A state privacy law passes with an unusual provision: companies must show their work

A state legislature has passed a consumer privacy statute whose central provision is not a right to delete or a right to opt out, but a requirement that companies be able to explain what went into an automated decision about a person.

The law covers automated decisions affecting credit, housing, insurance and employment. For each such system, a covered firm must publish the categories of data used — not the model, not the weights, but the categories — and retain a record sufficient for a regulator to reconstruct why a given decision came out the way it did.

Why categories, not code

The drafters chose categories deliberately after two years of hearings in which firms argued that disclosing model internals would be both meaningless to consumers and commercially damaging. Legislators accepted the first argument and largely rejected the second, settling on a disclosure that is legible without being a schematic.

“A consumer does not need the coefficients,” one of the bill’s sponsors said during debate. “They need to know whether their zip code was in the model. Those are very different asks and the industry keeps answering the second by objecting to the first.”

Nobody is asking for the source code. We are asking what the machine was allowed to look at.— A sponsor of the bill, during floor debate

Scope and timing

The statute takes effect in eighteen months. Firms below a revenue threshold are exempt, as are decisions made by a human who documents their reasoning. Industry groups warned that the audit-record requirement is the expensive part and that eighteen months is short for firms running legacy systems.

• Covered decisions: credit, housing, insurance and employment
• Required: published data-category disclosure plus a retained, auditable record
• Not required: model architecture, weights or source code
• Effective: eighteen months from signing, with a small-firm revenue exemption

Three other states have introduced substantially similar language this session. Because compliance is easier to build once than four times, several large firms have said they expect to apply the strictest version nationally — the pattern that has followed most state privacy legislation.