Hey all, here is a quick update on some recent activity on state privacy and AI laws.
Maine’s legislature has advanced a comprehensive privacy bill — the Maine Online Data Privacy Act (LD 1822) — through both chambers, though its path to becoming law remains uncertain. The bill closely mirrors Maryland’s privacy framework, featuring stringent data minimization requirements, enhanced protections for children’s privacy, and prohibitions on the sale of sensitive data. However, a Senate amendment adding a controversial exemption for political organizations has created friction even among Democrats, with some joining Republicans in opposition. If enacted, the law would apply to businesses that handle the personal data of at least 35,000 Maine residents or at least 10,000 consumers and derive 20% or more of gross revenue from data sales, with a proposed effective date of September 1, 2027.
On the AI front, Oregon’s Senate Bill 1546 — one of the first AI chatbot safety bills to clear a state legislature in 2026 — passed with near-unanimous support and is headed to the governor’s desk. The bill requires AI chatbot operators to disclose that users are interacting with a bot rather than a human, provide break reminders, and prohibit the use of addictive algorithms, with additional protections for users believed to be minors. Notably, the bill includes a private right of action for statutory damages, which legal experts have flagged as a significant concern for companies deploying consumer-facing AI, given ambiguities in the language governing applicability and the potential for broad litigation as chatbot technology continues to evolve.
CIPAWorld 