AI & Privacy Newsletter Edition 12

IN THIS ISSUE

1. Chambers Spotlight Ranking, ABA Panel & Bloomberg Article

2. New State Data Privacy Laws (Indiana, Kentucky, Rhode Island)

3. California Privacy & AI: 2026 Compliance

4. Eightfold AI Lawsuit: A New Legal Strategy

5. Illinois AI Hiring Rule

Chambers Spotlight Ranking, ABA Panel & Bloomberg Law Article

• Chambers Spotlight Recognition: LK Law Firm has been ranked by Chambers Spotlight in New York, recognized as one of only two New York City firms for privacy and acknowledged as a “go-to law firm for major companies” navigating complex data privacy matters.
• Speaking Engagement: Lena Kempe has been invited to speak on the You Know How I Feel: Emotion AI and Surveillance Capitalism panel at the 2026 Privacy and Emerging Technology National Institute, organized by the American Bar Association. Join us on March 12–13 in Washington, DC. Register here
• Bloomberg Law Article: In her recent Bloomberg Law article, Lena Kempe discusses how courts are likely to shape the AI legal landscape in 2026 despite President Trump’s executive order seeking to preempt state AI laws. Read the full article

New State Data Privacy Laws

Three new state privacy laws took effect in 2026: Indiana, Kentucky, and Rhode Island. Here’s what businesses need to know:

Indiana & Kentucky

Both the Indiana Consumer Data Protection Act (ICDPA) and Kentucky Consumer Data Protection Act (KCDPA) apply to entities that either:

• Control or process personal data of 100,000 or more residents, OR
• Controls or processes personal data of at least 25,000 residents and derives over fifty percent (50%) of gross revenue from the “sale” of any personal data.

Key requirements include:

• Data protection impact assessments
• Consumer opt-out mechanisms
• Opt-in consent for processing sensitive data
• Processing standards for deidentified data
• 30-day cure provision before facing penalties

Rhode Island

The Rhode Island Data Transparency and Privacy Protection Act (RIDPA) sets a lower threshold and applies to for-profit entities conducting business in Rhode Island or targeting Rhode Island consumers that during the preceding calendar year did any of the following:

• Controlled or processed personal data of 35,000 or more Rhode Island customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction., OR
• Controlled or process personal data of 10,000 or more Rhode Island customers and derived more than 20% of gross revenue from the sale of personal data.

⚠️ Important Note: Rhode Island provides NO cure period. Several states are sunsetting the 30-day cure window. In this environment, proactive compliance is increasingly the default expectation.

California Privacy & AI: 2026 Compliance

The CPPA’s new rules and the impact of AB 2013 are creating a multi-phase compliance tidal wave.

Wave 1: Effective January 1, 2026 – New Requirements Now in Force

• Developers of GenAI systems released on or after January 1, 2022, and made available to Californians (whether for free or for a fee) are required to disclose a “high-level summary” of the datasets used to develop their GenAI systems (including sources and IP status).
• CCPA Amendments include new standards for privacy notices, fulfilling rights requests, and contract terms.
• Risk Assessments are now required for all processing activities that pose a “significant risk” to consumers.
• DELETE Act- the DROP platform is now open for consumers to register their one-stop data deletion requests.

Wave 2: Data Deletion & ADMT

• August 1, 2026: Data brokers must be integrated and checking the DROP platform every 45 days to process deletion requests
• January 1, 2027: Full ADMT compliance kicks in, requiring pre-use notices and consumer opt-outs for significant decisions (e.g. finance, housing, employment, healthcare—but not targeted advertising)

Future Focus (2028-2030)

• Cyber Audits: Phased requirements for mandatory cybersecurity audits, structured by annual revenue

Eightfold AI Lawsuit: A New Legal Strategy

On January 20, 2026, a significant class-action lawsuit was filed against Eightfold AI, a major HR technology provider used by Fortune 500 companies like Microsoft and PayPal. The lawsuit marks a shift in legal strategy, moving away from common claims of “AI bias” and instead focusing on consumer protection law.

The lawsuit, filed in California by two job seekers, claims that Eightfold’s AI compiles “dossiers” on applicants using data pulled from across the internet (social media, location data, and device activity) to assign a “match score” from 0 to 5. The plaintiffs argue that these AI-generated scores and profiles are functionally equivalent to consumer credit reports. Therefore, Eightfold should be regulated as a “Consumer Reporting Agency” under the Fair Credit Reporting Act (FCRA) and California’s ICRAA. Applicants claim they are never notified that these reports exist, are not allowed to see them, and have no way to dispute or correct inaccurate information that may be leading to automated rejections.

Key Insight: Unlike other lawsuits that focus on whether an AI is discriminatory, this case focuses on transparency. It argues that applicants have a legal right to know what data is being used to judge them and how they are being ranked. If the court agrees that AI matching scores are “consumer reports,” it would force AI vendors nationwide to provide the same disclosures and dispute mechanisms as credit card companies or background check firms.

Illinois AI Hiring Rule

Effective January 1, 2026, Illinois joins a small but growing group of states that directly regulate the use of AI in employment decisions.

New amendments to the Illinois Human Rights Act (IHRA) specifically target AI-driven discrimination in the workplace:

• Employers cannot use AI to discriminate against employees based on protected classes. This includes “generative AI” and systems used for hiring, promotions, discipline, and discharge
• Zip codes cannot be used as a workaround (proxy) to identify and discriminate against protected classes
• Companies must inform employees that AI is being used for specified purposes

I have discussed the AI legal landscape in the employment context in my ABA article, Navigating the AI Employment Bias Maze: Legal Compliance Guidelines and Strategies

Need assistance with AI or privacy matters?

Learn more about our services at https://lklawfirm.net/services/

Contact us at https://lklawfirm.net/contact/