Across New York, Maryland, California, New York City, and Florida, state actions are accelerating AI governance: NYDFS issues guidance on cybersecurity risk assessments with frontier AI considerations; Maryland unveils an AI framework prioritizing privacy, workers, and children with proposed regulatory tools; California issues an executive order to speed up its AI oversight framework and hints at a potential frontier AI “kill switch”; NYC Council advances a robust safety package with third‑party validation and data privacy requirements; Florida pursues criminal liability for AI chatbot developers and references OpenAI incidents.

This October 2026 BR Privacy, Security & AI Download surveys state, federal, and enforcement developments in privacy, security, and AI across the U.S. as of October 8, 2026.

Federal developments include the FTC rescinding the old Health App Breaches policy while preserving the Health Breach Notification Rule; a coalition of 25 state attorneys general calls for comprehensive federal frontier AI regulation without preempting state laws; NIST releases an updated OT security guide aligned with CSF 2.0; CISA and NIST issue guidelines to protect federal cloud identities and tokens; CISA retires six free cybersecurity assessments and shifts to Cross‑Sector Cybersecurity Performance Goals.

In enforcement, Connecticut sues over CTDPA deletion rights for consumer profiles; Illinois’ BIPA government‑contractor exemption is upheld in Help at Home; Virginia data broker SalesIntel is fined for registration failures under the Delete Act and forced to enforce DROP usage; Connecticut AG probes Kik for age assurance and moderation failures; Alabama AG secures a multi‑million‑dollar TikTok settlement on youth safety; Florida AG seeks a temporary injunction against OpenAI amid safety, minors’ data, and dark patterns actions.

Delaware updates its privacy law by lowering applicability thresholds, expanding sensitive data, and adding due diligence and profiling provisions with an effective date in 2027; California signs a broad AI package addressing workplace surveillance, automated decisions, transparency, and children’s online safety, including the No Robo Bosses Act, tougher NDAs for AI audits, and added protections for minors and workers.

Taken together, the current wave of actions signals a broad, ongoing push toward AI governance, privacy, and consumer protection with particular focus on workforce impacts, child safety online, biometric data, and frontier AI governance.