AI Governance Meets Privacy: What It Means for Your Personal Data

A growing number of new laws and proposals are positioning privacy regulators as the primary enforcers of AI oversight. That shift might sound like a procedural detail, but for anyone who uses online services, fills out web forms, or interacts with chatbots, it could change how companies handle your personal data. Here’s a look at what’s happening, why it matters, and what you can do about it.

What’s happening

Over the past year, several legislative efforts have explicitly tied AI governance to existing data protection frameworks. The European Union’s AI Act, already in force in parts, classifies certain AI systems by risk and places obligations on developers that overlap heavily with GDPR privacy rules. In the United States, state-level activity is accelerating.

Connecticut’s recent privacy amendment (SB 3) expanded the state’s existing data privacy law to cover “automated decision-making” and “profiling” systems. Companies must now provide consumers with notice and an opportunity to opt out of such systems when they involve sensitive data. California, meanwhile, is finalizing a set of AI-related amendments to its privacy regulations that would require businesses to explain how algorithms use personal information and to allow consumers to access “meaningful information” about automated decisions.

The International Association of Privacy Professionals (IAPP) has been tracking these developments closely, noting that privacy offices—rather than standalone AI agencies—are being tasked with enforcement. In Canada, the federal government’s proposed Artificial Intelligence and Data Act would be administered alongside the Personal Information Protection and Electronic Documents Act (PIPEDA), putting privacy commissioners in a central role.

Why it matters for your data rights

The practical effect is that many of the rules governing AI will borrow directly from privacy law. That means concepts like consent, data minimization, and the right to access and delete information now apply to how AI models are trained and deployed.

For consumers, the most immediate change is likely to be more transparent notices. If a company uses your data to train a recommendation engine or a hiring algorithm, it may need to tell you explicitly and give you a way to opt out. Some laws also require companies to let you request a human review of automated decisions that have significant consequences (like loan denials or job screening).

However, the landscape is still fragmented. Not all states or countries have signed on, and enforcement varies. It’s not yet clear how consistently these new rules will be applied, especially across borders. What is clear is that privacy regulators are gaining new tools—and new responsibilities—that directly affect how your data is used in AI systems.

What you can do

Even as laws evolve, there are practical steps you can take to protect your privacy around AI:

  • Check privacy settings on platforms you use. Many social media, search, and productivity tools now offer controls for data used to train AI. Look for options like “Do not train AI models on my content” or “Opt out of automated decision-making.”
  • Understand opt-out forms. Some companies process opt-out requests through web forms or email. If you’re uncomfortable with your data being used, submit a request. Keep a copy for your records.
  • Stay informed about local laws. If you live in the U.S., check whether your state has passed an AI or privacy amendment. Connecticut, Colorado, and California have some of the strongest protections so far. In Europe, the AI Act is gradually taking effect.
  • Be cautious about what you share publicly. Even with regulations, publicly posted data can still be scraped or used in training. Consider limiting personal details on public forums and social media.

No single action will fully protect you, but combining these steps with awareness of your rights under emerging law can help you maintain more control.

Sources

The information in this article is drawn from recent reporting and analysis by the International Association of Privacy Professionals (IAPP), a credible source for privacy and AI governance news. Specific articles include:

  • “Notes from the IAPP Canada: AI strategy, lawful access and more” (May 2026)
  • “A view from DC: Double toil and trouble in Connecticut’s privacy amendment” (June 2025)
  • “Last-minute legislative decisions to shape California’s AI, privacy regimes” (September 2024)

These pieces provide detailed descriptions of the legislative changes and their implications for privacy enforcement.