Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
These developments signal a growing trend: states are stepping up with ambitious, enforceable rules focused on transparency, risk management, and protecting vulnerable users — especially children.
Illinois: The Strictest Frontier AI Transparency Law Yet?
Illinois is poised to enact one of the most comprehensive AI transparency bills in the country with Senate Bill 315. The legislation, which passed both chambers and was signed by Governor JB Pritzker on July 6, 2026, introduces rigorous requirements for high-risk “frontier” AI models.
Key Provisions of SB 315:
- Annual third-party audits
- Mandatory governance and risk mitigation programs
- Cybersecurity requirements
- Pre-deployment reports detailing model capabilities, intended uses, and risk disclosures
The bill defines “catastrophic risk” as models capable of causing mass harm or damages exceeding $1 billion. State Rep. Daniel Didech emphasized the need for guardrails while acknowledging the preference for a federal solution. The law was signed on July 6, 2026, and takes effect on January 1, 2027.
Notably, major AI developers including OpenAI and Anthropic have publicly supported the measure, calling it a “new standard” for responsible AI development.
Connecticut: Strengthening Data Broker Rules and Broad AI Oversight
Governor Ned Lamont recently signed two significant bills that expand Connecticut’s already progressive privacy and AI framework.
Senate Bill 4 – Data Broker Accountability
Public Act 26-64 (Senate Bill 4) creates a data broker registration framework that took effect October 1, 2026, but data brokers may not sell or license brokered personal data in Connecticut without being registered beginning January 1, 2027. Restrictions on the sale of precise geolocation data and new facial-recognition protections are among the October 1, 2026 amendments. The Department of Consumer Protection must establish the accessible deletion mechanism by July 1, 2028, and registered brokers must begin accessing it every 45 days on October 1, 2028.
Senate Bill 5 – Comprehensive AI Regulation
After years of negotiation, SB 5 establishes requirements for frontier AI models, automated decision-making tools (ADMT), and AI companions. It includes whistleblower-style reporting mechanisms for employees, anti-discrimination safeguards, and restrictions on minors’ access to AI companions under age 18.
The bill also creates an innovation-friendly regulatory sandbox set to launch by January 2028, balancing protection with economic growth.
New York: Protecting Children with the Safe By Design Act
Governor Kathy Hochul signed the Safe By Design Act as part of New York’s FY 2027 budget. The law takes effect on January 1, 2027. When it becomes operative, it will require covered social media, gaming, and messaging platforms to apply strong default protections:
- Restrictions on adult-minor interactions
- Geolocation data protections
- Parental consent requirements for users under 13
- Default safety settings for minors under 17
- AI companions turned off by default for minors
The move comes as New York Attorney General Letitia James and 43 other state AGs oppose the federal KIDS Act, arguing it could undermine stronger state-level protections.
What This Means for Businesses and the Future of AI Governance
These three bills reflect a maturing state-level approach to AI regulation — one that emphasizes transparency, accountability, and child safety without completely stifling innovation. Companies operating nationally should prepare for a patchwork of requirements that may soon become the de facto standard across the U.S.
Key Takeaways:
- Third-party audits and risk reporting are becoming mainstream expectations
- States are prioritizing child protection in both data privacy and AI design
- Collaboration between industry and lawmakers (as seen in Illinois and Connecticut) can lead to more balanced outcomes
As AI capabilities continue to advance, expect more states to follow suit in 2027 and beyond. Organizations that proactively build strong governance, transparency, and risk management frameworks will be best positioned to thrive in this new regulatory landscape.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
