Attorneys General in Oregon and Connecticut issued guidance over the holiday interpreting their authority under their state comprehensive privacy statutes and related authorities.  Specifically, the Oregon Attorney General’s guidance focuses on laws relevant for artificial intelligence (“AI”), and the Connecticut Attorney General’s guidance focuses on opt-out preference signals that go into effect on January 1, 2025 in the state.

Oregon Guidance on AI Systems

On December 24, Oregon Attorney General Ellen Rosenblum issued guidance, “What you should know about how Oregon’s laws may affect your company’s use of Artificial Intelligence,” which underscores that the state’s Unlawful Trade Practices Act (“Oregon UTPA”), Consumer Privacy Act (“OCPA”), Equality Act, and other legal authorities apply to AI.  After noting the opportunities for Oregon’s economy – from streamlining tasks to delivering personalized services – the guidance states that AI can involve concerns around privacy, discrimination, and accountability. 

In particular, the guidance discusses how the Oregon UTPA and OCPA apply to the development and use of AI.  First, and with respect to the Oregon UTPA, Attorney General Rosenblum states that the “marketing, sale, or use” of AI systems are not exempt from the Oregon UTPA.  The guidance then provides several examples of activities related to AI systems that could implicate the Oregon UTPA, including, for example, that a business could violate the Oregon UTPA if it fails to disclose a material defect or material nonconformity in an AI product.  As another example, the guidance states that a business could violate the Oregon UTPA if it misrepresents the characteristics, uses, benefits, or qualities of AI system.

Additionally, the guidance also remarks on the intersection between the development and use of AI systems and the OCPA, and Attorney General Rosenblum remarks on two notable topics:

• Disclosures of Personal Data for Model Training:  Attorney General Rosenblum states that developers that use personal data to train AI systems “must clearly disclose this in an accessible and clear privacy notice.”  Additionally, the guidance states that suppliers and developers cannot retroactively or passively alter privacy notices and must obtain affirmative consent for any new or secondary uses of that data.
• Sensitive Data for Training:  The guidance also states that the use of sensitive data to develop or train AI models requires consent.
• DPIAs:  Additionally, the guidance states that “feeding consumer data into AI models and processing it in connection with these models” presents “heightened risks to consumers” that require a data protection assessment.

Connecticut Guidance on OOPS Signals On December 30, Connecticut Attorney General William Tong issued a press release that the requirement to honor global opt out preference signals (“OOPS”) sent by consumers enters into effect January 1, 2025.  Under the Connecticut privacy statute, covered entities must honor signals that communicate a consumer’s request to opt-out of the sale of their personal data or targeted advertising.