Obligation guides

AI and privacy regulations by US state

There is no single US AI statute that replaces state privacy assessments. What attaches depends on which residents you reach and what the processing does.

Run the AI Regulatory Requirements Check →Obligation Atlas →

State privacy assessments are per-state

Comprehensive state privacy laws often require a data protection or risk assessment for heightened-risk activities — targeted advertising, sale of personal data, sensitive data, or profiling with foreseeable harm. The exact trigger and contents are statute-specific.

Utah, Iowa, and Alabama are examples of state privacy laws that do not create a statutory assessment duty of this kind. Presence of residents there is not the same as owing a state assessment work product.

Thresholds and exemptions matter

Revenue, consumer volume, and entity-level exemptions (including financial and health overlays) can move a state from “likely required” to “needs more facts.” A free check should demote those calls rather than guess.

Multi-state footprints compound the work: each triggered state is its own assessment determination, not one national form.

← Obligation Atlas · Start the free check