AI inferences outrun state privacy laws, experts warn
Collection rules miss the thing AI brokers increasingly sell: conclusions about people built from lawful scraps of data.
TL;DR
StateScoop reports that data-privacy experts on a recent panel warned state privacy laws often regulate what data brokers collect and sell, but not the conclusions those companies infer from it. Consumers and state privacy offices get the gap: a law can police the input while leaving the AI-generated profile largely outside the frame.
StateScoop’s report is narrow, but the problem is not. State privacy laws are mostly written around collection, sale, sharing and deletion of personal data. The panel’s warning is that AI-driven data brokers can turn regulated inputs into inferred attributes, risk scores or conclusions that may be more sensitive than the underlying data itself.
That matters for state privacy teams because the control point is shifting. If the law gives residents rights over data a broker collected, but not over what the broker concluded from that data, the practical privacy harm sits one layer above the statutory hook. The compliance form can look complete while the profile remains intact.
This is also where the state patchwork starts to show its seams. Legislatures can add delete mechanisms, broker registries and profiling assessments, and some are doing that. But inferencing is a moving target: it asks whether privacy law governs only the raw material, or also the derived judgment that actually gets used.
Published ·Deep Fathom