The Consumer Financial Protection Bureau has issued a warning to companies regarding the misuse of digital surveillance and artificial intelligence tools in the workplace. The CFPB emphasizes that employers must obtain employee consent when using third-party consumer reports derived from surveillance data, as the Fair Credit Reporting Act mandates. During a recent announcement, CFPB Director Rohit Chopra expressed concerns over how AI can generate background dossiers that may be used in hiring and promotions, potentially harming worker careers. He highlighted the invasive nature of workplace surveillance, citing examples from the healthcare sector where nurses are monitored via digital badges. Jamie Brown, president of the country’s largest nurse union, echoed these concerns, stating that such technologies often violate worker and patient privacy.
A new report from The Software Alliance reveals that nearly 700 pieces of artificial intelligence legislation have been introduced across 45 states in 2024, signaling a significant increase from just 191 in 2023. This trend mirrors previous waves of consumer data privacy laws, suggesting that state policymakers are responding to the need for regulation without federal laws. Notable examples include Colorado’s recent legislation to mitigate AI-powered discrimination, making it the first state to regulate the AI industry on such a scale. With 33 states establishing AI task forces, experts believe the momentum is building for comprehensive AI legislation as we move into 2025.
Companies using AI-based surveillance or third-party consumer data must prioritize FCRA compliance by implementing clear consent policies and informing employees about data usage. And I suspect that’s a surge of products infusing everything with AI. Service providers specializing in workforce management solutions or surveillance tools have a vital role to play in helping employers ensure regulatory alignment. Offering consent management features and compliance support can help clients avoid significant legal liabilities and foster a culture of transparency in digital monitoring.
This fragmented regulatory environment poses compliance challenges for organizations operating across multiple states, each with its own AI standards. IT and AI service providers should consider expanding compliance and regulatory consulting as part of their offerings, helping clients adapt policies and processes to diverse state regulations. Proactive monitoring of legislative developments will also be crucial, allowing companies to stay ahead of evolving compliance requirements and avoid reactive measures.