AI and privacy rules, by the date they start.

Source: Arbiter law tracker, verified rows

1. 2026-11-02Today
2. 13 Nov 2026DPDP Rules 2025, rule 4 (consent managers), with DPDP Act s.6(9) and s.27(1)(d) (India)Consent managers must be registered with the Data Protection Board and meet the rule 4 / First Schedule obligations
3. 20 Nov 2026Consumer Credit Directive 2 (Directive (EU) 2023/2225) (EU)Where a creditworthiness assessment uses automated processing, consumers can obtain human intervention, an explanation and a review
4. 1 Dec 2026Law 21.719 (new personal data protection law) (Chile)New data protection regime and agency apply, including a right to object to automated decisions and profiling
5. 2 Dec 2026EU AI Act as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI): new prohibitions and legacy gen-AI marking (EU)Bans AI systems that generate non-consensual intimate images of identifiable people or child sexual abuse material; pre-Aug-2026 gen-AI systems must machine-mark outputs (Art. 50(2))
6. 2 Dec 2026Platform Work Directive (Directive (EU) 2024/2831) (EU)Limits algorithmic management: no automated processing of workers' emotional state or private conversations; transparency and human oversight of automated decisions
7. 9 Dec 2026Product Liability Directive (Directive (EU) 2024/2853) (EU)No-fault liability for defective products now explicitly covers software (so AI); compensable damage includes destruction or corruption of data
8. 10 Dec 2026Privacy and Other Legislation Amendment Act 2024, Sch 1 Part 15 (APP 1.7 to 1.9, automated decisions) (Australia)Privacy policies must say what personal information computer programs use, and what kinds of decisions they make or substantially assist, where decisions significantly affect individuals
9. 28 Dec 2026ONC HTI-5 final rule (removes EHR 'model card' and predictive-DSI risk management criteria) (US federal (HHS/ONC))REMOVES duties: source-attribute ('model card') support and access for decision support interventions and risk management for predictive DSIs are no longer certification requirements
10. 1 Jan 2027CMS Interoperability and Prior Authorization rule (CMS-0057-F): Provider Access, Payer-to-Payer and Prior Authorization APIs (US federal (CMS))Run FHIR APIs that share patients' claims and clinical data with in-network providers and other payers, plus an electronic prior authorization API
11. 1 Jan 2027Alabama HB 161, app store accountability (Act 2026-59) (US-Alabama)Verify users' age category, get parental consent for minors, pass age signals to developers
12. 1 Jan 2027California AB 1043, Digital Age Assurance Act (Ch. 675, Stats. 2025) (US-California)OS asks for age at account setup and sends an age-bracket signal; developers must request and act on the signal
13. 1 Jan 2027California AB 1159, Student personal information: K-12 and preschool (Ch. 182, Stats. 2026) (US-California)May not use student 'covered information' to train generative AI or develop AI systems
14. 1 Jan 2027California AB 1609, Customer service chatbots (Ch. 733, Stats. 2026) (US-California)Never claim a customer service chatbot is human; disclose when a reasonable person could be misled; offer a way to reach a human agent (good-faith 15-minute target)
15. 1 Jan 2027California AB 1883, Workplace surveillance tools (Ch. 853, Stats. 2026) (US-California)No AI workplace surveillance tools that collect neural data or recognise emotional state (with exceptions); $500 per violation
16. 1 Jan 2027California AB 1979, Health care services: artificial intelligence (Ch. 854, Stats. 2026) (US-California)A consumer 'health care chatbot' is deemed a provider of health care under the CMIA (medical confidentiality); AI may not independently perform licensed clinical functions; clinicians keep independent judgment over clinical decision support
17. 1 Jan 2027California AB 2246, Age-appropriate design code re-enacted (Ch. 187, Stats. 2026) (US-California)Take reasonable steps to prevent specified risks of harm to children; data minimisation for children's personal information
18. 1 Jan 2027California AB 2561, Operating systems and applications: privacy settings (Ch. 478, Stats. 2026) (US-California)May not undo a user's privacy-setting choice without consent
19. 1 Jan 2027California AB 566, Opt Me Out Act (Ch. 465, Stats. 2025) (US-California)Browsers must include a consumer-configurable setting that sends an opt-out preference signal
20. 1 Jan 2027California AB 883, Data brokers: deletion mechanism every 30 days (Ch. 507, Stats. 2026) (US-California)Process deletion requests from the state DROP mechanism every 30 days instead of 45
21. 1 Jan 2027California AI Transparency Act: large online platform provenance (AB 2713) and GenAI hosting platforms (AB 853) (US-California)Platforms must detect and show provenance data, let users inspect it, and not strip it; hosting platforms may not knowingly offer GenAI systems that skip the required disclosures
22. 1 Jan 2027California SB 1050, False advertising: synthetic performers (Ch. 246, Stats. 2026) (US-California)Ads that prominently feature an AI 'synthetic performer' must say so clearly
23. 1 Jan 2027California SB 1111, Digital replicas (Ch. 862, Stats. 2026) (US-California)Right-of-publicity claims (Civ. Code 3344) expressly cover AI digital replicas of voice and likeness; new Penal Code chapter
24. 1 Jan 2027California SB 1119, Adam's Law (Ch. 190, Stats. 2026): repeal of SB 243 known-minor duties; age determination section (US-California)SB 243's specific duties for known minors (B&P 22602) are deleted on this date; new s.21811 (determine age or treat everyone as a child) has no delayed date, but the child protections it points to start 1 Jul 2027
25. 1 Jan 2027California SB 503, Health care services: AI clinical decision support (Ch. 857, Stats. 2026) (US-California)Identify and mitigate biased impacts of clinical decision support; developers give deployers documentation on training data (incl. demographic representativeness), evaluation and risks; deployers monitor
26. 1 Jan 2027California SB 574, Attorneys and generative AI (Ch. 858, Stats. 2026) (US-California)No delegating legal practice to gen-AI; do not enter confidential or personal identifying client information into gen-AI systems (as specified); verify outputs
27. 1 Jan 2027California SB 867, Toys: companion chatbots (Ch. 189, Stats. 2026) (US-California)No manufacture or sale of toys that include a companion chatbot (until 1 Jan 2031)
28. 1 Jan 2027California SB 923, CCPA deletion right expanded (Ch. 482, Stats. 2026) (US-California)Deletion right covers personal information collected ABOUT the consumer, not only from them (e.g. inferred or third-party data)
29. 1 Jan 2027California SB 951, Cal/WARN notices for AI-driven layoffs (Ch. 860, Stats. 2026) (US-California)If layoffs are caused in whole or substantial part by AI or automation, the notice must say which job functions are being automated
30. 1 Jan 2027California SB 976, Protecting Our Kids from Social Media Addiction Act: age assurance for addictive feeds (US-California)Before serving an algorithmic 'addictive feed' without parental consent, the operator must reasonably determine the user is not a minor
31. 1 Jan 2027California CCPA regulations: automated decisionmaking technology (ADMT) compliance date (US-California (CPPA))Pre-use notice, opt-out (or human appeal) and access rights for ADMT used in significant decisions; businesses already using ADMT must comply by this date
32. 1 Jan 2027Colorado HB 26-1139, Use of AI in Health Care (US-Colorado)AI used in utilization review must use individual clinical data and be auditable; no medical-necessity denial on AI output without licensed human review
33. 1 Jan 2027Colorado HB 26-1263, Conversational AI Service Operator Requirements (Chatbot Safety Act) (US-Colorado)Estimate user age; disclose AI; for known minors block sexual content and simulated emotional dependence, no engagement rewards, and give tools to control memory and use of their data for training; suicide/self-harm protocol; no claims of licensed-professional equivalence
34. 1 Jan 2027Colorado SB 26-189, Automated Decision-Making Technology Act (repeals and re-enacts SB 24-205) (US-Colorado)Developers give deployers documentation (incl. training-data categories); deployers give point-of-use notice, a plain-language explanation within 30 days of an adverse decision, data correction and human review on request
35. 1 Jan 2027Connecticut PA 26-15 (SB 5), AI companion rules (secs. 4-6) and frontier internal-reporting deadline (sec. 2(c)) (US-Connecticut)Companions need a self-harm detection and referral protocol (published), a not-human notice (hourly for minors), and minor safeguards (no self-harm encouragement, romance, manipulative engagement; screen-time tools). Large frontier developers must have an anonymous internal risk-reporting channel
36. 1 Jan 2027Connecticut PA 26-64 (SB 4), data broker registration (US-Connecticut)Must be registered with the Department of Consumer Protection before selling or licensing brokered personal data
37. 1 Jan 2027Delaware HB 380, Personal Data Privacy Act amendments (85 Del. Laws c. 463) (US-Delaware)Lower applicability thresholds; neural data added to sensitive data; consumers can get a list of specific third parties
38. 1 Jan 2027Georgia SB 444, AI in utilization review (Act 411 of 2026) (US-Georgia)Coverage decisions may not rest solely on AI or software tools; adverse determinations need a human clinical peer
39. 1 Jan 2027Illinois SB 2886, Genetic Information Privacy Act: biomarker data (P.A. 104-0642) (US-Illinois)GIPA protections extended to biomarker testing information
40. 1 Jan 2027Illinois SB 2909, AI in teacher evaluations (P.A. 104-0565) (US-Illinois)Evaluators may not use an AI tool to assign a teacher's numerical score or rating
41. 1 Jan 2027Illinois SB 315, AI Safety Measures Act (P.A. 104-0538) (US-Illinois)File a disclosure statement with the Illinois Emergency Management Agency before developing, deploying or operating a frontier model; incident reporting; whistleblower protections
42. 1 Jan 2027Indiana HEA 1408, social media and minors (IC 24-16) (US-Indiana)Age screening; parental consent for younger teens; algorithmic content selection limited for teen accounts
43. 1 Jan 2027Louisiana SB 386, Louisiana Data Privacy Act (Act 502 of 2026) (US-Louisiana)Consumer rights incl. opt-out of profiling; data protection assessments
44. 1 Jan 2027New Hampshire HB 1460, ban on selling children's data (Ch. 168, Laws of 2026) (US-New Hampshire)No sale of personal data of children under 13
45. 1 Jan 2027New York RAISE Act (Ch. 699 of 2025 as rewritten by S8828 / Ch. 96 of 2026) (US-New York)Publish and follow a frontier AI framework; transparency report at each new frontier model; report critical safety incidents to a DFS office within 72 hours (24 if imminent danger); disclosure statement and assessments
46. 1 Jan 2027New York S9051-B / A10379-C, unsafe AI companion features for minors (Ch. 368 of 2026) (US-New York)May not provide listed unsafe AI companion features to users the operator knows are minors
47. 1 Jan 2027New York Safe by Design Act (GBL Art. 45-B; FY2027 budget A10008-C Part Y, Ch. 58 of 2026) (US-New York)Privacy-by-default settings and parental approvals for minors; age assurance before offering an integrated AI companion, which must be OFF by default for minors
48. 1 Jan 2027Oklahoma SB 546, comprehensive consumer data privacy act (US-Oklahoma)Consumer rights incl. opt-out of profiling for significant decisions; data protection assessments
49. 1 Jan 2027Oregon SB 1546, AI companions (Oregon Laws 2026 ch. 85) (US-Oregon)Disclose AI; suicide/self-harm protocol; for minors, break reminders every 3 hours and limits on sexual content and manipulative engagement; public annual report
50. 1 Jan 2027Rhode Island AI Companion Models Act (P.L. 2026 ch. 376) (US-Rhode Island)Self-harm detection and referral protocol; not-human notice at start and every 3 hours
51. 1 Jan 2027Utah HB 276, AI Modifications: Digital Content Provenance Standards Act and Digital Voyeurism Prevention Act (Laws 2026 ch. 352) (US-Utah)Embed latent provenance disclosures in AI image, video and audio; large platforms detect, show and do not strip provenance; consent and takedown rules for AI intimate images
52. 1 Jan 2027Utah SB 319, Health Insurance Preauthorization Amendments (Laws 2026 ch. 240) (US-Utah)Disclose whether AI is used in preauthorization review
53. 1 Jan 2027Vermont Act 138 of 2026, data broker amendments (US-Vermont)New registration rules, fee and bond; biometric definitions
54. 1 Jan 2027Vermont Act 63 of 2025, Age-Appropriate Design Code (US-Vermont)Duty of care, high-privacy defaults for minors, no notifications overnight, limits on age-assurance data; AG rules
55. 1 Jan 2027Washington HB 2225, AI companion chatbots (Ch. 168, Laws of 2026) (US-Washington)Not-human notice at start and every 3 hours; no claims to be human; minor protections; self-harm protocol with yearly crisis-referral reporting; Consumer Protection Act enforcement

Source: statute, regulation or regulator text, linked in the tables below