US state consumer privacy laws, profiling opt-outs and assessments

What it is

The United States has no federal consumer privacy law, but since 2023 a growing number of states have passed comprehensive ones. Most follow the model set by the Virginia Consumer Data Protection Act (VCDPA), which took effect on 1 January 2023. Two of its provisions matter for AI governance, a right to opt out of profiling and a duty to assess risky profiling. Because AI decision systems are usually profiling in the legal sense, these provisions reach a large share of AI used to make decisions about consumers.

This page describes that shared model and the main variation, Connecticut’s 2025 amendments. California regulates the same ground differently, through its CCPA ADMT regulations, and Colorado has layered an ADMT-specific law, SB 26-189, on top of the Colorado Privacy Act.

Who it applies to

Each state law applies to controllers, the businesses that decide why and how personal data is processed, that do business in the state or target its residents and cross that state’s thresholds, usually based on the number of residents whose personal data they process, sometimes combined with revenue from selling data. Thresholds differ, and some states have lowered them. Connecticut, for instance, now applies to controllers handling the data of at least 35,000 consumers, and to any controller processing sensitive data or selling personal data, whatever the volume.

Profiling in these laws means any form of automated processing of personal data to evaluate, analyse or predict aspects of a person’s economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Most credit, insurance, hiring, tenancy and pricing models qualify.

People acting in a commercial or employment context are generally not consumers under these laws, unlike California’s, so workplace AI is mostly covered by the employment laws instead, such as Illinois and NYC Local Law 144.

What it requires

Opt-out of profiling. Under the Virginia model, a consumer can opt out of the processing of their personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning them (Va. Code § 59.1-577). Those decisions are defined to cover the provision or denial of financial and lending services, housing, insurance, education enrolment, criminal justice, employment opportunities, health care services and access to basic necessities such as food and water. Several states limit the right to solely automated decisions, and others apply it more broadly.

Data protection assessments. A controller conducts and documents a data protection assessment of processing that includes profiling where it presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers, financial, physical or reputational injury, intrusion on seclusion, or other substantial injury (Va. Code § 59.1-580). The assessment weighs the benefits to the controller, the consumer and the public against the risks, as reduced by safeguards. It is made available to the attorney general on request and is otherwise confidential.

Connecticut’s expanded rights. Public Act 25-113 amended the Connecticut Data Privacy Act with effect from 1 July 2026. The opt-out now covers profiling in furtherance of any automated decision with legal or similarly significant effects, not only solely automated ones. Where a consumer’s data was processed for such profiling, the consumer can, where feasible, question the result, be told the reason for the decision and review the personal data used. For housing decisions they can also correct inaccurate data and have the decision re-evaluated.

Connecticut profiling impact assessments. A controller that profiles to make decisions with legal or similarly significant effects conducts an impact assessment, for processing created or generated from 1 August 2026. It covers the purpose, intended uses, deployment context and benefits, any known or reasonably foreseeable heightened risk of harm and the mitigations, the categories of data used as inputs and the outputs, the data used to customise the profiling, performance metrics and known limitations, transparency measures, and post-deployment monitoring and user safeguards. That is close to the content of a standard AI impact assessment.

Key dates

• 1 January 2023. Virginia’s law takes effect. Most other state laws on the same model followed between 2023 and 2026.
• 1 July 2026. Connecticut’s expanded profiling rights and lower thresholds take effect.
• 1 August 2026. Connecticut’s profiling impact assessment duty applies to new processing.

How it relates to other frameworks

These provisions are descended from Article 22 and Article 35 of the GDPR, though the opt-out works differently from the GDPR’s default prohibition on solely automated decisions. They sit underneath the AI-specific state laws. A Colorado lender, for example, faces both the Colorado Privacy Act’s profiling opt-out and SB 26-189’s notice, explanation and human review duties for the same model.

Because most of these laws accept an assessment prepared for another law if it is reasonably similar in scope and effect, an organisation can run one structured assessment per AI system and read it against each state. An impact assessment structured around ISO/IEC 42005 or the NIST AI RMF covers most of what Connecticut’s list asks for.

Working with it in Aicura

US state framework content is available in Aicura on the Enterprise tier and is switched on in Settings under Frameworks. The AI Register records which systems profile consumers and the decisions they feed, and Data Provenance, Aicura’s map of where each system’s data comes from, records the datasets each system uses, which is the input and output description these assessments ask for. Impact assessments set out the rights affected and the mitigations, and the Cadence view shows how long ago each assessment was done and when it is going stale. Privacy policy reviews check your privacy notices against the frameworks you choose. Aicura gives guidance for your own judgement and your advisers’. It does not decide which state laws apply to you.