California and Connecticut are expanding privacy guardrails in ways that directly touch AI: workplace monitoring that infers emotional state is getting new scrutiny, and data-broker, geolocation, genetic, and facial-recognition practices face tighter rules. Teams building or deploying models on personal data should treat this as a signal to harden data governance, vendor controls, and documentation around sensitive inferences.
Important Privacy Law and Policy Updates from the Past Month
National Law Review’s monthly “Privacy Filter” briefing highlights recent U.S. privacy developments with direct implications for AI and analytics programs. The update flags California restrictions aimed at AI-driven workplace surveillance—particularly monitoring that involves inferring an employee’s emotional state—as well as Connecticut rules that reach across data brokers and several high-risk data categories.
On the California side, the focus is on automated workplace surveillance that goes beyond traditional productivity monitoring into inference about how a person feels (e.g., emotional-state inference). In Connecticut, the briefing points to rules that cover data brokers and regulated use of geolocation data, genetic testing data, and facial recognition—areas that commonly show up in identity, fraud, risk scoring, and personalization pipelines.
- Sensitive inference is becoming a compliance surface. If your models or monitoring tools derive emotional state (or adjacent “affective” signals) from behavior, video, audio, or text, you may need tighter purpose limitation, notice/consent alignment, and internal review before deployment—especially in the workplace context.
- Data-broker and vendor risk increases. Connecticut’s attention to data brokers raises the bar on third-party data sourcing and downstream sharing. Data teams should re-check broker contracts, provenance documentation, and deletion/opt-out workflows that affect training and feature stores.
- Geolocation, genetics, and facial recognition require stronger controls. These data types can trigger heightened obligations; engineering teams should segment them in data catalogs, gate access, and ensure model evaluation avoids “silent” use through derived features.
- Operational impact: policy + engineering must move together. Expect more demands for DPIAs/PIAs, model documentation, and monitoring plans that describe what is inferred, how it’s used, and how individuals can exercise rights—before tools reach production.