|
. . .
BATON ROUGE. LOUISIANA'S PRIVACY BILL CROSSED BOTH CHAMBERS UNANIMOUSLY. IT IS ON THE GOVERNOR'S DESK. The Louisiana Senate concurred with House amendments to Senate Bill 386 by a vote of thirty-four to zero. The House had already passed the bill unanimously. The Louisiana Data Privacy Act is now on Governor Jeff Landry's desk.
Lawmakers sent SB 386 to the governor on May 21, 2026. Landry has ten days to sign or veto. If he does neither, the bill becomes law on its own.
Today is May 28. The clock runs out around May 31.
The statute takes effect January 1, 2027 once enacted. Louisiana becomes the twenty-second US state with a comprehensive consumer privacy law.
. . .
The bill reaches businesses by three thresholds. Twenty-five million dollars in annual gross revenue. Or seventy-five thousand consumers, households, or devices processed in the state. Or fifty percent of annual revenue earned from the sale of personal data.
A controller that clears any one of those bars is in scope.
. . .
Enforcement runs through the Louisiana Attorney General. There is no private right of action. Violations count as unfair and deceptive trade practices under Louisiana's Unfair Trade Practices and Consumer Protection Law.
That hook matters. It opens the door to civil penalties, attorney fees, and costs. A willful violation exposes a defendant to treble damages.
. . .
The vote pattern is the headline inside the headline. Two chambers. Zero opposition votes. A Republican governor with the pen.
Louisiana also moved on a parallel track this session. House Bill 977 has already been signed. It repeals and replaces the state's app store and children's privacy law in one stroke.
The legislature did not wait for Congress. It wrote its own rulebook and moved it through both chambers without a dissent.
|
For Counsel: Map SB 386's thresholds against current data flows now. The January 1, 2027 effective date is short runway for a UDAP-coupled regime. Treble damages on willful conduct change the settlement calculus on any enforcement letter. Watch the AG's office for early guidance and any rulemaking signal. Reconcile SB 386 obligations against HB 977's app store provisions before splitting compliance workstreams.
For Builders: Inventory consumer counts, device counts, and household counts against the seventy-five thousand threshold. Revenue mix matters too. If half of annual revenue traces to data sales, the dollar threshold is irrelevant. Build the data subject rights pipeline now. The deletion, access, and opt-out workflows are not weekend projects, and 2027 arrives fast.
For Legislators: A thirty-four to zero Senate vote and a unanimous House passage in a Republican-led state is a signal. Comprehensive privacy is no longer a blue-state file. The UDAP enforcement model in SB 386 is exportable. Other states can copy it without standing up a new privacy agency. Federal preemption did not arrive. The states moved anyway.
Source: Privacy Daily, Louisiana Legislature unanimously passes comprehensive privacy bill, https://privacy-daily.com/article/2026/05/20/louisiana-legislature-unanimously-passes-comprehensive-privacy-bill-2605200075
|
. . .
BATON ROUGE. THE LOUISIANA SENATE SENT THE AI-TRANSCRIPTION DISCLOSURE BILL BACK TO THE HOUSE. The Louisiana Senate passed an amended House Bill 475 in May and returned it to the House for concurrence. The bill requires a verbal disclosure before an AI scribe records a clinical visit. The House passed the original 97 to 0 on April 14.
House Bill 475 names a specific moment. The clinician must speak. Before the microphone turns on, the client must hear that artificial intelligence will generate the transcription of the visit.
Written notice in an intake stack does not satisfy the bill. Neither does a poster on the wall. The disclosure is verbal, at the bedside, on the record.
The House cleared the original text unanimously on April 14, 2026. Ninety-seven yeas. Zero nays.
. . .
The Senate took the bill in May and amended it. The amended version cleared the chamber the week of May 19. The Senate then returned the text to the House for concurrence on the amendments.
Today is Thursday, May 28, 2026. The House is considering the Senate version now.
. . .
The timing tracks the product curve. The Veterans Health Administration launched ambient AI scribe in October 2025. The VA is rolling the technology out to every VA medical center across 2026.
Private health systems are moving faster. Ambient scribe vendors have signed enterprise contracts across primary care, behavioral health, and emergency medicine. The microphone is arriving in the exam room before the consent rule.
Louisiana legislators wrote the consent rule first.
|
For Counsel: HB 475 sets a verbal-disclosure floor that intake-form language will not satisfy. Audit your ambient-scribe deployment scripts for a spoken consent step, captured contemporaneously. Confirm the script identifies the recording as AI-generated, not human-typed. The bill targets the moment of capture, not the downstream record. A signed BAA does not cure a missing verbal notice.
For Builders: Build the verbal-disclosure prompt into the device UX, not the EHR intake. Surface a clinician-facing cue that fires before the first audio frame is captured. Log the spoken-consent timestamp as a discrete field, separate from form acknowledgment. Vendors who ship a Louisiana-mode toggle this quarter will be the reference architecture for the next twelve states.
For Legislators: Louisiana wrote the bedside rule the ambient-scribe market has been waiting for. The 97 to 0 House vote tells you the politics. The Senate amendments are the negotiation, not the fight. If your state is drafting an ambient-AI bill, the Louisiana text is the floor, not the ceiling. Verbal, before recording, by the clinician.
Source: Troutman Pepper Locke privacy and AI law update, May 25, 2026, https://www.troutmanprivacy.com/2026/05/proposed-state-privacy-and-ai-law-update-may-25-2026/
|
. . .
DOVER. DELAWARE CUT THE PRIVACY THRESHOLD TO FIFTEEN THOUSAND AND PULLED SENSITIVE DATA BEHIND A CONSENT GATE. On May 21, 2026, the Delaware House passed two privacy bills sponsored by Representative Krista Griffith. House Bill 380 cuts the applicability threshold of the state's Personal Data Privacy Act. House Bill 381 puts sensitive data behind opt-in consent.
The old threshold was 35,000 consumers. HB 380 drops it to 15,000. That number is not arbitrary.
On a population-percentage basis, the new Delaware floor sits close to the thresholds in Connecticut and New Jersey. Representative Griffith aligned Delaware with the tighter end of the New England and Mid-Atlantic privacy cohort.
. . .
HB 381 does separate work. It requires opt-in consent before any sale of sensitive personal data. The default flips. Silence is no longer permission.
. . .
The Delaware Personal Data Privacy Act took effect January 1, 2025. It is sixteen months old. The Delaware House is already tightening it.
Representative Griffith developed both bills in partnership with the Delaware Department of Justice. The Department of Justice signed on as a development partner, not a late commenter. That posture matters for enforcement readiness.
. . .
Both bills now head to the Delaware Senate for consideration. The Senate calendar will decide whether the consent gate and the lower threshold reach the Governor this session.
. . .
The pattern across this week's dispatches is two-sided. States without a privacy law are passing one. States with a privacy law are tightening it. Delaware sits in the second group and moved on the same day Louisiana moved in the first.
|
For Counsel: The HB 380 threshold cut pulls a new tier of mid-size controllers into scope. Re-run your client's Delaware consumer count against 15,000, not 35,000. HB 381 converts sensitive-data sale from opt-out to opt-in. Audit consent-capture flows before Senate passage, not after.
For Builders: If your product touches Delaware residents and handles mental health, biometric, or precise-geolocation data, the sale-of-sensitive-data path now needs an affirmative consent record. Build the consent log before you build the sale pipeline. The Delaware Department of Justice co-developed the bills. Treat enforcement intent as real.
For Legislators: Delaware shows the second move in a two-step pattern. Pass the baseline law. Then cut the threshold and gate the sensitive categories. Connecticut and New Jersey set the population-percentage benchmark Delaware just matched. The cohort is forming.
Source: Delaware House Democrats press release on passage of the Griffith privacy bills, https://housedems.delaware.gov/2026/05/21/house-passes-griffith-bills-to-improve-data-privacy-for-delawareans/
|
. . .
ALBANY. NEW YORK MOVED A BILL THAT NAMES THE TOY. Assemblymember Steven Otis carried New York Assembly Bill A11144. Senator Kristen Gonzalez introduced the Senate companion S9408 with Attorney General Letitia James. The bills name the product. Chatbot toys.
The Assembly bill cleared the New York Internet and Technology committee in May 2026. The committee returned a favorable report. The bill moved.
A11144 and S9408 prohibit the manufacture, distribution, and sale of chatbot toys in New York. The bills define a chatbot toy as a children's toy with an AI-companion chatbot embedded in or integrated with it. The bills define a child as a natural person under the age of thirteen.
Senator Andrew Gounardes pushed the moratorium concept in public. Gounardes told City and State New York that the toys belong off the shelf until the state understands what they do to children. Route Fifty carried the same call.
. . .
The bill text walks through how the products operate. Passive voice recording. Internal data use for model training. External data sharing with third parties. The drafters put the data pipeline on the page.
The bills then direct an interagency study. The study examines the risks and benefits of chatbot toys for child users. The state legislates the moratorium and orders the evidence at the same time.
. . .
Senator Gonzalez framed the Senate companion as a partnership with the Attorney General. Letitia James signed on. The press release named the harm and named the product class.
A children's toy. With a chatbot inside. Sold to a household with a child under thirteen.
That is the object the bill describes. That is the object the bill prohibits.
|
For Counsel: The bills create a per-unit prohibition on manufacture, distribution, and sale. The defined term is the product, not the use case. Counsel for toy manufacturers and platform licensors should map current SKUs against the chatbot toy definition. The interagency study creates a record the plaintiffs' bar will read.
For Builders: The bill text names passive voice recording, model-training use, and third-party data sharing as the operative facts. Those are the three pipes a builder ships by default. A New York ban on the product class means the compliance question is not consent flow. It is product category.
For Legislators: New York moved a bill that defines the product and prohibits the product. The age line is thirteen. The companion bill carries the Attorney General's name. Legislators in other states now have a drafted definition, a drafted prohibition, and a drafted study mandate to lift.
Source: New York State Senate press release on S9408, Senator Kristen Gonzalez, https://www.nysenate.gov/newsroom/press-releases/2026/kristen-gonzalez/state-senator-kristen-gonzalez-introduces-bill
|
. . .
SACRAMENTO. WHILE THE SENATE VOTE ON SB 903 DREW THE HEADLINES, SEVEN MORE CALIFORNIA BILLS CROSSED. The California Senate passed SB 903 thirty-nine to zero last week. National outlets ran the story. Seven other California AI bills cleared a chamber in the same window and drew no national coverage.
SB 903 governs mental health professionals' use of AI. AB 1988, the Assembly chatbot-notice bill, cleared in the same stretch. Those two got the headlines.
The other seven did not.
SB 1119 is the Senate-side parallel to AB 1988. Consumer AI notice. It passed the Senate.
AB 1979 covers health care services that incorporate AI technology. It passed the Assembly. That is two clinical-AI bills moving in parallel, in opposite chambers, in the same week.
. . .
Senator Lena Gonzalez carries SB 1146. The bill targets synthetic performers used in health advertising. It requires clear and conspicuous disclosure when an advertisement uses AI-generated or substantially altered audio, video, or images of digital replicas or synthetic performers depicted as health-care providers.
Senate Judiciary passed it April 6. The bill was amended April 14. The full Senate passed it in May.
Fake doctors. Real ad spend. Disclosure required.
. . .
SB 1000 and AB 2713 both amend California's AI Transparency Act disclosure requirements. One cleared the Senate. The other cleared the Assembly. Same statute, two chambers, one week.
SB 947 covers employment automated decision systems. Transparency. Accountability. It passed the Senate.
SB 1106 amends California's data broker law. Response timeframe drops from forty-five days to thirty days. It passed the Senate.
. . .
Count the surfaces. Clinical AI in two bills. Consumer AI notice in two bills. Synthetic performers in advertising. Employment ADM. AI Transparency Act amendments in two bills. Data broker timelines.
Nine California bills crossed chambers in the stretch. Two got the press. Seven did not.
The architecture is the same in every one. Disclosure. Notice. Timelines. Named actors held to named obligations.
|
For Counsel: Treat the seven as a single compliance surface, not seven separate items. SB 1146 stacks on existing advertising disclosure law. SB 1000 and AB 2713 will reconcile into one Transparency Act amendment package before session end. SB 1106 shortens the data broker response window by one-third. Calendar the thirty-day clock now.
For Builders: If your product touches health advertising, SB 1146 reaches synthetic performers depicted as providers. If your product makes employment decisions, SB 947 reaches the model. If your product is a chatbot in California, SB 1119 and AB 1988 reach the notice layer. Build the disclosure surface once. Wire it to every product line.
For Legislators: California is moving nine AI bills through chambers in a single week. The press covered two. The other seven layer the same architecture into adjacent surfaces. If your state is drafting on AI in health, advertising, employment, or data brokers, the California package is the working template. Pull SB 1146 first. Fake-doctor ads are a clean fact pattern.
Source: Troutman Pepper Locke proposed state privacy and AI law update, May 25, 2026, https://www.troutmanprivacy.com/2026/05/proposed-state-privacy-and-ai-law-update-may-25-2026/
|
. . .
SEATTLE. THE HOSPITAL WHERE THE AI TRANSLATOR HAS TO GET A HUMAN SIGN-OFF. At Seattle Children's Hospital, an AI translation system drafts discharge instructions in four languages. A human medical translator then reads every draft before it reaches the family.
Doctor K. Casey Lion leads the project. Her team built a hybrid pipeline for clinical communication. The AI generates the first translation. A credentialed human translator verifies the wording before it leaves the hospital.
The four languages were picked by family demand. Spanish. Somali. Vietnamese. Simplified Chinese.
The problem the team is solving is documented. The human-only translation pipeline for discharge instructions can take days. Families often go home with English-only paperwork while the verified translation is still being prepared.
That gap has consequences. Discharge instructions delivered in a language the family cannot read raise the risk of medication errors. They raise the risk of preventable re-admission.
. . .
The hybrid pipeline cuts the delay. The human gate stays in place.
Doctor Lion's team is talking with parent task forces about how to deploy the tool. Some families want the fastest possible translation, imperfect or not. Other families want to wait for a fully human-verified version. The hospital is gathering that input before it locks the rollout.
. . .
The architecture is the point. Every AI draft goes through a human reviewer. The AI saves time. The translator keeps the safety floor. Seattle Children's chose that design on purpose.
|
For Counsel: A human-in-the-loop translation pipeline preserves a clear locus of professional responsibility. The credentialed translator signs off. The hospital can point to a named reviewer when a translation is challenged. That is a defensible record. Compare it to a fully automated pipeline with no reviewer in the chain.
For Builders: Note the design choice. The AI is positioned as a drafter, not a decider. The human gate is non-optional. The speed gain comes from cutting reviewer time, not from cutting the reviewer. Build the gate first. Tune the speed after.
For Legislators: This is the supervised model in operating form. A regulated clinical setting. A named lead investigator. A documented equity gap as the motivating harm. Family input gathered before deployment. When you write rules for AI in health communication, this is the architecture the rules should make easy to build.
Source: Peer-reviewed report on the Seattle Children's hybrid AI translation project led by Doctor K. Casey Lion, https://pmc.ncbi.nlm.nih.gov/articles/PMC10873784/
|
. . .
THE ONE CONFIGURATION. Five surfaces. Same architecture in each.
Comprehensive privacy with thresholds and opt-outs. Louisiana writes it for the first time. Delaware tightens its own. The thirty-five-thousand line moves to fifteen thousand. The line keeps moving down.
. . .
Bedside consent at the moment of data capture. Louisiana HB 475 says the disclosure must be spoken to the client by the clinician. A poster on the wall does not satisfy the bill. An intake form does not satisfy the bill. The microphone does not turn on until the words are said out loud.
. . .
Age-gate plus device-class scope on the surfaces children touch. New York names the chatbot toy. The Assembly bill prohibits the manufacture and sale of the product class, not just its bad use. The age line is thirteen.
. . .
Disclosure obligations on parallel actors. California SB 1146 reaches the synthetic performer who plays a doctor in an advertisement. SB 947 reaches the employment automated decision system that decides who gets hired. AB 2713 and SB 1000 amend the AI Transparency Act for parallel disclosure layers. The architecture covers more than the chatbot.
. . .
Supervised AI deployment in the clinical setting. Seattle Children's Hospital wires the AI translator behind a credentialed human reviewer. The AI drafts. The human signs. The hospital chose that design before the law required it.
. . .
The five-piece pattern is not a coincidence. It is what careful drafters in five different state capitols converge on when they read the harm record and read each other's bills. The pattern names what is at stake and names what to require.
Washington could ship the pattern as a federal floor. Washington has not.
The states are doing the work.
| 
