Connecticut, Iowa Advance New Privacy and AI Laws; Colorado Eyes Rule Changes
Connecticut, Iowa, and Colorado move forward with privacy and AI regulation updates in May 2026.
Why it matters: Evolving state laws on privacy and AI bring fresh compliance obligations for legal teams advising businesses, especially those handling data or deploying AI solutions. Staying current helps organizations prepare for new enforcement regimes and potential client risks.
- Connecticut passed Senate Bill 4, creating a data broker registration system with annual fees and consumer deletion rights.
- Iowa’s new law mandates chatbot disclosure to minors and imposes steep fines for violations, focusing on mental health interactions.
- Colorado is considering a repeal and replacement of its privacy pricing bill, though amendments are not yet finalized.
States continue to accelerate reforms around data privacy and artificial intelligence oversight. On May 4, 2026, Connecticut’s House passed Senate Bill 4 by a wide margin, sending it to the governor for signature. The bill establishes the state’s first data broker registration, requiring businesses dealing in personal data to register with the Department of Consumer Protection by October 1, 2026. Data brokers must pay a $600 annual registration fee and provide consumers an accessible way to request deletion of their information. State Senator James Maroney said, “We want to give people the ability, if they choose, to delete their information from data brokers so it cannot be used.”
Meanwhile, Iowa’s legislature unanimously approved a measure on April 15, 2026, to regulate chatbot interactions with minors. The law requires bots to disclose non-human status at the start of every chat and every three hours thereafter. If a chatbot discusses mental health with a minor, it must refer them to a suicide hotline. Fines are stiff—$1,000 per violation, up to $500,000 for repeated breaches. Rep. Austin Harris underscored the urgency: “AI chatbots...are encouraging kids to commit suicide or do harmful things...we’re bringing this bill forward to be able to start a discussion.”
- Connecticut’s new regime builds on the 2023 Data Privacy Act, introducing more audit trails and consumer control.
- Iowa’s law is viewed as a potential model for other jurisdictions aiming to limit AI risks for youth.
Colorado, for its part, is debating whether to repeal and replace its pricing bill on privacy, with legislative details pending (details).
By the numbers:
- $600 — Annual registration fee for Connecticut data brokers
- October 1, 2026 — Deadline for Connecticut broker registration
- $1,000 — Iowa fine per chatbot law violation
- $500,000 — Maximum total fine for multiple chatbot violations in Iowa
Yes, but: Specifics of Colorado's proposed bill changes are still unclear and may shift in legislative negotiations.
What's next: Connecticut’s S.B. 4 awaits the governor’s signature; Colorado’s pricing bill revision may move forward within this legislative session.