State AGs Intensify Privacy Enforcement; FTC Consent Decree Risk; Major State Privacy Laws Passed
Key Questions
What are the key provisions of the new Vermont privacy law?
Vermont enacted a comprehensive data privacy bill as the 23rd state with a low threshold of 35,000 consumers, requirements for AI training disclosures, and a ban on geofencing near healthcare facilities. The law emphasizes consumer protections and will take effect in the coming years.
Which states recently passed or amended privacy laws?
Louisiana enacted the LDPA as the 22nd state privacy law effective in 2027, while Vermont became the 23rd. Amendments were also made in Utah, Kentucky, and Virginia, with new laws in Oklahoma and Alabama.
What does Massachusetts' H.211 bill include?
The Massachusetts House passed H.211 by a 146-0 vote, featuring a blanket ban on geolocation data sales, a private right of action, and affirmative consent requirements for sensitive data. It now moves to the Senate for consideration.
What is the status of the OpenAI investigation by state AGs?
Forty-two state attorneys general are investigating OpenAI's advertising practices and consumer data handling, signaling material pre-IPO risks for the company and its ad tech partners.
What FTC settlements relate to AI data collection and consent?
The FTC reached a $930K settlement in an 'Active Listening' case establishing that terms of service acceptance does not constitute valid consent for AI data collection, with implications for reseller liability in ad tech.
What actions have state AGs taken against major platforms?
Florida's AG sued TikTok, while Arkansas sued Snapchat for age verification failures, data monetization in targeted ads, and deceptive safety claims with penalties up to $10,000 per violation.
What AI-related disclosure requirements are emerging in states?
Connecticut enacted a sweeping AI law, Pennsylvania's HB 95 mandates AI disclosures in ads with a one-year compliance window, and New York signed a synthetic performer disclosure law.
How are state AGs coordinating on privacy enforcement?
Coordinated actions include an 18-state coalition's $4.88M settlement with GS Labs for deceptive ads and Massachusetts AG focus on data breaches and security practices relevant to ad tech firms.
Massachusetts House passes H.211 with 146-0 vote, including blanket geolocation sale ban, private right of action, and affirmative consent for sensitive data; moves to Senate. Connecticut updated data privacy act (CTDPA amendments effective July 1, 2026). Maryland MODPA 2026. Connecticut enacts sweeping AI law. FTC considering modifying $150M penalty against X. GM's $12.75M CCPA settlement. Louisiana enacts LDPA (22nd state, effective 2027). Florida AG sues TikTok. New York's synthetic performer disclosure law signed. Vermont enacts data privacy bill (23rd state) with low 35k threshold, AI training disclosure, geofence ban near healthcare. FTC FY 2026-2030 Strategic Plan released. Pennsylvania HB 95 mandates AI disclosure in ads with one-year window. GS Labs settlement ($4.88M, 18-state coalition) for deceptive ads demonstrates coordinated state AG action. OpenAI investigation by 42 state AGs now specifically targets advertising practices and consumer data handling – a material pre-IPO risk signal. Federal preemption fight alive: EPIC testimony calls SECURE Data Act data minimization standard 'exploitable'; warns broad preemption would gut stronger state laws. FTC's $930K 'Active Listening' settlement establishes that TOS acceptance is not valid consent for AI data collection; reseller liability holding critical for ad tech vendors. Arkansas AG sues Snapchat over age verification failures, data monetization for targeted ads, and deceptive safety claims; $10k/violation penalty. Vermont's AI training disclosure and low 35k threshold are new details from recent reading.