#
Substantive biometric/ADM governance exists but is state-fragmented; no general federal biometric or profiling statute exists, and state-surveillance carve-outs for national security are addressed only indirectly via the DPF redress mechanism.
Sub-modules (6)
Profiling RestrictionsAmber
California's ADMT regulations, applicable since 1 January 2026, introduce profiling-adjacent oversight requirements for automated decision-making technology.
Claims (1):
- California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026.
Automated Decision Making TransparencyAmber
The same 2026 CCPA ADMT rules impose transparency and risk-assessment duties tied to automated decision-making technology.
Claims (1):
- California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026.
Ai Risk AssessmentsAmber
Illinois SB 315 (2026, awaiting enactment) would require covered AI entities to conduct pre-deployment risk assessments, mandatory governance, and annual third-party audits — a first among US state AI statutes.
Claims (1):
- Illinois Senate Bill 315, approved by the Illinois General Assembly and awaiting enactment, would require covered AI entities to conduct pre-deployment risk assessments and undergo mandatory annual third-party audits.
Biometric RegimeAmber
Illinois's BIPA (2008) is the first comprehensive US biometric privacy statute, includes a private right of action, and has generated landmark litigation including a $650M Facebook settlement and a Illinois Supreme Court ruling (Cothron v. White Castle) permitting per-scan damages accrual.
Claims (2):
- Illinois's BIPA, in effect since 2008, prohibits collection of biometric identifiers or information absent specified conditions and includes a private right of action that produced a $650 million Facebook settlement in March 2021.
- The Illinois Supreme Court's Cothron v. White Castle decision held that separate BIPA claims accrue for every biometric scan, exposing White Castle to potential damages of up to $17 billion under the current ruling.
Genetic DataAmber
PADFAA separately designates genetic data as a category of sensitive data subject to foreign-adversary transfer restrictions.
Claims (1):
- PADFAA's definition of personally identifiable sensitive data includes health, financial, genetic, biometric, geolocation, and sexual-behavior information as well as account/device credentials and government-issued identifiers.
State Surveillance CarveoutsAmber
The EU-US DPF includes binding safeguards limiting US intelligence-service access to EU data to what is necessary and proportionate, with a Data Protection Review Court able to order deletion of unlawfully collected data — the principal check on surveillance carve-outs relevant to this transfer corridor.
Claims (1):
- The EU-US Data Privacy Framework introduces binding safeguards limiting access to EU data by US intelligence services to what is necessary and proportionate and establishes a Data Protection Review Court able to order deletion of unlawfully collected data.
no periodic updates on record for this sub-brief
Sources and claims (5)
- ProbableIAPP — Illinois Senate Bill 315, approved by the Illinois General Assembly and awaiting enactment, would require covered AI entities to conduct pre-deployment risk assessments and undergo mandatory annual third-party audits.observed
- ProbableIAPP — Illinois's BIPA, in effect since 2008, prohibits collection of biometric identifiers or information absent specified conditions and includes a private right of action that produced a $650 million Facebook settlement in March 2021.observed
- ProbableIAPP — The Illinois Supreme Court's Cothron v. White Castle decision held that separate BIPA claims accrue for every biometric scan, exposing White Castle to potential damages of up to $17 billion under the current ruling.observed
- ProbableIAPP — The EU-US Data Privacy Framework introduces binding safeguards limiting access to EU data by US intelligence services to what is necessary and proportionate and establishes a Data Protection Review Court able to order deletion of unlawfully collected data.observed
- ProbableFTC — The 2025 COPPA amendments clarify that the Rule applies to children's biometric identifiers usable for automated or semi-automated recognition of an individual.observed