Search results for: biometric

On January 1, 2026, Texas’s newest law addressing the growing issues of data privacy and the use of Artificial Intelligence went into effect. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) was passed by the 89th Texas Legislature and signed into law by Gov. Greg Abbott in 2025.

The law’s central focus is on restricting and regulating the use of Artificial Intelligence (AI) systems in Texas, which includes adding new prohibitions and requirements on anyone who develops or deploys AI systems in the private sector.

What does TRAIGA prohibit?

Under TRAIGA, private entities are prohibited from developing or deploying AI systems in a manner that:

  • Intentionally aims to incite or encourage a person to commit physical self-harm (including suicide), harm another person, or engage in criminal activity;
  • Serves the sole intent of producing, assisting or aiding in producing or distributing child pornography or certain sexually explicit “deep fake” videos or images;
  • Impairs a person’s individual rights guaranteed under the U.S. Constitution; or
  • Unlawfully discriminates against a protected class in violation of state or federal law.

TRAIGA also prohibits governmental entities from using or deploying AI systems for uniquely identifying a specific individual using biometric data or gathering images or other media without the individual’s consent if such gathering would infringe on the individual’s rights, as well as barring “social scoring” by government entities to evaluate or classify people based on social behavior or personal characteristics, or developing or deploying such systems for the purpose of identifying individuals using biometric data or data from the internet or other public sources without the individual’s consent.

How does TRAIGA prohibit unlawful discrimination?

While TRAIGA’s prohibitions against self-harm and sexual content attract more attention as “high risk” AI systems, the law’s emphasis on unlawful discrimination is of particular concern for many businesses that utilize AI in aspects of their Human Resources, employee evaluation, or recruitment process. Although TRAIGA expressly notes that disparate impact alone is not sufficient to establish a violation, the law otherwise bars any intentional discrimination.

Are any industries treated differently under TRAIGA?

Yes. Although TRAIGA’s requirements generally apply across all industries, the law carves out two unique cases. First, the law’s prohibition on unlawful discrimination does not apply to insurance companies for the purposes of providing insurance services if the company is already subject to statutes regulating unfair discrimination, unfair methods of competition, or unfair or deceptive acts or practices related to the insurance industry.

Additionally, if an AI system is used to provide health care services or treatment, the provider of such service or treatment must provide a clear and conspicuous disclosure to the patient (or patient’s representative) no later than the date the service or treatment is first provided (except in case of emergency).

What are the penalties for violating TRAIGA and who can enforce its prohibitions?

Like other recent efforts by Texas to secure residents’ data privacy and biometric data, TRAIGA does not provide a private cause of action, but tasks the Texas Attorney General with enforcing any violations of TRAIGA following a sixty-day cure period following a notice of violation. Civil penalties under the law can range for $10,000 to $12,000 per violation for any “curable” violation, while penalties for “uncurable” violations can be as high as $80,000 to $200,000 per violation. The law further incentivizes prompt remediation by applying civil penalties for ongoing violations of between $2,000 and $40,000 daily as long as the violation continues.

What can businesses do to comply with TRAIGA?

As AI use is a developing field, TRAIGA also encourages businesses to take proactive steps to adopt compliance measures and self-audit protocols by providing various safe harbors and affirmative defenses for parties who identify potential violations through internal review, adversarial testing, or compliance with recognized risk management frameworks, such as the National Institute of Standards and Technology (NIST) AI Risk Management Framework.

The Texas Attorney General has demonstrated a growing interest in prosecuting technology-related violations in recent years, resulting in several high-profile settlements in the hundreds of millions and billions of dollars. In light of this enforcement priority, Texas businesses should proactively take steps to ensure their actions are compliant with TRAIGA and all other recent data privacy and data security laws in effect, including:

  • Evaluating whether and how they are using any AI system in the workplace, especially with regard to employment decisions
  • Creating AI-specific policies and procedures to ensure any AI use, now or in the future, is regulated and potential violations can be identified and cured promptly
  • Developing procedures for self-auditing and internal review of AI systems prior to full roll-out, and
  • Adopting a recognized AI risk management framework, such as the NIST AI Risk Management Framework

If your organization is one of the many adopting AI use in any aspect of its operations, it is essential that you conduct a prompt review of your usage to ensure your entity is not at risk of non-compliance.

As AI-powered hiring tools become more widespread, it is important to remember that some states have acted early and their laws should be reflected in an organization’s governance, risk, and compliance program. Maryland’s Labor and Employment Code Section 3-717 which became effective October 1, 2020, is one example. We break down the key requirements and highlight multistate considerations.

Q: Who does the law apply to?

The law applies to employers who use facial recognition services during applicant interviews. Its protections run to applicants, generally individuals who are interviewing for employment. The law does not, by its terms, extend to current employees or to other stages of the employment relationship beyond the interview. It is unclear, however, whether the law may also protect employees of an organization applying for other positions at the same organization.

Q: What does Maryland Section 3-717 actually prohibit?

The statute prohibits an employer from using a “facial recognition service” to create a “facial template” during a job applicant’s interview, unless the applicant has first provided consent. A “facial recognition service” is defined as technology that analyzes facial features and is used for the recognition or persistent tracking of individuals in still or video images, and a “facial template” is the machine-interpretable pattern of facial features extracted from one or more images of an individual by such a service.

Q: How does an applicant give consent under the Maryland law?

Consent must be provided through a signed waiver. The waiver must be written in plain language and include: (1) the applicant’s name, (2) the date of the interview, (3) a statement that the applicant consents to the use of facial recognition during the interview, and (4) whether the applicant has read the consent waiver.

Q: Does Section 3-717 apply to all uses of AI in hiring?

No. The Maryland statute is narrowly focused on facial recognition services used to create facial templates during interviews. It does not broadly regulate other AI-based tools an employer might use in the hiring process, such as resume-screening algorithms or chatbot-based assessments, unless those tools incorporate facial recognition technology as defined in the statute.

Q: How does the Maryland law differ from the Illinois Artificial Intelligence Video Interview Act (AIVIA)?

Although both laws regulate the use of technology during applicant interviews, there are several notable differences:

  • Scope of technology covered. Maryland’s Section 3-717 targets only “facial recognition services” used to create a facial template. The Illinois AIVIA, which became effective January 1, 2020, is broader: it applies whenever an employer asks applicants to record video interviews and uses “artificial intelligence analysis” of those videos, which can encompass a wider range of AI evaluations beyond facial recognition alone.
  • Disclosure and transparency. The Illinois AIVIA requires employers to (a) notify the applicant before the interview that AI may be used to analyze the video and assess their fitness for the position, and (b) provide an explanation of how the AI works and what general types of characteristics it evaluates. Maryland’s statute has no comparable pre-interview disclosure or transparency requirement — it requires only a signed consent waiver.
  • Form of consent. Maryland requires a specific written waiver containing the applicant’s name, interview date, a consent statement, and an acknowledgment of whether the applicant read the waiver. Illinois requires consent to be obtained before the interview but does not prescribe the same formalized waiver requirements.
  • Video sharing and deletion. The Illinois AIVIA includes additional protections that have no counterpart in the Maryland statute. Under the Illinois law, employers may not share applicant videos except with persons whose expertise or technology is necessary to evaluate the applicant, and employers must delete interview videos (including backup copies) within 30 days of an applicant’s request. Maryland’s Section 3-717 does not address video sharing or data deletion.

Q: What should multi-state employers take away from these laws?

An ongoing challenge for organizations operating in multiple states is the patchwork of similar laws addressing similar technologies, but sometimes with a different scope or context, along with some unique provisions.

Here, we focused on two laws that address the interview process for job applicants. One might ask whether there are other statutes that regulate the interview process in this way. Focusing only on regulation of job interviews might cause one to miss other critical compliance requirements.

The Maryland and Illinois laws discussed above may involve the collection of biometric information that, for example, also is protected under more general laws, such as the California Consumer Privacy Act (CCPA), the Illinois Biometric Information Privacy Act (BIPA), and other states with protections for such information (e.g., Colorado and Texas).

Additionally, neither the Maryland nor Illinois job interview laws includes obligations to safeguard the facial scan data collected during covered interviews. However, other state laws may include such a requirement. Maryland’s own Personal Information Protection Act (PIPA) requires:

a business that owns, maintains, or licenses personal information of an individual residing in the State [to] implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information owned, maintained, or licensed and the nature and size of the business and its operations.

Under the PIPA, personal information includes biometric information.

It is not enough to think about just the activity the organization is engaged in – a job interview – employers need to consider a range of other issues to fully appreciate the regulatory environment for that activity – the kind of data collected, the location of the collection, who is collecting it, the state of residency of the person providing the information, how that data is collected and analyzed, among other things.

Artificial intelligence is rapidly transforming human resources operations. From AI-powered recruiting platforms that screen résumés and rank candidates, to onboarding tools that personalize new-hire experiences, performance management systems that predict attrition, identity verification solutions using biometrics, and platforms administering ERISA-governed benefit plans, employers are increasingly relying on third-party vendors whose products are built on or enabled by AI. For labor and employment lawyers, this shift demands a fresh look at how we negotiate and structure vendor agreements.

While most states have not yet enacted AI-specific employment legislation, all employers deploying such technologies should pay careful attention to the terms in their AI vendor agreements. A patchwork of state laws is emerging across the country, federal agencies are actively extending existing frameworks to AI, and even a vendor’s home-state obligations can shape the contractual landscape. This article offers a high-level overview of several key issues practitioners should consider when negotiating agreements with HR technology vendors that use AI.

Define What You’re Buying

Vendor agreements should clearly define service provided under the agreement, capturing not only products explicitly marketed as AI but also any service that includes, incorporates, or is based upon or enabled by artificial intelligence, including generative AI, and agentic AI systems that autonomously act and make decisions in response to prompts and other actions.

Equally important is defining the vendor’s obligation to disclose the nature and extent of its use of AI. Require that the vendor mark or otherwise identify for Customer in writing all deliverables that incorporate or derive from AI, and provide upon request, a full disclosure of the use of AI services in connection with the preparation of any deliverables. Similarly, consider requiring the vendor to notify the employer of a new AI use case, particularly when the current services do not involve AI. Without this transparency, employers cannot assess their own compliance obligations under emerging state and federal laws.

Data Ownership and Restrictions on Training

HR data is among the most sensitive information an organization holds. Vendor agreements should unambiguously establish employer ownership of all content, prompts, inputs, and—critically—all generated output, meaning results or derivative works created by the AI using the employer’s data. Perhaps most important, the agreement should expressly prohibit the vendor from using employer data to train, retrain, or improve its AI models without approval. This is not a theoretical concern—HR data used to train a general-purpose model could expose the employer to claims under data privacy laws and compromise confidential workforce information.

Bias Testing and Anti-Discrimination Protections

The risk of algorithmic bias is the headline issue for AI-driven decision making, particularly in certain areas including health care, housing, financing, and, of course, employment. A growing number of jurisdictions are imposing affirmative obligations on employers who deploy these tools.

New York City’s Automated Employment Decision Tool (AEDT) law, for example, requires employers to ensure an independent bias audit was conducted within the past year before using an AEDT for hiring or promotion decisions, and to publish a summary of the audit results. California’s Civil Rights Department regulations do not have an express bias audit requirement, but recognize that evidence of anti-bias testing or similar proactive efforts to avoid unlawful discrimination is relevant to defending a claim. A similar rule is present in Connecticut’s new AI law.

Because of these regulatory developments, and considering the extent to which organizations rely on vendors for these technologies, employers should negotiate the right to request and receive documentation of the vendor’s bias testing methodology, frequency, and results, and include contractual obligations for the vendor to maintain governance standards and validation procedures.

Cybersecurity Assessment and AI Incident Response

Before onboarding any AI vendor (or, really, any vendor that processes confidential or personal information), employers should conduct a thorough cybersecurity assessment, particularly where the vendor will process biometric data, health information, or other sensitive employee data. The agreement should require the vendor to maintain a written information security program that includes, without limitation, administrative, physical, technical, and organizational safeguards. The agreement also should establish a robust AI incident response protocol, requiring the vendor to notify the employer promptly in writing of any AI incident, and to take corrective action to remediate the issue and prevent recurrence.

Change Management

AI models are not static, they are updated, retrained, and sometimes fundamentally altered. A performance management tool that worked as expected last quarter may behave differently after a model update. Vendor agreements should require advance written notice of material changes to AI services, with enough lead time for the employer to assess potential impacts. The agreement should also grant the employer the right to test and validate changes prior to implementation and require the vendor to maintain appropriate version control, monitoring, and change management procedures throughout the lifecycle of the AI services.

Subcontractors and Third-Party AI Providers

Many vendors do not build their AI models in-house; they integrate third-party AI models or systems, APIs, and/or subprocessors. The agreement should require the vendor to disclose all third-party AI providers, including the nature and scope of their access to employer data. And, liability for those downstream risks to data should be made clear. Preferably, the vendors should remain liable for all acts and omissions of its subcontractors to the same extent as if the acts or omissions were those of the vendor.

Record Retention

Emerging AI laws are creating new recordkeeping obligations. Colorado’s AI Act, for instance, requires deployers to “maintain records to demonstrate compliance” for at least three years after the date of a consequential decision, which may include version identifiers, change logs, and documentation of mitigation changes. Vendor agreements should include record retention obligations that align with these requirements and ensure that the employer has access to the records it needs to demonstrate compliance.

Liability Allocation: Lessons from Colorado and Beyond

Liability allocation is where vendor negotiations often get most contentious. Colorado’s AI Act offers an instructive framework: it provides that liability in discrimination actions involving AI shall be “allocated based on relative fault” between developers and deployers. Colo. Rev. Stat. § 6-1-1707(2). Notably, the Colorado law:

shields a developer from liability when the developer’s covered AI tool is used by the deployer in the manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer.

In other words, if an employer repurposes an AI tool for a use the vendor never intended or contracted for, the employer may not shift liability to the vendor. For the deployer, managing the use of the tool to align with the services agreement (i.e., governance) will be critical.

This statutory framework underscores the importance of clearly defining the permitted use of AI services in the vendor agreement and having the governance structure to abide by those provisions. A strong indemnification clause should cover claims arising from allegations that the AI service or its output infringes third-party intellectual property rights, privacy and security has been breached, and breaches of AI-specific obligations.

Looking Ahead

The regulatory landscape for AI in employment is evolving rapidly. Connecticut’s new AI law takes effect in October 2027 and will require employers to provide certain disclosures, including the purpose of the technology, the categories of personal data analyzed, and the data sources used. California’s CCPA automated decisionmaking regulations, with a compliance deadline of January 1, 2027, will require pre-use notices, opt-out mechanisms, and risk assessments. 

For employers, the message is clear: the critical role vendors play in AI deployment, together with the combination of multi-state compliance obligations, federal agency guidance, the risk to personal information, and the sheer pace of AI adoption in HR, means that vendor agreements are a foundational component of compliance and risk management. Taking the time to negotiate comprehensive, AI-specific terms today will pay dividends when, not if, the regulatory and litigation landscape catches up.

Senate Bill (SB) 1130, legislation that would establish criminal penalties for certain uses of wearable recording devices, continues to move through the California legislature. I’ve had the honor of discussing this measure with staff of the bill’s sponsor, California State Senator Eloise Gómez Reyes, and anticipate there will be more efforts to enact laws seeking to impose measured responses to the privacy, security, and other challenges posed by the latest generation of AI-enabled wearables.

The Rise of AI-Enabled Smart Glasses

SB 1130 arrives at a critical moment. Modern AI glasses blend high-resolution cameras, always-on microphones, and real-time AI assistants into a hands-free wearable that can capture, analyze, and even transcribe ambient information around the wearer. Unlike traditional recording devices that require deliberate action, AI glasses and similar wearables can passively capture and transcribe conversations throughout the day, creating permanent searchable records of discussions that participants never knew were being documented.

Several institutions and organizations have taken steps to minimize the impact of these devices. For example, in July 2026, New York became the first state to prohibit AI-enabled smart glasses in all state courthouses. Outside the U.S., in August 2026, England and Wales followed suit when His Majesty’s Courts & Tribunals Service (HMCTS) announced that AI glasses will be confiscated from anyone entering its judicial buildings. The UK has also seen its first criminal prosecution involving smart glasses, with a guilty plea for voyeurism at Warrington Magistrates’ Court after a man recorded sex with a woman without her consent using smart glasses.

As we explored in our four-part series on AI glasses, “The Hidden Legal Minefield: Compliance Concerns with AI Smart Glasses,” these devices no doubt raise compliance issues spanning biometrics, two-party consent, workplace surveillance, labor law, data security, and third-party AI processing risks.

What SB 1130 Would Do?

Specifically, SB 1130 would make it a misdemeanor to operate a wearable recording device to capture sound or video of another person in any area within a place of business where that person has a reasonable expectation of privacy, without their explicit consent. Penalties include up to one year in county jail, a fine of up to $1,500 per violation, or both.

The bill also targets the circumvention of recording indicators such as small lights or sounds that signal a device is actively recording. Disabling an indicator would itself be a misdemeanor, and the manufacture, sale, or use of technology primarily designed to disable recording indicators would carry civil penalties of up to $2,500 per violation.

What is a wearable recording device?

SB 1130 defines wearable recording device to mean:

“any device that is designed to be worn on or attached to the body, rather than held by the user, that has the capacity to make sound or video recordings or to transmit sound or video to another device or to the internet.”

This definition likely would capture a broad array of devices beyond AI glasses. However, recent amendments adding “rather than held by the user,” potentially indicate an intention to avoid capturing smartphones, which generally are not designed to be worn or attached to the body (parents of 13-17 years old children may disagree) and typically are held by the user.

What is a place of business?

SB 1130 defines a place of business to mean:

“any physical office or retail establishment in which members of the public receive goods or services from the business.”

What is a reasonable expectation of privacy?

It is not clear at this point and may never be. While walking down a public sidewalk in California does not generally give rise to a reasonable expectation of privacy for visual observation, California law can be more protective than many other states when it comes to audio recording of conversations, targeted or technologically enhanced surveillance, and publication of private facts, even when the underlying events occurred in technically “public” spaces. The context, the nature of the information, and the technology used all matter.

This may be why SB 1130 focuses specifically on places of business where a person has a reasonable expectation of privacy, rather than attempting to regulate all public recording.

Are there provisions which would affect some employees directly?

The bill carves out of the definition of wearable recording devices:

“a headset, two-way radio, or similar device that is operated by an employee during the normal course of their business duties and is provided by their employer for that purpose.”

This description potentially includes positions such as call center representatives and order processors at some fast food restaurants. While providing some relief from its reach, SB 1130 also provides that employees who record sound or video of a customer using such devices must inform the customer that they are being recorded. So, in addition to assessing the implications of more cutting-edge technologies entering the workplace, some employers may need to revisit how their employees use more traditional recording equipment.

What comes next?

SB 1130 has not yet been enacted and must still clear the full legislature and receive the Governor’s signature. But the trajectory is clear: California is moving to close the gap between legacy wiretapping statutes and modern wearable technology and, as noted, it is part of a global trend.

We will continue monitoring SB 1130 as it moves through the legislative process. In the meantime, if you have questions about this bill or related issues, contact a Jackson Lewis attorney to discuss.

New York has become the first state to prohibit AI-enabled smart glasses and other recording-enabled eyewear in all state courthouses. The new policy reflects growing concern over the ability of these devices to discreetly capture audio, video, photographs, and AI-generated transcripts. Below are answers to some common questions about the new rule and what it may signal for how organizations approach this technology.

Are AI Glasses Permitted in New York Courts?

Effective July 20, 2026, according to a memorandum by New York’s Office of Court Administration Executive Director, Justin Barry, on July 1, 2026, the New York State Unified Court System prohibits visitors from bringing smart glasses and other eyewear or headwear equipped with cameras, microphones, or other recording technology into any New York state courthouse. The prohibition applies to more than 1,200 state, county, city, town, and village courts throughout the state.

“This prohibition applies to all individuals entering court facilities, including litigants,
attorneys, witnesses, family members, UCS employees, and all other individuals who seek to enter a UCS facility for any reason.”

Why did New York adopt this policy?

The court system explained that AI-enabled smart glasses present unique challenges because they can record proceedings, conversations, and participants without being readily apparent to others. The statewide rule is intended to reinforce existing prohibitions on unauthorized recording in court facilities and to protect the integrity of judicial proceedings, confidential communications, and courthouse security.

Are prescription smart glasses prohibited?

Yes. Individuals who wear prescription smart glasses are expected to bring a conventional pair of prescription glasses if they need to enter a courthouse.

Is New York the first state to take this step?

New York appears to be the first state to implement a statewide prohibition applicable to every state court. However, courts in other jurisdictions have already begun restricting smart glasses through local rules, courthouse policies, or individual judicial orders. As adoption of AI-enabled wearables accelerates, additional statewide restrictions would not be surprising.

Why should organizations care about a courthouse policy?

For starters, lawyers and litigants who are not aware, or think they will get a pass, may show up at court with prescription AI glasses. According to the memorandum, “no individual possessing smart glasses will be permitted to enter a UCS facility unless they voucher the smart glasses for safekeeping by uniformed personnel while the individual remains in the facility.”  Without a backup pair of conventional glasses, they will not be able to enter the facility and participate in their case.

The New York policy also reflects a broader trend. Organizations across many industries are recognizing that existing “no recording” policies often were not drafted with AI-enabled wearable devices in mind. Smart glasses may continuously capture audio, video, images, location information, and AI-generated summaries while appearing no different from ordinary eyewear.

What are the broader legal and compliance issues with AI glasses?

There are many. We summarized a range of issues in our four-part series examining the legal and practical implications of AI-enabled smart glasses:

  • Part 1: Biometrics, facial recognition, and emerging privacy concerns.
  • Part 2: Audio recording, wiretapping, and consent laws.
  • Part 3: Workplace privacy, surveillance, and labor law considerations.
  • Part 4: Cybersecurity, data governance, and incident response implications.

What are some terms an organization should consider including in a policy on these devices?

A short list includes:

  • Defining AI-enabled wearable devices covered by the policy;
  • Recording in the workplace;
  • Protection of confidential and proprietary information;
  • Attorney-client privileged communications;
  • Customer and employee privacy;
  • Visitor access policies; and
  • Appropriate use of AI-enabled technologies.

Are other organizations taking similar action?

Yes. Courts are only one example. Law firms, healthcare providers, schools, financial institutions, retailers, entertainment venues, and other organizations are evaluating whether to restrict or regulate AI-enabled smart glasses in sensitive environments. Some organizations have already prohibited their use in conference rooms, client meetings, secure facilities, or other locations where confidential information is routinely discussed.

What is the takeaway?

New York’s action demonstrates that organizations are beginning to move beyond generic recording-device policies and adopt rules specifically addressing AI-enabled wearable technology. As smart glasses become increasingly sophisticated and widely used, organizations should expect additional legislation, court rules, and organizational policies governing their use.

For organizations that have not yet evaluated the implications of AI-enabled smart glasses, now may be an appropriate time to review workplace policies, security protocols, and AI governance programs to determine whether they adequately address this rapidly evolving technology.

Vermont has passed Senate Bill 71, a comprehensive privacy law that will regulate how covered entities collect, use, disclose, sell, and protect personal data.

The law is scheduled to take effect on January 1, 2028.

To whom does the law apply?

The law applies to people who conduct business in Vermont or produce products or services targeted at Vermont residents and meet one of several thresholds during the preceding calendar year. A business may be covered if:

  • It controls or processes the personal data of at least 35,000 consumers (not counting personal data controlled or processed solely to complete a payment transaction);
  • Controls or processes the sensitive data of at least 3,000 consumers (not counting personal data controlled or processed solely to complete a payment transaction); or
  • Offers for sale the personal data of at least 3,000 consumers.

The Act also contains specific provisions for consumer health data, which seem to be in line with efforts in other states to fill perceived gaps in the protection of health data left by HIPAA. Those provisions apply more broadly to people conducting business in Vermont or producing products or services targeted at Vermont residents.

The law includes numerous exemptions, including for certain government entities, certain HIPAA-regulated entities and data, financial institutions and data subject to the Gramm-Leach-Bliley Act, Fair Credit Reporting Act activities, and other regulated or limited categories.

Who is protected by the law?

The Act protects “consumers,” defined generally as Vermont residents.

However, the definition excludes individuals acting in a commercial or employment context, including employees, owners, directors, officers, contractors, or representatives of an organization when their communications or transactions occur solely within that role.

The law also includes heightened protections for children and minors, such as restricting targeted advertising and the sale of personal data.

What data is protected by the law?

The Act protects “personal data,” defined broadly to include information that is linked or reasonably linkable to an identified or identifiable individual or to a device associated with such an individual. This includes derived data and unique identifiers but excludes deidentified data and publicly available information.

The law provides heightened protections for “sensitive data.” Sensitive data includes data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, nonbinary or transgender status, citizenship or immigration status, health conditions, disability, or treatment. It also includes consumer health data, genetic or biometric data, children’s data, precise geolocation data, neural data, certain financial account credentials, and government-issued identification numbers.

What are the rights of consumers?

Under the law, consumers may require a controller to do the following:

  • Confirm whether the controller is processing the consumer’s personal data and accessing that data.
  • Correct inaccuracies.
  • Delete personal data.
  • Provide a portable and, where technically feasible, readily usable copy of personal data previously provided by the consumer;
  • Allow the consumer to opt out of processing for targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions; and
  • Provide a list of third parties to whom the controller has sold personal information. 

What obligations do controllers have?

Controllers have several duties, including:

  • Controllers must limit the collection of personal data to what is reasonably necessary and proportionate to disclosed purposes. Remember, data minimization.
  • They may not process personal data for a materially new purpose (other than what is reasonably necessary and proportionate in relation to the purposes for which the data are processed, as disclosed to the consumer) unless they obtain consent.
  • They also must maintain reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of the personal data. For sensitive data, controllers generally must obtain consent before processing or selling the data.
  • They must provide an effective mechanism for consumers to revoke consent and stop processing within 15 days after receiving the revocation request.
  • Controllers also must avoid unlawful discrimination and refrain from discriminating against consumers for exercising privacy rights.
  • Controllers must maintain certain contractual terms with processors.
  • Controllers must provide clear, accessible (e.g., website homepage, app settings menu, etc.) privacy notices. Those notices must disclose, among other things, categories of data processed, processing purposes, consumer rights, categories of personal data sold to third parties, and the categories of those third parties, “clear and conspicuous” disclosures concerning targeted advertising, contact information, whether personal data is used to train large language models, and the date of the latest update.

Controllers must also provide secure methods for consumers to exercise their rights, honor qualifying opt-out preference signals, and conduct data protection assessments for certain high-risk processing activities, including targeted advertising, sales of personal data, sensitive data processing, and certain profiling.

How is the law enforced?

The Vermont Attorney General enforces the Act. The law does not create a private right of action, meaning consumers generally may not sue directly for violations under the Act.

The Attorney General must provide guidance to controllers and processors and submit annual reports to the General Assembly regarding enforcement activity. During the period from January 1, 2028, through June 30, 2029, the Attorney General must provide notice and a 60-day opportunity to cure when the Attorney General determines that a cure is possible before initiating an enforcement action.

If you have questions about Vermont’s new privacy law or related issues, please reach out to a member of our Privacy, AI, and Cybersecurity practice group to discuss.

With the Governor of Louisiana’s signature on Senate Bill 386, Louisiana becomes one of the latest states to enact a comprehensive consumer privacy law, joining more than twenty states that have adopted similar frameworks in recent years. Like laws in Texas, Virginia, Colorado, and other states, the Louisiana Data Privacy Act (LDPA) adopts a controller/processor framework, grants consumers rights over their personal data, and authorizes enforcement by the state attorney general rather than private litigants. The Act takes effect January 1, 2027.

To whom does the law apply?

The law applies to a person or entity that does business in the state and meets at least one of these thresholds:

  • Annual gross revenues over $25 million
  • Annually buys, receives, sells, or shares for commercial purposes the personal information of 75,000 or more consumers, households, or devices.
  • Derives 50 % or more annual revenues from selling consumers’ personal information.

Notably, Louisiana’s applicability thresholds differ from many recent state privacy laws that focus primarily on the volume of consumer data processed. Instead, the LDPA incorporates revenue-based thresholds similar to those found in California’s privacy framework, applying to businesses with annual gross revenues exceeding $25 million regardless of the amount of personal data processed.

The law does not apply to various categories, including state agencies, certain financial institutions, and GLBA-regulated data, HIPAA-covered entities and business associates, nonprofits, and institutions of higher education.

Who is protected by the law?

The law protects consumers, defined as Louisiana residents acting only in an individual or household context. The law expressly excludes individuals acting in a commercial or employment context.

Under the law, a child’s parent or legal guardian may exercise the child’s consumer rights on the child’s behalf.  

What data is protected by the law?

The law protects personal data, which is information that is linked or reasonably linkable to an identified or identifiable individual. It excludes deidentified data or publicly available information.

Under the law, “sensitive data” is protected and includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, genetic or biometric data used to uniquely identify an individual, personal data collected from a known child, and precise geolocation data. Businesses should pay particular attention to the law’s treatment of sensitive data. Like many recently enacted state privacy laws, Louisiana generally requires consumer consent before processing sensitive data.

What rights do consumers have?

Under the law, consumers may require a controller to do the following:

  • Confirm whether the controller is processing the consumer’s personal data and access that data;
  • Correct inaccuracies;
  • Delete personal data;
  • Provide a portable and, where technically feasible, readily usable copy of personal data previously provided by the consumer; and
  • Allow the consumer to opt out of processing for targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions. 

Controllers generally must respond within 45 calendar days, with one additional 45-day extension when reasonably necessary to such requests.

What obligations do controllers have?

Under the law, controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purpose and must maintain reasonable administrative, technical, and physical security practices appropriate to the data.

Controllers must provide a reasonably accessible and clear privacy notice describing categories of personal data processed, processing purposes, how consumers may exercise rights and appeal decisions, categories of personal data sold, categories of third parties to whom data is sold, and request submission methods.

If a controller sells sensitive data or biometric data, it must have a specific notice to that effect.

A contract between a controller and a processor must address the processor’s data processing procedures with respect to processing performed on behalf of the controller. Similar to other state privacy laws, the LDPA requires such contracts to include certain provisions, such as:

  • clear instructions for processing data;
  • the type of data subject to processing;
  • the duration of processing; and
  • a requirement that the processor make available to the controller, on reasonable request, all information in the processor’s possession necessary to demonstrate the processor’s compliance with the requirements of the LDPA.

Controllers must also conduct and document data protection assessments for targeted advertising, the sale of personal data, certain risky profiling, the processing of sensitive data, and other activities. Controllers that already maintain privacy impact assessments under other state laws may be able to leverage existing compliance processes.

How is the law enforced?

The state attorney general may enforce the law. And violations shall constitute an unfair and deceptive trade practice pursuant to the Unfair Trade Practices and Consumer Protection law, excluding private rights of action. Note, however, that the LDPA provides a 30-day cure period that sunsets on July 31, 2027, providing organizations with a limited opportunity to address alleged violations during the law’s early implementation period.

Although the LDPA largely follows the increasingly familiar state privacy law framework, businesses should not assume existing compliance programs automatically satisfy Louisiana’s requirements. Organizations with multi-state privacy compliance programs should review their privacy notices, consumer rights request procedures, consent mechanisms for sensitive data, and data protection assessment processes before the law takes effect on January 1, 2027.

If you have questions about Louisiana’s new privacy law or related issues, please reach out to a member of our Privacy, AI, and Cybersecurity practice group to discuss.

Key Takeaways

  • Outlines key considerations for businesses using productivity management and monitoring platforms – such as, Teramind, ActivTrak, and Insightful – and whether their use may require a CCPA risk assessment.
  • Identifies the specific CCPA risk assessment triggers most relevant to such productivity technologies.

Productivity management and monitoring platforms have become a fixture of the modern workplace—particularly for remote and hybrid workforces. These tools can track application usage, keystrokes, website visits, active and idle time, and even capture periodic screenshots of employee screens. Some platforms go further, using artificial intelligence to generate productivity scores, assess engagement levels, and flag behavioral anomalies. Businesses subject to the California Consumer Privacy Act (CCPA) and deploying this type of technology, should carefully consider whether a risk assessment is required before or during that use.

The first question is always whether the CCPA applies to the business at all. If the business has not yet made that determination, our comprehensive CCPA FAQs is a helpful starting point. Assuming the CCPA applies, the next question is whether the specific processing activity at issue presents a “significant risk” to consumer privacy—the standard that triggers the assessment obligation.

Our earlier posts on CCPA risk assessment basics discuss when the CCPA risk assessment requirement applies and the general requirements for conducting and reporting a risk assessment. This post focuses specifically on productivity management and monitoring platforms.

What Do Productivity Management and Monitoring Platforms Do?

Modern productivity platforms vary considerably in their capabilities and configurations. At a minimum, many log which applications an employee uses and for how long. More sophisticated deployments capture screenshots at regular intervals, record keystrokes, monitor email and messaging communications, and track time spent on specific websites or documents. AI-enhanced platforms layer on behavioral analytics, producing output that can characterize an employee’s work patterns, predict disengagement, or rank individuals against their peers.

The breadth of data collected—and the degree to which it is processed automatically to draw inferences about individual employees—is precisely what makes these platforms significant from a CCPA risk assessment perspective.

Which CCPA Risk Assessment Triggers Apply?

The updated CCPA regulations, which became effective in 2026, identify specific processing activities that require a risk assessment. Businesses using productivity management and monitoring platforms should evaluate at least three of them:

First, the regulations require a risk assessment when a business profiles a consumer (which includes employees and contractors) through “systematic observation.” The term “systematic observation” is defined broadly to include “methodical and regular or continuous observation,” and expressly covers “video or audio recording or live-streaming” and “technologies that enable physical or biological identification or profiling.” Periodic screenshots, continuous application logging, and keystroke capture may fall within this definition. “Profiling” itself is defined to include “any form of automated processing of personal information to evaluate certain personal aspects… relating to a natural person,” specifically including analysis of “performance at work,” “reliability,” “predispositions,” and “behavior.” A platform that generates productivity scores or behavioral profiles may fall within this definition.

Second, to the extent a productivity monitoring platform uses automated decision-making technology (ADMT) to make or meaningfully contribute to significant decisions about employees—such as decisions about compensation, employment opportunities, or similar matters—a risk assessment may be independently required on that basis. Businesses should carefully examine whether the platform’s output is used in any formal or informal employment decision-making process.

Third, if the platform processes any “sensitive personal information” as defined under the CCPA—such as health information (e.g., inferences about mental health from behavioral data), or biometric data (e.g., keystroke dynamics used for identity verification)—that processing could independently trigger a risk assessment requirement. The regulations include a narrow exception for certain human resources functions such as payroll and benefits administration, but businesses should not assume that exception is broad enough to cover behavioral analytics or performance profiling. Also, remember that the CCPA excludes certain categories of personal information including protected health information covered under the Health Insurance Portability and Accountability Act (HIPAA) and medical information under the California Confidentiality of Medical Information Act (CMIA). Importantly, however, not all health and medical information is covered under these laws, and could be covered by the CCPA.

Other Federal and State Laws to Consider

The CCPA is not the only federal or state law to consider when deploying performance management and monitoring platforms. To fully address compliance, the business needs to take into account, among other things, the regulatory environment of the business, the data collected by the platform, and the features of the platform. By way of example, the platform could trigger laws regulating biometric data, the recording of conversations, and the safeguarding of health information.

What Should Businesses Do?

Businesses that have deployed—or are considering deploying—productivity management and monitoring platforms should begin with a thorough inventory of what data the platform collects, how that data is processed or analyzed, and what outputs or decisions flow from that processing. Where the platform involves systematic behavioral observation, AI-generated productivity profiles, or ADMT that contributes to employment decisions, a CCPA risk assessment should be considered.

For the procedural requirements of completing a risk assessment—including the required contents of the risk assessment report and the certification obligation to the CPPA—Part 2 of our risk assessment series provides relevant information.  

Key Takeaways

  • Analyzes whether recording customer service and sales calls triggers the CCPA’s new risk assessment requirements.
  • Identifies the specific CCPA triggers most relevant to call recording, particularly when AI analytics are applied to recordings.
  • Notes related obligations under state wiretapping laws and other state privacy frameworks.

Recording customer calls is among the most common data collection practices in business. Contact centers, healthcare providers, financial services firms, and countless other industries record customer interactions for quality assurance, training, compliance, and dispute resolution. The familiar “this call may be recorded for quality and training purposes” disclosure has become almost reflexive. But with the CCPA’s new risk assessment requirements now in effect, businesses subject to the CCPA should revisit this practice—particularly where call recordings are analyzed using AI or used in ways that go beyond simple storage and retrieval.

Our earlier posts on CCPA risk assessment basics discuss when the CCPA risk assessment requirement applies and the general requirements for conducting and reporting a risk assessment. This post focuses specifically on the call recording context.

How Businesses Use Customer Call Recordings

At its most basic level, call recording captures audio of a conversation between a customer service representative and a customer, stores that recording, and makes it available for later playback. Many businesses, however, now use AI-powered speech analytics tools to extract additional value from those recordings. These tools can transcribe calls, identify topics discussed, detect customer sentiment and emotion, flag compliance concerns, score agent performance, and generate profiles of individual customers based on their communication patterns, expressed preferences, or emotional responses across multiple interactions.

It is this AI-enhanced use of call recordings—rather than simple storage—that raises the most significant, but not the only CCPA risk assessment questions.

CCPA Risk Assessment Triggers for Call Recording Programs

Businesses should evaluate at least the following potential risk assessment triggers in connection with their call recording programs:

Sensitive Personal Information. Call recordings frequently capture sensitive personal information. Under the CCPA, sensitive personal information means personal information that reveals information about a consumer, such as: SSN, driver’s license number, passport number, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, genetic data, biometric information for the purpose of uniquely identifying a consumer, and information about a consumer’s sex life or sexual orientation. This is not an exhaustive list, but no doubt information that could be captured on a recorded line.

Customers who call healthcare providers, pharmacies, or health insurance companies for example, routinely disclose such information. But remember, the CCPA excludes certain categories of personal information including protected health information covered under the Health Insurance Portability and Accountability Act and medical information under the California Confidentiality of Medical Information Act. Importantly, not all health and medical information is covered under these laws, and could be covered by CCPA!

If a business uses voice biometrics—either to verify a caller’s identity or as part of a speaker analytics program that analyzes vocal patterns to identify individuals—it is processing biometric information, which is sensitive personal information under the CCPA. Even a speech analytics platform that generates a persistent voice profile of a customer may implicate this category. A risk assessment may be required for processing of that kind.

Systematic Observation. The CCPA risk assessment regulations require an assessment when businesses profile consumers through systematic observation. Automated processing of information obtained from call recordings could be used to infer or extrapolate a consumer’s intelligence, aptitude, performance at work, economic situation, behavior, location, etc. based upon systematic observation. When this occurs in connection with a consumer acting in their capacity as an educational program applicant, job applicant, student, employee, or independent contractor for the business, a risk assessment may be needed.

Automated Decision-Making. Where call recording analytics feed into automated systems that make significant decisions about consumers—such as creditworthiness determinations, insurance coverage decisions, or healthcare recommendations—the ADMT risk assessment trigger may be engaged.

State Wiretapping and Consent Laws

Separate from the CCPA risk assessment requirements, businesses recording customer calls must comply with state wiretapping and call recording consent laws. California’s Invasion of Privacy Act (CIPA) requires all-party consent for recording telephone calls. Several other states—including Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington—also require all-party consent. Businesses that record calls involving customers in those states without proper consent face significant litigation exposure. The wiretapping consent requirement and the CCPA risk assessment obligation are independent—satisfying one does not satisfy the other.

What Businesses Should Do

Businesses that record customer calls should document the full lifecycle of those recordings: what is captured, where it is stored, how long it is retained, who can access it, and whether any AI or analytics tools are applied to the recordings. Where recordings capture sensitive personal information or are analyzed by AI to generate profiles or inform significant decisions about customers, a CCPA risk assessment should be considered by businesses covered under the CCPA.

For the procedural requirements of completing a risk assessment—including the required contents of the risk assessment report and the certification obligation to the CPPA—Part 2 of our risk assessment series provides the relevant guidance.

The governor of Alabama recently signed House Bill 351, which establishes a consumer data privacy law for the state. The law takes effect May 1, 2027.

To whom does the law apply?

The law applies to controllers that conduct business in Alabama or produce products or services targeted to Alabama residents, if they either:

(1) control or process the personal data of more than 25,000 consumers, excluding data processed solely to complete a payment transaction, or

(2) derive more than 25 percent of gross revenue from the sale of personal data. 

The Act does not apply to various entities, including political subdivisions and certain public bodies, institutions of higher education, certain securities associations, certain financial institutions and GLBA-regulated data, HIPAA covered entities and business associates, certain small businesses with fewer than 500 employees that do not sell personal data, certain nonprofits with fewer than 100 employees that do not sell personal data, certain regulated entities under specified Alabama statutes, certain political organizations and data sellers serving them, and certain electric providers. 

Who is protected by the law?

The law protects “consumers,” defined as individuals who are residents of Alabama. It excludes individuals acting in a commercial or employment context.

The law also specifically allows a parent or legal guardian to exercise rights on behalf of a known child, and a guardian or conservator to exercise rights on behalf of a consumer. 

What data is protected by the law?

The law protects “personal data,” defined as information that is linked or reasonably linkable to an identified or identifiable individual. It excludes deidentified data and publicly available information. 

The defines “sensitive data” to include: data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about an individual’s sex life, sexual orientation, or citizenship or immigration status; genetic or biometric data processed for uniquely identifying an individual; personal data collected from a known child; and precise geolocation data. 

What are the rights of consumers?

Under the law, consumers may require a controller to do the following:

  • Confirm whether the controller, processor, or third party acting on the controller’s behalf is processing the consumer’s personal data and access that data;
  • Correct inaccuracies;
  • Delete personal data;
  • Provide a portable and, where technically feasible, readily usable copy of personal data previously provided by the consumer; and
  • Allow the consumer to opt out of processing for targeted advertising, sale of personal data, and profiling in furtherance of solely automated significant decisions. 

A controller must respond to a consumer request within 45 days, subject to a possible 45-day extension when reasonably necessary and must explain if it declines to act. 

Controllers must allow opt-out requests through a clear and conspicuous link on the controller’s website to a webpage that enables the consumer directly to opt out of targeted advertising or the sale of personal data, or to provide up-to-date contact information for submitting the opt-out request. 

What obligations do controllers have?

Controllers must:

  • Limit collection of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purposes;
  • Establish, implement, and maintain reasonable administrative, technical, and physical data security practices; and
  • Provide an effective mechanism for consumers to revoke consent that is at least as easy as the method used to provide consent. 

Controllers may not process personal data for purposes that are not reasonably necessary to or compatible with disclosed purposes, process sensitive data without consent (or, for known children, outside COPPA-compliant processing), process data in violation of discrimination laws, or process personal data for targeted advertising or sell personal data without consent where the controller has actual knowledge that the consumer is at least 13 and younger than 16. 

Controllers may not deny goods or services, charge different prices or rates, or provide a different level of quality because a consumer opted out, although the law allows certain loyalty and reward programs. 

Controllers must establish and describe in the privacy notice one or more secure and reliable means for consumers to submit requests to exercise their rights and may not require consumers to create a new account to do so, though they may require the use of an existing account. 

Controllers also have obligations regarding deidentified and pseudonymous data, including taking measures to ensure deidentified data cannot reasonably be associated with an individual, refraining from reidentifying deidentified data, contractually obligating recipients of deidentified data to comply with the statutory requirements, and exercising reasonable oversight over disclosures of pseudonymous or deidentified data.

How is the law enforced?

The Alabama Attorney General may enforce violations of the Act. 

Before initiating an action, the Attorney General must issue a notice of violation to the controller. If the controller fails to correct the violation within 45 days after receipt of the notice, the Attorney General may bring an action for an injunction.

If the court finds a violation and failure to cure, it may assess a civil penalty of up to $15,000 per violation. If the controller cures within the 45-day period and provides an express written statement that the violations have been corrected and will not recur, no action may be initiated. 

If you have questions about Alabama’s new privacy law or related issues, please reach out to a member of our Privacy, Data, and Cybersecurity practice group to discuss.