Across the United States, evolving data collection and processing practices and advances in artificial intelligence are driving new digital services, technologies, and socially beneficial research – while also raising new opportunities, risks, and questions for individuals and communities. In response, state and federal policymakers are considering new legislative and regulatory frameworks on three interconnected fronts: comprehensive consumer privacy laws that establish baseline rights and protections for personal data across the economy; frameworks that target specific sectors and practices such as automated decisionmaking, biometric identification, companion chatbots, data-driven pricing, data brokerage, frontier AI model safety, genetic data, and health data; and youth-specific privacy and online safety laws that set distinct rules for minors. These three tracks rarely stay in their lanes: a comprehensive privacy law may include AI provisions, an AI safety bill may carve out rules for minors, a youth online safety law may hinge on biometric age verification. Understanding the landscape requires understanding both the individual pieces and how they fit together.
FPF’s U.S. Legislation team provides expert, independent, pragmatic analysis of state and federal legislative and regulatory approaches to privacy, AI, and youth online safety – three distinct but increasingly intertwined issue areas. The team tracks emerging proposals, compares new laws against existing frameworks, analyzes implementation and compliance implications, and helps policymakers and stakeholders understand how legal requirements interact with current technologies, business practices, and data uses.
Through reports, blog posts, legislative and policy analyses, webinars, in-person and virtual peer-to-peer gatherings, and educational programs, FPF helps the broader technology policy and governance community understand the mechanisms and strategies available to protect privacy, promote responsible AI development and deployment, and advance youth online safety. FPF does not typically support or oppose particular bills. Instead, the U.S. Legislation team focuses on explaining the practical and legal implications of proposals – individually and as they interact with one another. This work helps ensure that privacy, AI, and youth safety compliance and policy strategies remain future-looking, adaptable, and workable for the continued, beneficial use of data and AI.
FPF’s U.S. Legislation team is led by Tatiana Rice, Senior Director.
FPF Submits Comments to Inform Colorado Minor Privacy Protections Rulemaking Process
On September 10th, FPF provided comments regarding draft regulations for implementing the heightened minor protections within the Colorado Privacy Act (“CPA”). Passed in 2021, the CPA, a Washington Privacy Act style-framework, provides comprehensive privacy protections to consumers in Colorado that are enforced by the state Attorney General’s office, which also has rulemaking authority. In 2024, […]
“Personality vs. Personalization” in AI Systems: Intersection with Evolving U.S. Law (Part 3)
This post is the third in a series on personality versus personality in AI systems. Read Part 1 (exploring concepts) and Part 2 (concrete uses and risks). Conversational AI technologies are hyper-personalizing. Across sectors, companies are focused on offering personalized experiences that are tailored to users’ preferences, behaviors, and virtual and physical environments. These […]
A Price to Pay: U.S. Lawmaker Efforts to Regulate Algorithmic and Data-Driven Pricing
“Algorithmic pricing,” “surveillance pricing,” “dynamic pricing”: in states across the U.S., lawmakers are introducing legislation to regulate a range of practices that use large amounts of data and algorithms to routinely inform decisions about the prices and products offered to consumers. These bills—targeting what this analysis collectively calls “data-driven pricing”—follow the Federal Trade Commission (FTC)’s […]
The “Neural Data” Goldilocks Problem: Defining “Neural Data” in U.S. State Privacy Laws
Co-authored by Chris Victory, FPF Intern As of halfway through 2025, four U.S. states have enacted laws regarding “neural data” or “neurotechnology data.” These laws, all of which amend existing state privacy laws, signify growing lawmaker interest in regulating what’s being considered a distinct, particularly sensitive kind of data: information about people’s thoughts, feelings, and […]
Balancing Innovation and Oversight: Regulatory Sandboxes as a Tool for AI Governance
Thanks to Marlene Smith for her research contributions. As policymakers worldwide seek to support beneficial uses of artificial intelligence (AI), many are exploring the concept of “regulatory sandboxes.” Broadly speaking, regulatory sandboxes are legal oversight frameworks that offer participating organizations the opportunity to experiment with emerging technologies within a controlled environment, usually combining regulatory oversight […]
Data-Driven Pricing: Key Technologies, Business Practices, and Policy Implications
In the U.S., state lawmakers are seeking to regulate various pricing strategies that fall under the umbrella of “data-driven pricing”: practices that use personal and/or non-personal data to continuously inform decisions about the prices and products offered to consumers. Using a variety of terms—including “surveillance,” “algorithmic,” and “personalized” pricing—legislators are targeting a range of practices […]
Tech to Support Older Adults and Caregivers: Five Privacy Questions for Age Tech
Introduction As the U.S. population ages, technologies that can help support older adults are becoming increasingly important. These tools, often called “AgeTech”, exist at the intersection of health data, consumer technology, caregiving relationships, and increasingly, artificial intelligence, and are drawing significant investment. Hundreds of well funded start-ups have launched. Many are of major interest to […]
The Connecticut Data Privacy Act Gets an Overhaul (Again)
Co-Authored by Gia Kim, FPF U.S. Policy Intern On June 25, Governor Ned Lamont signed SB 1295, amending the Connecticut Data Privacy Act (CTDPA). True to its namesake as the “Land of Steady Habits,” Connecticut is developing the habit of amending the CTDPA. Connecticut has long been ahead of the curve, especially when it comes […]
Annual DC Privacy Forum: Convening Top Voices in Governance in the Digital Age
FPF hosted its second annual DC Privacy Forum: Governance for Digital Leadership and Innovation on Wednesday, June 11. Staying true to the theme, this year’s forum convened key government, civil society, academic, and corporate privacy leaders for a day of critical discussions on privacy and AI policy. Gathering an audience of over 250 leaders from […]
FPF Unveils Paper on State Data Minimization Trends
Today, the Future of Privacy Forum (FPF) published a new paper—Data Minimization’s Substantive Turn: Key Questions & Operational Challenges Posed by New State Privacy Legislation. Data minimization is a bedrock principle of privacy and data protection law, with origins in the Fair Information Practice Principles (FIPPs) and the Privacy Act of 1974. At a high […]