USA Trends and Developments Contributed by: Paul Lanois, Fieldfisher
review cross‑border data flows and update contracts to incorporate the Rule’s mandatory safeguards. Penalties for violations can be significant: civil fines may reach USD368,136 or twice the value of the transaction and wilful violations may result in crimi - nal penalties of up to USD1 million or imprisonment for up to 20 years. The DOJ Rule reflects the DOJ’s increasing focus on national security risks associated with data transfers and signals the likelihood of further national security‑driven data regulations. A Slowdown in State Privacy Laws Despite the introduction of hundreds of consumer privacy bills, 2025 was the first year since 2020 in which no new comprehensive state privacy law was enacted. This leaves the total number of states with comprehensive privacy laws at 19. This does not mean that there was no movement on the legislative side: nine states passed amendments to their existing comprehensive privacy laws in 2025. Those states are Connecticut, Montana, Oregon, Colorado, Kentucky, Texas, Utah, Virginia and California. State regulators are also stepping up and increas - ing their collaboration on the implementation and enforcement of their privacy laws with the shared goal of protecting consumers’ privacy rights across jurisdictions and ensuring like-minded applications of the applicable laws across jurisdictions. The Consor - tium of Privacy Regulators was formed as a bipartisan effort that includes the California Privacy Protection Agency and state Attorneys General from California, Colorado, Connecticut, Delaware, Indiana, New Jer - sey and Oregon. A Renewed State Focus on AI Legislation On 23 January 2025, President Trump signed the Executive Order “Removing Barriers to American Leadership in Artificial Intelligence”, repealing the pre - vious administration’s order on safe and trustworthy AI, and taking aim at the risk of having a patchwork of different state regulatory regimes that could thwart innovation. Nevertheless, in the absence of a broad federal AI regulatory framework, certain US states are passing their own rules, resulting in a mix of federal actions and state laws that companies must follow when building or deploying AI.
Some states have nevertheless introduced state laws governing the use of AI. For example, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) establishes new obligations for organisa - tions that develop or deploy artificial intelligence sys - tems in Texas, including private entities and govern - ment bodies. TRAIGA prohibits the development or deployment of AI systems for certain high‑risk pur - poses, such as intentional unlawful discrimination or other statutorily defined harms, including the creation or dissemination of illegal or explicit content. TRAIGA places limitations on the deployment and develop - ment of certain AI systems and went into effect on 1 January 2026, which is one month before the Colo - rado AI Act. On 19 December 2025, the New York Governor signed the Responsible AI Safety and Education Act (the “RAISE Act”) into law, amending the version that was originally passed by the state legislature in June. The bill creates requirements for the training and use of AI frontier models, including creating a safety plan. Additionally, California finalised its regulations on cybersecurity audits, risk assessments and automat - ed decision-making technology (ADMT). The regula - tions went into effect on 1 January 2026, however companies still have some additional time to comply with the new requirements. Children’s Privacy Remains a Concern In April 2025, the Federal Trade Commission (FTC) issued its final updates to the Children’s Online Priva - cy Protection Act (COPPA) rules, which became effec - tive on 23 June 2025. These amendments broaden the obligations for operators of websites and online services that collect personal information from chil - dren under 13. Among the new requirements are the creation of a written children’s personal information security programme and enhanced parental con - trols over how a child’s data is used and shared. The amendments also obligate organisations to review and update their data collection, retention, security and disclosure practices to ensure ongoing compli - ance.
562 CHAMBERS.COM
Powered by FlippingBook