• Insured
  • Counsel-reviewed
  • De-identified
Call +1 656 800 9088Partner portal
Call+1 656 800 9088Partner portal

Which US state privacy laws matter when a company licenses its records to AI developers?

Short answer. The comprehensive state privacy laws, led by California, Virginia, Colorado and Texas, matter when the licensed records contain personal information about residents, because handing that information over for value can be a sale. Each law also defines de-identified data and treats it more lightly when the company takes reasonable measures, commits publicly not to re-identify it, and binds recipients by contract. Licensing de-identified operating records under those three conditions is the common route.

General information, not legal advice.

Contact usWhat's my data worth?

When a license can be a sale

California's Consumer Privacy Act defines a sale broadly: making personal information available to another business for money or other valuable consideration. Most other state laws follow a similar idea, though some are narrower and cover only exchanges for money. A license of records that still identify customers or staff, in return for payment, can fall inside those definitions.

If it does, the law brings duties with it: notice to the people involved, a right for them to opt out of the sale, and in some states stricter rules or consent for sensitive information such as health or precise location. Those duties are hard to meet for records gathered years ago, which is why most company data licensing works on de-identified records instead.

The shared test for de-identified data

California, Virginia, Colorado and Texas use closely related definitions. Data counts as de-identified when it cannot reasonably be linked to an identified or identifiable person and the business holding it does three things: takes reasonable technical and organizational measures so it cannot be linked again, publicly commits to keep and use it only in de-identified form and not to try to re-identify it, and requires by contract that anyone receiving it meets the same commitments.

Each of the three conditions shows up in a real license. The measures are the de-identification work and its review. The public commitment usually sits in the privacy notice. The contract term is a clause in the license that forbids the AI developer from re-identifying anyone and requires it to pass the same promise on. Our blog post on how Virginia, Colorado and Texas define de-identified data walks through the wording of each statute.

Pseudonymous data is not the same

Several state laws also define pseudonymous data: data that cannot be tied to a person without extra information kept separately, such as a key that maps codes back to names. Pseudonymous data gets some relief from consumer rights in these laws, but it is still personal information. Replacing names with codes while keeping the key does not, on its own, make records de-identified.

Sector laws sit beside the state laws. Health records held by a covered provider follow HIPAA, which has its own de-identification methods. Financial institutions follow the Gramm-Leach-Bliley Act, and several state laws exempt data already covered by it. Biometric laws, such as the Illinois statute on voiceprints and face geometry, add separate limits.

Could licensing make you a data broker?

California's Delete Act and similar laws in a few other states require data brokers to register. California defines a data broker as a business that knowingly collects and sells personal information about consumers with whom it has no direct relationship. A company licensing de-identified records about its own customers and work does not usually fit that definition, because the records are not personal information once properly de-identified, and the people involved dealt with the company directly.

The California regulator has widened its reading of a direct relationship and has taken enforcement action against companies that failed to register, so counsel should check this question rather than assume it away, especially if any licensed records came from third parties. The answer can change from one state to the next as the laws are amended.

Follow-up questions

Our privacy notice never mentioned AI. Can we still license de-identified records?

Properly de-identified data generally falls outside the consumer rights in these laws, which is why it is the usual route. The notice still needs the public commitment not to re-identify, and counsel checks the older promises.

Which state law applies to us?

Each law applies based on where the people in the records live and the size of the business, not only where the company sits. A company with customers in many states plans around the strictest rule it meets.

Does removing names make our records de-identified?

Not by itself. Account numbers, addresses, rare details and free text can still point to a person, and a kept key makes data pseudonymous. De-identification is reviewed against the whole record set.

Didn't find your question? Ask us directly.

Sources

Keep reading