U.S. state legislatures will continue integrating requirements for profiling and automated decision-making into consumer privacy laws, reflecting the growing impact and influence of AI. All comprehensive state consumer privacy laws that are currently in effect (California, Colorado, Connecticut, and Virginia) and almost all of those entering effect over the next few years (Delaware, Indiana, Montana, Oregon, Tennessee, Texas, and Utah) include concepts of automated decision-making and profiling and place restrictions on such activities.
While definitions differ slightly across the U.S. state privacy laws, profiling generally refers to the evaluation of individuals’ personal aspects via the automated processing of their personal information. Most states require covered entities to offer an opt-out from profiling, and most require a data protection assessment for activities posing a “heightened risk of harm” to individuals, such as targeted advertising.
California is leading these efforts by creating an independent watchdog, the California Privacy Protection Agency (CPPA), tasked with, inter alia, regulating the use of automated decision-making technology (ADMT). ADMT refers to any system, software, or process that processes personal information and uses computation to make decisions or facilitate human decision-making, including profiling. The CPPA recently proposed draft regulations that would require businesses to follow specific notice, opt-out, and access rules regarding their use of ADMT. These landmark regulations are expected to set the stage for other states’ enforcement of ADMT and profiling restrictions.
Carson Martinez contributed to authoring this blog post.