How to Fight Back Against AI

Italy's data protection authority (Garante) ordered ChatGPT to suspend operations in Italy on March 30, 2023, citing violations of GDPR relating to lack of legal basis for mass data collection, no age verification to protect minors, and inadequate disclosure to users whose data was used for AI train…

Arizona HB 2191 placed restrictions on new data center water usage permits in Maricopa County, requiring data centers consuming more than 1 million gallons of water per day to receive approval from the state Department of Water Resources. The law responded to growing concerns about AI data centers s…

NYC Local Law 144 requires employers using AI in hiring decisions to conduct annual bias audits by independent parties, and to publicly post a summary of the audit results. Employers must also notify candidates when automated employment decision tools are being used.

The EU Digital Services Act (DSA, Regulation 2022/2065) prohibits large platforms from using algorithmic recommendation systems to serve targeted advertising to minors and bans profiling of children for any commercial purpose. Platforms must conduct algorithmic risk assessments for harms to minors a…

California's Age-Appropriate Design Code Act (AB 2273, signed 2022) requires online services likely to be accessed by children under 18 to default to high-privacy settings, prohibit AI systems from profiling children without explicit consent, and conduct data protection impact assessments. Algorithm…

New York State enacted amendments to the law governing automated employment decisions (the nation's only state law on automated employment decisions at the time) requiring any company using AI tools to screen resumes or rank candidates for jobs in New York to obtain an annual bias audit from an inde…

New York City Local Law 49 of 2021 bans the NYPD and other city agencies from using predictive policing software and requires all surveillance technology acquisitions to go through a public review process. The law was driven by evidence that predictive policing algorithms — which use AI to forecast …

New York City Local Law 144 of 2021 requires employers and employment agencies using automated employment decision tools (AEDTs) to conduct independent bias audits before deploying them for hiring or promotion. Results of the bias audit must be made publicly available, and candidates must be notifie…

Colorado SB21-169 restricts insurers from using external consumer data and algorithms in ways that create unfair discrimination. The law requires insurers to demonstrate that AI and algorithmic tools used for underwriting, pricing, and claims do not unfairly discriminate against protected classes. R…

Portland, Oregon enacted two ordinances in 2020 banning facial recognition technology — one for city agencies and another, uniquely, for private businesses operating in public-facing spaces within the city. The private-sector ban was the first of its kind in the US and prohibits retailers, hotels, r…

Maryland HB 1202 prohibits employers from using facial recognition technology during job interviews without applicant consent. Employers who use facial recognition in pre-employment interviews must first obtain written consent from the applicant, making Maryland one of the first states to restrict A…

The Illinois Artificial Intelligence Video Interview Act (Public Act 101-0260) requires employers to notify applicants when AI is used to analyze video interviews and to explain how the AI evaluates candidates. Employers must obtain consent before using AI analysis and must delete video recordings u…

San Francisco Ordinance 103-19 was the first law in the United States to ban city government agencies from using facial recognition technology. The ordinance prohibits all city departments, including the police, from acquiring or using facial recognition or surveillance technology without prior boar…

The EU General Data Protection Regulation (GDPR, Regulation 2016/679) includes Article 22, which gives individuals the right not to be subject to solely automated decisions, including AI profiling, that significantly affect them. Data protection authorities have used GDPR to impose major fines on AI…

The Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14) requires companies to obtain written consent before collecting biometric data including fingerprints, retina scans, and facial geometry used in AI recognition systems. Companies must publicly disclose retention schedules and cannot s…