Lessons for AI from the Data Privacy Debate

Key highlights this week:

• We’re currently tracking 638 bills in 45 states (plus another 112 congressional bills) related to AI this year, 53 of which have been enacted into law. 

• Governors in Colorado and Arizona signed new political deepfake laws. Currently, 17 states have enacted laws to regulate the use of deepfakes in elections. 

• Louisiana governor signs a sexual deepfake law. Currently, 20 states have enacted laws addressing sexual deepfakes. 

With the enactment of a comprehensive law in Colorado and several deepfake measures in other states, we are starting to see the enacted laws designed to deal with artificial intelligence technology. But if the policymaking battles over consumer data privacy are any indication, this is just the first chapter of the story of AI regulation. With legislative sessions in many states concluding, it is a good time to examine what efforts to pass privacy legislation can tell us about where AI legislation is headed.

In the past few years, 19 states have enacted their own version of comprehensive data privacy laws (with another bill sitting on the desk of the Vermont governor). The legislative debate surrounding these privacy laws can teach those engaged in AI policy debates several lessons, including that states are more than happy to fill a policy vacuum left by Congress, that the first state is not always the trendsetter that other states will emulate, and that protecting children will motivate aggressive action by lawmakers. Finally, the initial group of industry and policymaking actors taking on AI policy are veterans of the comprehensive data privacy law debates. 

This year, we have tracked 638 bills relating to AI, 53 of which have been signed into law. Much like with consumer data privacy, the absence of Congressional action has left a vacuum for states to fill. State lawmakers have stressed the need to act quickly on AI, having learned lessons from privacy legislation when tech companies were self-policing in their privacy policies for many years. Connecticut Senator James Maroney (D), a leading advocate for AI regulation, expressed that sentiment at a panel on AI last fall: “One argument is gonna be ‘it’s too new you can’t regulate us’. But then once it's around for a while, the argument will be ‘we’re already doing this, you can’t change the rules of the road now.”  

However, the complicated nature of the technology and the breadth of possibilities it offers will slow down regulatory efforts. In Connecticut, Maroney witnessed how reluctant many are to regulate a developing industry, with Governor Ned Lamont (D) and House Democrats unwilling to approve his Senate bill. The need for “broad guidelines”, as many lawmakers put it, runs up against the desire for a “light touch” for fear of overregulation. 

Those tensions are similar to the debates over whether data privacy laws should have enforcement through a private right of action, or be left with the state through the attorney general. Advocates wanted laws with real teeth, but industry groups raised concerns over compliance and litigation costs. After failed efforts to pass a privacy bill in Florida, lawmakers ultimately settled on a very narrow law that applies to just certain large companies with over $1 billion in global revenues. State lawmakers could take a similar approach with AI legislation, proposing “comprehensive” regulation that is narrowly applied only to those large companies that carry the most risk, while allowing smaller businesses to operate without such regulatory burdens.

While Colorado has struck first with a landmark comprehensive AI law, that does not ensure its position as a leader for other states to follow. California was the first state to enact privacy legislation in 2018, but subsequent states took some of those provisions and created a new model, the one set by Virginia and Colorado. Once again, lawmakers in California seek a leading role in AI policy, as their legislature continues to push AI legislation, including bills that would impose obligations on developers and deployers of automated decision tools, regulate digital replicas, and protect the consumer data used to train models. Texas could also provide a more business-friendly model when its legislature meets next year, as Rep. Giovanni Capriglione (R) has been heavily involved in the multi-state group of state lawmakers that studied AI last year and has vowed a package of bills that will prevent harms, but also foster innovation.

Lawmakers are also much more likely to take action when it comes to problems that concern children. This year brought a wave of bills to protect children online and privacy legislation has evolved to the point where most bills include heightened protections for data collected from minors. The single biggest issue this year on AI policy has been laws to combat sexual deepfakes, with 20 states now enacting laws specifically on that issue. Lawmakers have been motivated by news headlines about the proliferation of embarrassing deepfakes of high school students. Expect more states to enact provisions to add deepfakes to child pornography laws, prevent the use of AI in child exploitation, and protect data from minors from being trained for models.

Finally, some of the frustration from lawmakers over battles with tech groups has bled into AI policymaking as well. A bipartisan group of lawmakers held a press conference last month to call out the pushback they were getting from industry groups that have dominated so far, not unlike the frustrations lawmakers have expressed from their efforts to pass privacy legislation. Industry groups may find lawmakers are more combative and determined to pass some sort of regulation.

Lawmakers will convene in more study groups later this summer with recommendations for the next legislative session. Senator Maroney has already vowed to come back next year with better legislation, and many other lawmakers are likely to do the same. The trajectory of AI regulation remains complex, but both lawmakers and industry groups can learn from the privacy legislation battles of the last few years.

Recent Developments

In the News

• OpenAI Shuts Down Foreign Influence Networks: On Thursday, OpenAI released a report on how the company discovered and shut down covert influence operations using OpenAI’s generative AI tools based in Russia, China, Iran, and Israel. In related news, Wired has set up a database to track every instance of AI’s use in and around global electoral campaigns this year.
  

Major Policy Action 

• New York: Gov. Hochul (D) announced further steps to develop an AI innovation center at state universities. This year’s state budget includes $275 million for Empire AI, part of a $400 million public and private investment in a consortium of universities meant to provide access to AI tools for academics and entrepreneurs.

• Louisiana: Last Wednesday, Gov. Landry (R) signed a sexual deepfake bill (LA SB 6) into law, which provides for the crime of unlawful dissemination or sale of sexual images of another created by AI. The law will go into effect on Aug. 1, 2024. 

• Colorado: Last Friday, Gov. Polis (D) signed a political deepfake bill (CO HB 1147) into law, which prohibits distributing or publishing a political communication with a deepfake with reckless disregard that the candidate did not do or say what is being depicted within 60 days before a primary or 90 days before a general election without a disclaimer. 

• Federal: On Monday, Chief AI Officers were appointed for 24 federal agencies, ahead of a deadline set by the White House Executive Order on Artificial Intelligence. Next month, the Commerce Department will issue a report on authenticating content and detecting fakes, and later this summer the Patent and Trademark Office will recommend executive actions on AI and copyright. 

• Arizona: On Wednesday, Gov. Hobbs (D) signed a political deepfake bill (AZ SB 1359) into law, which prohibits the distribution of a deceptive and fraudulent deepfake of a candidate or political party within 90 days of an election without a disclaimer.

• Georgia: On Wednesday, Lt. Governor Burt Jones appointed members to Senate study committees, including the Senate Study Committee on Artificial Intelligence. Sen. John Albers (R) will chair the committee that includes six senators, an academic, an attorney, and a business professional.

Notable Proposals

• Pennsylvania: On Wednesday, lawmakers introduced new versions of bills on political deepfakes (PA HB 2353/SB 1217) and sexual deepfakes (PA SB 1213). There have been a total of eleven deepfake bills that have been considered this biennium in the Pennsylvania General Assembly.