Center for Practical AI

CPAI Issue Brief · Rights & Fairness · Privacy & data

AI & Data Protections

Email

There is no comprehensive federal privacy law — so what happens to the data people put into AI depends on their zip code and the fine print.

What’s happening

People type sensitive information into AI tools that feel private but are company servers. That data can be used for training, retained, reviewed by humans, subpoenaed, breached, or sold — and the rules governing it are a patchwork.

What the evidence shows

In the New York Times copyright litigation, a federal court ordered OpenAI to hand over about 20 million de-identified consumer ChatGPT conversations in discovery — ordinary users' chats became evidence in a case they are not party to. "Anonymized" offers thin protection: a Nature Communications study estimated 99.98% of Americans could be re-identified from 15 demographic attributes. The FTC's amended COPPA Rule now requires separate parental consent before a child's data is disclosed to third parties, including for AI training.

~20M

consumer ChatGPT chats ordered produced in discovery

NYT v. OpenAI, 2025 — court order

~20 states

have comprehensive privacy laws in effect; NC is not among them

IAPP / MultiState, 2026

Where it reaches constituents

Every person who uses an AI tool — and, acutely, children, patients, and anyone whose most sensitive data ends up in the least-protected place. The protection you get depends heavily on which state you live in.

The current legal & regulatory landscape

No comprehensive federal consumer-privacy statute exists; sector rules (HIPAA, FERPA, COPPA, GLBA) cover slices. About 20 states have comprehensive privacy laws in effect as of 2026; North Carolina does not. A newer layer of AI-specific state laws (Colorado, Texas, Illinois, California) is arriving alongside them.

Considerations policymakers are weighing

  • ·Baseline data rights that do not depend on the state a person lives in.
  • ·Rules for sensitive categories — genetic, biometric, health, and children's data.
  • ·Transparency about training use, retention, and human review of what users enter.

Listed as live debates, not recommendations. CPAI does not take a position on how these should be resolved.

This brief condenses a full, sourced public guide. The complete evidence and citations:

AI and Your Data →

More in Rights & Fairness

  • Bias at ScaleA biased human decides one case. A biased system deployed statewide decides every case the same way — silently, and at scale.

Key sources

Court ruling / legal filing
NYT v. OpenAI (2025) — Court order to produce 20 million ChatGPT logs ↗In the New York Times copyright litigation, a federal magistrate ordered OpenAI (November 2025) to produce about 20 million de-identified consumer ChatGPT conversations — a random sample from Dec 2022–Nov 2024, up to 80 million prompt-output pairs — to opposing counsel in discovery; a stay was denied. Ordinary users' chats became evidence in a case they are not party to. A structural fact about data held by a company, not a scandal claim.
Peer-reviewed study
Rocher, Hendrickx & de Montjoye (2019) — Estimating the success of re-identifications in incomplete datasets ↗Nature Communications. A model estimated that 99.98% of Americans could be correctly re-identified in any dataset using 15 demographic attributes — so 'anonymized' data is often re-identifiable once combined with other data.
Official policy / primary source
Federal Trade Commission (2025) — Amended COPPA Rule ↗The FTC's amended Children's Online Privacy Protection Rule (final April 2025, effective June 23, 2025) requires separate verifiable parental consent before a child's personal information is disclosed to third parties — including for AI training.
Official policy / primary source
IAPP / MultiState (2026) — U.S. state comprehensive privacy laws ↗There is no comprehensive federal consumer-privacy statute; sector rules (HIPAA, FERPA, COPPA, GLBA) cover slices. About 20 states have comprehensive consumer-privacy laws in effect as of 2026 — North Carolina is not among them.
Court ruling / legal filing
In re 23andMe (2025) — Bankruptcy and sale of genetic data ↗After 23andMe filed for bankruptcy in 2025, its genetic database became a transferable estate asset; a court approved its sale (about $305 million) to TTAM Research Institute, a nonprofit led by the company's founder, over objections from multiple state attorneys general seeking explicit customer consent. The teaching point: a privacy promise is only as durable as the entity that made it.
Official policy / primary source
N.C.G.S. Chapter 75, Article 2A — Identity Theft Protection Act ↗§75-65 requires notice of a security breach without unreasonable delay, with no fixed deadline. The Act reaches breach only — it does not govern collection, use, sharing, retention, or model training. North Carolina has no comprehensive consumer privacy law: Senate Bill 757 did not leave Senate Rules, and House Bill 462 stalled after a favorable committee substitute in April 2025.
Official policy / primary source
N.C.G.S. §115C-401.2 — Student online privacy protection ↗Bars targeted advertising, profiling, and sale of covered information by operators of products designed and marketed primarily for K-12 school purposes, and requires deletion within 45 days on a school's request. Predates generative AI and says nothing about model training.
Official policy / primary source
NC Department of Information Technology (2026) — Use of Publicly Available Generative Artificial Intelligence, v1.1 ↗Updated April 14 2026. Prohibits state employees from entering confidential state information or personal information into publicly available generative AI tools, on the stated principle that "sharing information with a publicly available GenAI tool is considered a public release of the information."

A nonpartisan resource

The Center for Practical AI is a nonpartisan 501(c)(3) nonprofit. We provide education, research, and analysis, and we offer briefings and testimony on request. We do not endorse candidates or lobby for or against specific legislation. Everything here describes the evidence and the current landscape — the policy choices are yours.

Want CPAI to brief your office on this?

We provide nonpartisan briefings, research summaries, and testimony on request.

Request a briefing →