38 on file · 24 became law · 11 still moving · 1 moved in 30 days
United States (federal)A House bill in Congress, now in committee. Latest step: Referred to the House Committee on Energy and Commerce.
CaliforniaWould bar employers from using AI workplace surveillance tools to collect neural data or recognize workers' emotional states, with civil penalties of up to $500 per violation.
United States (federal)A Senate bill in Congress, now in committee. Latest step: Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
United States (federal)A Senate bill in Congress, now in committee. Latest step: Read twice and referred to the Committee on the Judiciary.
United States (federal)A House bill in Congress, now in committee. Latest step: Referred to the House Committee on Homeland Security.
United States (federal)A House bill in Congress, now in committee. Latest step: Referred to the Committee on the Judiciary, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
United States (federal)A House bill in Congress, now in committee. Latest step: Referred to the House Committee on Oversight and Government Reform.
JapanAmends Japan's personal information law to allow data sharing without consent for statistics and AI development, strengthen protections for children under 16 and facial feature data, and introduce administrative surcharges for serious violations.
New ZealandSets binding privacy rules under the Privacy Act 2020 for agencies that use biometric technologies such as facial recognition to verify, identify or categorise people.
European UnionSets EU-wide risk-based rules for AI systems, banning certain practices, imposing requirements on high-risk systems, transparency duties for some AI, and obligations for general-purpose AI model providers.
European UnionAmends the AI Act to delay high-risk obligations to 2 December 2027 and 2 August 2028, extend SME relief to small mid-caps, simplify AI literacy and registration duties, widen AI Office oversight, and ban AI nudification and CSAM generation.
European UnionDraft Commission guidelines under Article 6(5) of the AI Act with practical examples of AI systems that should or should not be classified as high-risk, published for consultation before formal adoption.
VermontEnacts a comprehensive consumer data privacy law giving Vermonters rights over their personal data and setting duties for controllers and processors, effective January 1, 2028.
ConnecticutCreates data broker registration rules and amends the Connecticut Data Privacy Act, including limits on the sale of precise geolocation data and provisions on facial recognition.
MinnesotaWould require consent before collecting biometric data, prohibit its sale, require deletion, and impose civil penalties.
MinnesotaWould prohibit state and local government entities from using facial surveillance systems or information obtained from them.
AlabamaWould have barred health and fitness apps from disclosing or using biological and neural data without express consent.
TexasBans developing or deploying AI systems for certain intentional harms such as behavioral manipulation toward self-harm, unlawful discrimination, government social scoring and sexual deepfakes of minors, requires state agencies to disclose AI use to consumers, and creates an AI regulatory sandbox and the Texas Artificial Intelligence Council, enforced by the attorney general.
United NationsA UNESCO standard-setting recommendation, mandated by the 42nd General Conference in November 2023, that gives Member States shared values, principles and concrete policy actions for the ethical development and use of neurotechnology.
MontanaAmends Montana privacy law to cover neurotechnology data alongside biometric and genetic data, requiring consent and limiting disclosure.
TexasBars covered facilities and companies from using genome sequencers or software produced by foreign adversaries and from storing Texans' genome sequencing data in foreign adversary countries, with civil penalties and a private right of action.
TexasAmended the Capture or Use of Biometric Identifier Act (Business and Commerce Code 503.001) to limit disclosure of commercially captured biometric identifiers and require their destruction within one year after the collection purpose expires; the act is enforced by the attorney general.
United NationsAsks the Human Rights Council Advisory Committee to draft recommended guidelines on applying the existing human rights framework to the design, development and use of neurotechnologies, for presentation at the Council's 64th session.
European UnionNon-binding Commission guidelines with legal explanations and practical examples of the AI practices banned under Article 5 of the AI Act, such as harmful manipulation, social scoring and real-time remote biometric identification.
United NationsCalls on States to respect and protect the right to privacy in the digital age, including in the context of surveillance, data collection and the design, use and governance of artificial intelligence.
CaliforniaAdds neural data, meaning information generated by measuring nervous system activity, to the CCPA definition of sensitive personal information.
IllinoisAmends BIPA so that repeated collection of the same person's biometric data by the same method counts as a single violation for damages, and allows electronic signatures for consent.
ColoradoExpands and renames the state task force to study artificial intelligence, automated decision systems and biometric technologies and report findings to the legislature.
ColoradoAmends the Colorado Privacy Act to require written policies, notice and consent before collecting biometric identifiers, with retention and deletion rules.
MarylandSets requirements, procedures and prohibitions for law enforcement use of facial recognition technology, including a training program and annual reporting.
ColoradoAdds biological and neural data to the sensitive data protected under the Colorado Privacy Act, the first state law to cover neural data.
United NationsHuman Rights Council resolution on protecting the right to privacy against surveillance, data collection and the use of artificial intelligence and other digital technologies.
United States (federal)A House bill in Congress, now in committee. Latest step: Referred to the Committee on the Judiciary, and in addition to the Committee on Oversight and Accountability, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
United States (federal)A Senate bill in Congress, now in committee. Latest step: Read twice and referred to the Committee on the Judiciary.
ChinaRegulates deep synthesis technologies such as face swapping and voice cloning, requiring providers to verify users, label synthetic content, obtain consent for editing biometric features and conduct security assessments.
United States (federal)A House bill in Congress, now in committee. Latest step: Referred to the Committee on the Judiciary, and in addition to the Committee on Oversight and Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
United States (federal)A Senate bill in Congress, now in committee. Latest step: Read twice and referred to the Committee on the Judiciary.
IllinoisRequires private entities to give notice and get written consent before collecting biometric identifiers, sets retention and destruction rules, and gives individuals a private right of action.
Legislationsby Glyph