Today's Top Story: Connecticut's AI Privacy Rules Go Live
Connecticut's SB 1295 (Public Act 25-113) takes effect today. Any controller doing business in Connecticut must now state in its privacy notice whether it collects, uses, or sells personal data to train large language models — one of the first US state mandates of its kind. The same amendment lowers the CTDPA applicability threshold from 100,000 to 35,000 consumers, pulling many mid-size companies into scope for the first time, and categorically bars processing minors' data for targeted advertising or sale regardless of consent. A separate profiling impact-assessment duty follows on August 1 (31 days out).
Also Today
Tennessee bans AI from posing as a therapist. SB 1580 takes effect today, barring anyone who develops or deploys an AI system from advertising it as, or as able to act as, a qualified mental-health professional. Violations are Tennessee Consumer Protection Act breaches at $5,000 per violation, with a private right of action. Audit product and marketing copy now for any claim implying clinical or licensed-therapist capability. Source
EU Council gives the Digital Omnibus its final green light. On June 29 the Council approved the AI Act simplification package (Parliament endorsed it June 16). High-risk application dates move to December 2, 2027 (stand-alone Annex III systems) and August 2, 2028 (systems embedded in regulated products), and a new prohibition on AI-generated non-consensual intimate content and CSAM arrives, with "nudifier" apps banned from December 2026. Re-baseline your EU AI Act timelines against the deferred dates. Source
EU AI Office enforcement powers switch on August 2. From that date the AI Office can enforce GPAI obligations and Article 50 transparency duties, with Article 101 fines up to 3% of global turnover or €15M, whichever is higher. Note: the Article 50(2) machine-readable marking duty for systems placed on the market before August 2 is deferred to December 2, 2026. Source
California's AI Transparency Act (SB 942) also lands August 2. Covered generative-AI providers must offer AI-detection tooling and attach provenance disclosures to AI-generated content. Source
One Thing to Do Today
If you sell into Connecticut, publish your LLM-training data-use disclosure in your privacy notice now — the mandate is live today — and re-check whether the new 35,000-consumer threshold just pulled you into CTDPA scope.
Tomorrow's Focus: Thursday is our weekly deep-dive edition — the daily briefing returns Friday with Financial Regulation & Compliance.
CyberEyeQ — Actionable Regulatory Intelligence. Questions or tips: [email protected]