State attorneys general (AGs) are significantly ramping up their technical hiring to enforce a growing patchwork of state privacy laws—potentially creating an enforcement template for other tech enforcement areas like artificial intelligence (AI). Given the large number of companies collecting consumer data and using some form of AI, the market at large should be prepared for heightened scrutiny across the board when it comes to the way customers interact with the technology the use in the normal course of business.
What States Are Doing
With federal privacy legislation stalled, states are taking the lead by recruiting technologists, privacy analysts and legal experts to investigate corporate data practices and enforce compliance, according to a recent Bloomberg Government report. What we are seeing:
- Widespread Hiring Across States: California, Colorado, Connecticut, Delaware, Minnesota, New Hampshire, Oregon and Texas have been aggressively hiring technical experts—including former federal employees, Big Tech veterans, and in-house counsel and privacy officers—to support privacy enforcement.
- Shift Toward Technical Investigations: Enforcement is evolving from merely reviewing privacy policies to conducting deep technical audits of backend systems and data infrastructures. California and Texas have secured eye-popping settlements over the last couple years, and recent actions in both states demonstrate a willingness by regulators to look “behind the scenes” of a company’s privacy compliance framework and actions at a very detailed level.
- Inspired by Federal Models: States are modeling their approach after federal agencies like the Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB), which have benefited from in-house technical expertise. According to the Bloomberg report, the Oregon Department of Justice was inspired in part by the FTC’s Office of Technology, which opened in 2023 to add a layer of technical expertise to support the agency’s investigations.
- Collaborative Enforcement: Several state AG offices and the California Privacy Protection Agency (CPPA) have formalized agreements to share resources and coordinate enforcement, signaling a potential rise in multistate investigations. Attorneys general in California, Colorado, Connecticut, Delaware, Indiana, New Jersey and Oregon announced a formal collaboration agreement in April—called the Consortium of Privacy Regulators—to share staff and other resources as well as coordinate investigations and other enforcement efforts.
With companies often fielding teams of engineers, product managers and in-house counsel, regulators are now following the same playbook and closing the expertise gap between regulators and the tech industry. This is shifting and growing the ability of state AGs to regulate and enforce state privacy laws, both through bolstering technical expertise and increased collaboration and resource-sharing.
What This Could Mean for AI Regulation
We don’t expect this hiring wave to stop at privacy. With states increasing their regulation of AI technologies and the recent failure of a federal moratorium on state AI regulations, state AGs very likely will soon begin hiring AI specialists to support enforcement in this emerging area.
Here is the current state of play, and what we expect comes next:
- Absence of Congressional Action: Similar to data privacy, Congress does not appear to have plans to take action on a nationwide AI regulatory framework. If anything, federal lawmakers have only attempted to minimize AI regulations. Although Congress ultimately struck language in the federal budget reconciliation bill that would have imposed a 10-year moratorium on state or local government regulation of AI, we anticipate additional attempts.
- AGs Signal Interest in AI Oversight: In reaction to the proposed state and local moratorium, 40 state AGs sent a bipartisan letter urging Congress to reject the AI moratorium, noting it would strip away essential state protections without replacing them with any viable federal regulatory framework. Though only a handful of states have existing AI-specific regulations, AGs have also attempted to used existing consumer protection and privacy laws to regulate the emerging technology. For example, Massachusetts AG Joy Campbell issued guidance last April outlining how AI frameworks could contravene the broader Massachusetts Consumer Protection Act, Anti-Discrimination Law and Data Security Law, among others. Oregon and New Jersey followed with their own guidance on how AI systems can violate the states’ existing consumer protection, data privacy, unlawful trade and civil rights laws.
- Hiring Patterns Likely to Mirror Privacy: Just as state AGs have recruited privacy experts from Big Tech, federal agencies and in-house counsel roles, we expect similar hiring patterns for AI enforcement for engineers, ethicists and compliance professionals. Technical expertise in the emerging technology ranges from development to deployment and spans almost any and all industries, from media and health care to national security and agriculture.
- Enforcement Momentum is Building: With Congress thus far failing to limit state AG enforcement powers, states are introducing and passing AI regulations at a rapid pace. This past year, all 50 states and the District of Columbia introduced AI-related legislation while 28 states enacted 75 new measures, according to the National Conference of State Legislatures.
What to Watch For
Nearly all companies are collecting some level of consumer data and are using some form of AI and should anticipate a new level of scrutiny from state AGs. The addition of technical staff to state AG offices and the increased cooperation among state AG offices will likely result in more targeted investigative demands, deeper technical reviews and more complex litigation risk.
Businesses should ensure their privacy and AI compliance programs are robust and well-documented and consider proactively developing relationships with AGs in the states where they operate under the guidance of experienced counsel.
