Compliance Tracker
State AI & Privacy Compliance for Staffing and Recruiting.
NYC, Illinois, California, and Colorado. More jurisdictions rolling in. Last updated 2026-04-21. 13 laws tracked · 7 enforced · 6 upcoming.
Plain-language disclaimer
This tracker is informational. It is not legal advice. Information is compiled from public legislative sources, attorney general guidance, and reputable law-firm summaries, and is accurate to the best of our research as of the date shown. Laws change. Interpretations evolve. Enforcement varies by jurisdiction and by facts. Always verify against the cited primary source and consult qualified counsel before making compliance decisions. Envoy Recruit makes no warranty of accuracy or completeness, and disclaims liability for actions taken in reliance on this tracker. Use at your own risk.
Enforced
7
Upcoming
6
Total
13
No laws match those filters. Try a different combination.
California FEHA Employment Regulations on Automated-Decision Systems
2 Cal. Code Regs § 11008 · Effective October 1, 2025
California Civil Rights Department regulations that extend the Fair Employment and Housing Act to cover automated-decision systems used in employment. Introduces agency theory and proxy concepts so third-party AI vendors and staffing-agency use of AI can trigger employer liability. Already in effect and enforceable as of October 1, 2025.
Who this affects
- · Employers using automated-decision systems (ADS) in hiring
- · Staffing firms using AI in placement decisions
- · Recruiting agencies using AI screening
- · AI tool developers selling into CA employment
Use cases
- · Candidate screening
- · Matching
- · Hiring decisions
- · Promotion decisions
Top obligations
- Conduct bias testing of ADS used in hiring, firing, and promotion decisions
- Maintain records of ADS-related employment data for at least four years
- Provide notices and documentation required for anti-discrimination review
- Oversee third-party vendors and staffing-agency ADS use; employer remains responsible
Colorado Privacy Act — Profiling & Automated Decisions
Colo. Rev. Stat. § 6-1-1301 · In effect
Colorado residents have the right to opt out of profiling that produces legal or similarly significant effects, which includes employment decisions. Staffing firms evaluating CO candidates must offer opt-out mechanisms and document profiling in privacy notices.
Who this affects
- · Businesses profiling Colorado residents
- · Staffing firms evaluating CO candidates
Use cases
- · Candidate profiling
- · Automated hiring decisions
- · Behavioral scoring
Top obligations
- Offer opt-out of profiling to Colorado candidates
- Disclose profiling use in privacy notices
- Honor opt-out requests within 45 days
- Conduct data protection assessments for high-risk profiling
Biometric Information Privacy Act (BIPA)
740 ILCS 14 · In effect since 2008
Illinois requires written consent and a published retention schedule before collecting biometric identifiers (voiceprints, facial geometry, fingerprints, iris scans). Statutory damages are $1,000 per negligent violation and $5,000 per intentional violation, with each candidate and each event potentially a separate violation. BIPA is the single most litigated biometric-data statute in the US, with hundreds of multi-million-dollar settlements.
Who this affects
- · Any firm collecting biometric data from Illinois residents
- · Staffing firms using AI video or voice analysis
- · Background check services using biometrics
Use cases
- · AI video interviews (voiceprint, facial geometry)
- · Voice-based screening
- · Biometric background checks
Top obligations
- Obtain written informed consent before collecting any biometric identifier
- Publish a retention schedule and destruction policy
- Disclose purpose and duration of biometric data use
- Store biometric data with the same or greater care as other confidential information
- Do not profit from or disclose biometric data to third parties without consent
Artificial Intelligence Video Interview Act
820 ILCS 42 · In effect since January 2020
Employers analyzing video interviews of applicants for Illinois positions using AI must notify candidates before the interview, explain how the AI works, obtain consent, limit video sharing to those with expertise needed to evaluate, and destroy videos within 30 days of a candidate request. Amended in 2022 to require annual demographic reporting for firms that rely solely on AI in hiring.
Who this affects
- · Employers using AI analysis on video interviews for Illinois positions
- · Staffing firms conducting AI-assisted video screening
Use cases
- · AI-powered video interviews
- · Video-based candidate analysis
- · Automated facial or vocal pattern analysis in hiring
Top obligations
- Notify candidates before the interview that AI may be used
- Provide information about how the AI works and what characteristics it evaluates
- Obtain candidate consent to be evaluated by AI
- Share video only with persons whose expertise is needed for evaluation
- Destroy videos and copies within 30 days of a candidate deletion request
- File annual demographic data reports (for firms relying solely on AI)
Local Law 144 (Automated Employment Decision Tools)
NYC Admin. Code § 20-870 et seq. · Enforced since July 5, 2023
Employers and employment agencies that use automated employment decision tools (AEDTs) to substantially assist hiring or promotion decisions for NYC positions must conduct annual bias audits, publish audit summaries, notify candidates at least 10 business days in advance, and allow candidates to request alternative selection processes.
Who this affects
- · Employers using automated employment decision tools for NYC residents
- · Staffing firms placing candidates in NYC
- · Employment agencies using AI screening
Use cases
- · Candidate screening
- · Matching
- · Ranking
- · Automated employment decisions
Top obligations
- Conduct an independent bias audit within one year of using any AEDT
- Publish summary of audit results publicly on the employer website
- Notify candidates at least 10 business days before using an AEDT
- Disclose the job qualifications and characteristics the AEDT assesses
- Allow candidates to request an alternative selection process or accommodation
Capture or Use of Biometric Identifier Act (CUBI)
Tex. Bus. & Com. Code § 503.001 · In effect since 2009
Texas regulates the capture, possession, and sale of biometric identifiers (fingerprint, hand, face, retina, iris, voice). Unlike most state privacy laws, CUBI has no employment exemption and applies directly to staffing firms using biometric tools in candidate screening or interview analysis. Enforced by the Texas Attorney General with civil penalties up to $25,000 per violation.
Who this affects
- · Staffing firms using biometric tools on Texas candidates
- · Employers capturing candidate biometrics
- · Recruiting agencies running facial or voice analysis
Use cases
- · AI video interviews (voiceprint, facial geometry)
- · Biometric check-in for candidates
- · Facial recognition in screening
Top obligations
- Obtain informed consent before capturing any biometric identifier
- Disclose the purpose of the collection
- Prohibit sale or disclosure of biometric identifiers for commercial purposes
- Destroy biometric data within one year of the end of the original purpose
Washington Biometric Identifiers Law
RCW 19.375 · In effect; enhancements effective July 1, 2024
Washington law prohibiting private entities from enrolling biometric identifiers into commercial databases without notice and consent, or from selling biometric data. No employment exemption. Staffing firms using facial or voice analysis in candidate screening must obtain informed consent, secure the data, and delete when purpose ends or within 30 days of a candidate deletion request.
Who this affects
- · Staffing firms collecting biometrics from Washington candidates
- · Employers using facial recognition or voice analysis in hiring
Use cases
- · AI video interviews
- · Voiceprint analysis
- · Facial recognition in screening
- · Biometric attendance verification
Top obligations
- Obtain informed consent before collecting biometrics
- Provide clear notice of collection purpose
- Secure biometric data against breach
- Delete data when purpose ends or within 30 days of candidate request
AB 2013 (Generative AI Training Data Transparency)
Cal. Civ. Code § 3110 et seq. (Title 15.2) · Effective January 1, 2026
GenAI developers must publish high-level summaries of training data used. Staffing firms using vendor AI tools need to verify vendor disclosures and update procurement processes to include training-data transparency requirements.
Who this affects
- · GenAI developers
- · Businesses deploying GenAI in products
Use cases
- · Any GenAI-powered hiring tool
- · Candidate communication generation
Top obligations
- Verify vendor training-data disclosures
- Update procurement to require AI transparency documentation
- Document data flows between your firm and AI vendors
- Keep records of vendor disclosures for each tool deployed
SB 942 (California AI Transparency Act)
Cal. Bus. & Prof. Code § 22758 · Effective January 1, 2025; operative January 1, 2026. Amended by AB 853 (October 2025).
California AI Transparency Act. Requires providers of GenAI systems to offer publicly accessible AI detection tools, include manifest and latent disclosures in AI-generated content, and revoke licenses for third parties who disable required disclosures. Staffing firms using AI-authored candidate communications may need to apply disclosures or rely on vendor watermarking. Amended by AB 853 in October 2025.
Who this affects
- · GenAI platform operators
- · Businesses generating content with AI
Use cases
- · AI-generated candidate communications
- · Job descriptions created by AI
- · Outreach messages
Top obligations
- Review AI-generated candidate communications for disclosure needs
- Confirm vendor capabilities for watermarking or AI-content detection
- Update candidate-facing materials to disclose AI authorship where required
CPRA ADMT Regulations (Automated Decision-Making Technology)
Cal. Civ. Code § 1798.185 · Effective January 1, 2026. Compliance deadline for existing ADMT uses: January 1, 2027.
California Privacy Protection Agency rules on automated decision-making technology. Staffing firms using AI in employment decisions about California residents must provide notices, access rights, opt-out mechanisms, and honor explanation requests.
Who this affects
- · Businesses using ADMT for employment decisions
- · Staffing firms processing CA candidates
Use cases
- · Candidate screening
- · Background checks
- · Matching and ranking
- · Automated hiring decisions
Top obligations
- Provide pre-use notice to California candidates before ADMT decisions
- Implement candidate access rights, including explanations and opt-out
- Conduct risk assessments before deploying ADMT
- Maintain records of ADMT decisions for audit
Colorado AI Act — Deployer Obligations (SB 24-205)
Colo. Rev. Stat. § 6-1-1703 · Effective June 30, 2026
Staffing firms deploying high-risk AI systems in hiring must implement a risk management program, conduct impact assessments, provide candidate notices, and honor the right to contest adverse decisions. Employment is explicitly covered as a consequential decision.
Who this affects
- · Staffing firms deploying AI in hiring
- · Any business making consequential decisions with AI
Use cases
- · Candidate screening
- · Matching
- · Hiring decisions
- · Performance evaluation
Top obligations
- Implement a documented risk management program aligned to NIST AI RMF or equivalent
- Conduct impact assessments before using high-risk AI, annually, and after substantial changes
- Notify candidates before and after AI-assisted decisions
- Provide right to contest and human review of adverse outcomes
- Annual review of AI system performance for discrimination
Colorado AI Act — Developer Obligations (SB 24-205)
Colo. Rev. Stat. § 6-1-1700 et seq. · Effective June 30, 2026
Developers of high-risk AI systems must provide documentation to deployers, disclose known risks, and assist deployers in meeting their compliance obligations. Applies to any staffing firm that builds its own AI tools, or to staffing-tech vendors.
Who this affects
- · Companies developing AI tools for hiring
- · Vendors selling AI staffing platforms
Use cases
- · AI tool development
- · Vendor compliance documentation
Top obligations
- Provide documentation to all deployer customers
- Disclose known risks, limitations, and intended uses
- Report substantial modifications that could affect deployer compliance
- Assist deployers with impact assessments
Illinois Human Rights Act — AI Amendment (HB 3773)
775 ILCS 5 · Effective January 1, 2026
Amends the Illinois Human Rights Act to explicitly prohibit the use of artificial intelligence in employment decisions where it produces discriminatory consequences based on protected classes. Requires candidate notice of AI use and extends existing anti-discrimination liability to AI-driven outcomes. Signed August 9, 2024, effective January 1, 2026.
Who this affects
- · Employers using AI in employment decisions for Illinois positions
- · Staffing firms using AI for Illinois placements
Use cases
- · Candidate screening
- · Hiring decisions
- · Promotion decisions
- · Any employment decision using AI
Top obligations
- Prohibit use of AI that produces discriminatory outcomes on protected-class characteristics
- Provide notice to candidates when AI is used in employment decisions
- Maintain records sufficient to demonstrate non-discriminatory AI use
- Audit AI vendor tools before and during use for disparate impact
Next step
Handle candidate data so most of this never applies to you.
Most of these rules turn on what happens to candidate data: where it lives, who sees it, and whether you can show an auditor a record. Envoy Recruit isolates every customer in a dedicated encrypted database, redacts sensitive values before any AI call, and logs every one.
Informational only. Not legal advice. Consult qualified counsel for your specific situation. Sources cited inline. Tracker updated monthly from primary sources (state legislatures, attorney general guidance) and reputable law-firm summaries. Last updated 2026-04-21.