year ago, we would say, Well, it looks like there’s going to be a wave that breaks and states pass these laws. But as we look back now, that didn’t happen in the way that it looked like it might, and states are taking more time to think about the speed that they want to act like. I think that’s something that we’ve seen across the board,” he said.

A varied AI landscape

Albright said that the conversation around AI has become more inconsistent and is just as varied as the number of state bills introduced. We’ve seen this at the federal level, as well. In July Congress defeated a 10-year ban on states enforcing their own AI laws after heated debate. The proposed ban, led by Republican Sen. Ted Cruz, of Texas, was met with stiff opposition from a large number of state lawmakers and state attorneys general, and eventually lost all support in the Senate before it was killed by a vote of 99-1.

These smaller distinctions and the overall variance in approach to regulating AI are where last year’s prediction and this year’s reality begin to diverge, Albright said.

“A lot of those bills, or some portion of those bills, were focused on deepfakes, establishing penalties, increasing penalties or trying to prevent unauthorized use of likeness — like, really, really bad stuff, like revenge porn,” Albright said. “There were a number of bills introduced to regulate high-risk uses of AI. I think that we saw less action on those bills than we were expecting a year ago, and there are reasons for that. We’ve seen bills to regulate transparency of frontier models, and we’ve seen more movement on that this year than we saw last year, so those are some like examples of things that we can point to at this point.”

What ties AI and data privacy legislation is that they both impact everyday folks, or “consumers” in legalese, one expert said. Kyle Quackenbush, a privacy and consumer protection attorney at Girard Sharp, said that the widespread use of AI may have created a perception that lawmakers are giving it more attention.

“I do think that AI is in vogue right now. I think not only in vogue because of its effects on the economy and the future, but also I think consumers are seeing how they can use it in their everyday life,” Quackenbush said. “I mean, law firms are looking at how to utilize AI to their advantage, recognizing pitfalls with AI, and so I think that that’s consumed the legislature.”

Legislative patchworks

Also tying data privacy and AI legislation together are similarities in legislative approaches and controversies over potential “patchworks” of state laws. Quackenbush said the fragmented and inconsistent sets of rules create complications for not only businesses, but consumers seeking to understand their rights. In both arenas, Congress members have introduced federal measures that would standardize the regulations for both, but none have been successful.

“I do think that having a patchwork system is complicated for businesses. Most states exempt smaller businesses, but that, in and of itself is a patchwork, right? And so you need to have legal counsel to advise you whether you’re obligated to follow any one of the patchworks of states requirements,” he said. “But I also think in the absence of federal law, you’re going to get a patchwork that’s kind of the design of the federal system and state sovereignty. Even if you had a federal system, I think states would want to tailor their privacy rights to on behalf of their citizens.”

Nathan Lindfors, policy director at Engine, a research nonprofit that serves startups, said that while this critical mass of legislation has created the illusion of a regulatory “wave,” the patchwork continues to exist, and likely will continue to exist, as the chasm between political ideologies continues to grow.

“I think definitely a lot of the oxygen in the room right now is taken up by the AI conversation, and a lot of people — policymakers, external stakeholders, civil society, you name it — are focused on the AI piece,” Lindfors said. “I think a little bit of that is responding to the states. We had this flurry of activity [on data privacy] where we went from like five states, if you will, making up the patchwork. Four of those states being pretty close in the contours that they’re launched like around 20, depending on how you count, in just a matter of two years in two sessions.

“It does feel like there’s probably some interplay in the state versus federal trend there on AI. I think the moratorium conversation shifted how some people are thinking about this, and I think the administration’s very forward stance on AI changed people’s thinking on from the maybe more bipartisan focus that we had up until last year.”