Congress has spent years debating a national privacy law and has little to show for it. States have stopped waiting. In March alone, Oklahoma, Colorado and California each took significant steps to regulate how companies collect data, use artificial intelligence and enforce privacy rights. Together, the three moves signal the growing reality that the rules governing data and AI in America are being written at the state level, one legislature at a time.
Legal and regulatory analysts at Roth Jackson, a Washington-based firm that advises companies on privacy and advertising law, broke down what each development means for businesses that rely on consumer data.
Oklahoma crossed a notable threshold first. The state’s governor signed Senate Bill 546 into law on March 20, making Oklahoma the 20th state to pass a comprehensive privacy law. The law covers companies that handle the personal data of at least 100,000 consumers, or 25,000 consumers if data sales make up at least half of the company’s revenue. Oklahomans will now have the right to access, correct and delete their data, and to opt out of targeted advertising. Roth Jackson notes the law leans toward business-friendly compliance, similar to Virginia’s and Tennessee’s frameworks, which should ease the transition for companies already operating under those laws.
Colorado’s move is more ambitious. The state passed the country’s first comprehensive AI governance law back in 2024, but its governor had reservations from the start. In March, Governor Jared Polis circulated a draft overhaul that would require companies to notify consumers when automated systems are influencing major decisions in their lives, such as loan approvals or employment outcomes. If a decision goes against a consumer, they would have the right to see the reasoning behind it, correct any errors and request a human review.
That last piece carries real weight for the advertising industry. AI now sits inside nearly every layer of digital marketing, from the algorithms that run programmatic ad auctions to the systems that personalize content for individual users. Under Colorado’s proposed framework, brands and agencies that deploy these tools could face new disclosure and audit requirements, even when the underlying AI was built by a third-party vendor.
Related: Colorado Eying Possible Do-Over of Landmark AI Law
As Roth Jackson put it: “Colorado’s revised AI Act is the most ambitious state-level AI governance framework in the country.”
California’s contribution may have the most immediate bite. Assemblywoman Pilar Schiavo introduced legislation that would create a whistleblower program tied to the California Consumer Privacy Act. Under the proposal, employees and other insiders who report data privacy violations would receive financial awards and legal protection against retaliation. The approach mirrors similar programs in financial fraud enforcement, and the backers point to past examples where insiders exposed misconduct that regulators could not see on their own.
For companies that handle consumer data, the implications are direct. Privacy compliance shifts from an external legal risk to an internal one. Roth Jackson advises companies to audit their opt-out systems, close any gaps between what their privacy policies say and what their systems actually do, and invest in training that makes compliance part of company culture.
What comes next? All three developments are moving in real time. Colorado’s revised AI law is still a draft, and lobbying from the ad industry is already underway. President Trump issued an executive order in March directing Congress to develop a national AI standard that would override state laws, though no such legislation has advanced. For now, businesses are navigating a patchwork of state rules with no federal floor in sight, and more states are watching Colorado’s framework closely for their own next steps.
The exchange for the debt economy
