U.S. state privacy and hiring notices

Information for everyone

Evidize handles the duties that apply to its own service, collection and provider role. Employers handle their own hiring notices, audits and decisions. The responsibility notes below explain the difference. A software-provider label does not remove a duty that follows from what Evidize actually does.

Read the Evidize Privacy Notice for the information we collect, where it comes from, its purposes, recipients, retention and request process. The hiring organization also provides information about its own processing with your application or screening session. Ask the hiring contact if that notice is missing. The state guide explains the rules; it does not replace either notice.

State rules can depend on the employer, job, associated office, your residence, where an assessment takes place and the feature being used. A company's headquarters alone does not decide the applicable rules. Selecting a state below does not declare your location or give consent to processing.

An employment-data exclusion concerns information used in that employment role. Separately covered website or consumer activity can have different rules, while using a business account does not automatically make you a consumer under every state law. A future date below applies only when that date and the stated conditions are met; it does not postpone a separate notice already required today.

To request an accommodation, correction or an applicable privacy right, use the hiring contact or the privacy request form. A security interruption is a separate access issue; explain it to the hiring contact so they can arrange assistance.

For a privacy appeal, identify the earlier request and the response you want reviewed. Use the responsible organization's specific choice method for any sale, sharing, advertising or sensitive-use opt-out; the Evidize form's automated-decision option does not submit those other choices.

Choose a state

State or Washington, D.C.

Alabama

The common Evidize Privacy Notice applies alongside the information below.

The reviewed eavesdropping provision concerns private communications of others without at least one participant's consent; it does not itself impose a general AI-processing notice. Act 2026-552 excludes commercial/employment context.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Evidize: Evidize must classify its actual device and communication collectors and provide any notice or obtain any permission required for its collection. Calling data metadata does not settle the issue.

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

In the service: Reuse the existing collection notice and permission mechanism only for the actual covered collector. No new recording capability or universal all-participant consent requirement is added.

Employment consumer reports

Evidize: Classify the actual existing report, including integrity findings. If Evidize acts as a consumer reporting agency, its accuracy, file-access, dispute and other reporting-company duties cannot be transferred to the employer.

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

In the service: Resolve report classification before permitting the affected employment use. Retain applicable Evidize reporting-company controls; do not create a new background-check product or require report authorization for unrelated uses.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Evidize: Evidize handles notices and rights for its own covered processing. When processing for an employer, Evidize must provide the assistance, security, use restrictions and data handling required of its actual service-provider or processor role.

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

In the service: Use the shared privacy notice, request process and provider data controls. Employer-only policy preparation and legal assessments are the employer’s work, not a mandatory Evidize setup workflow.

When additional notices apply

The Evidize Privacy Notice explains ordinary data processing. The additional notices below depend on the activity and the people involved. A resume review does not automatically trigger the separate rules for recording, biometrics or employment reports.

What you can do: Read the employer notice supplied with your application or session as well as Evidize's Privacy Notice. Ask the hiring contact which tools and information are used, or request a missing notice or assistance. The state guide explains the rules; it does not deliver that employer's specific notice or give permission.

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

Provide advance notice or obtain permission when the applicable recording law requires it. Some laws allow a participant to record, or allow recording with one participant's prior consent; others require everyone's consent or knowledge. The rule depends on the type of communication, privacy expectations and the participants' locations. Device screening and recording are separate activities.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

You receive a separate written disclosure and authorization step before the report is obtained. Before a report-based adverse decision, you receive the report and the prescribed rights summary. A final adverse-action notice identifies the reporting agency and explains dispute and free-copy rights. Investigative reports may require additional notices.

What you can do: Ask the employer for the separate report disclosure and the reporting agency details. Use the agency method identified in that notice to request your file or dispute inaccurate report information; an Evidize privacy request does not automatically send a dispute to a reporting agency.

Federal employment-report requirements

Website and other consumer uses

When this applies: Only where the controller and processing meet the applicable consumer-privacy law, including thresholds, operative date and exclusions; separately assess website advertising or independent consumer services. Ordinary excluded applicant-role processing does not activate this package.

From May 1, 2027, covered consumers may confirm/access, correct, delete and obtain a portable copy of data they provided, and opt out of sale, targeted advertising and profiling for solely automated significant decisions. Respond within 45 days; a justified 45-day extension requires notice during the initial period. An authentication failure or a documented fraudulent/unauthorized opt-out refusal requires notice. These are consumer rights, not an extension to excluded employment-context data.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe the personal-data categories processed and the purposes of processing.
Identify the categories of personal data shared with third parties and the categories of recipients.
Provide an active email address or other contact mechanism and explain the available rights and secure request methods.
Provide a conspicuous website opt-out link leading to a direct choice or current contact information for sale/targeted-advertising opt-out requests; disclose those activities clearly.
Explain how to revoke consent. Section 5 does not establish an internal appeal right; do not label an optional review process a statutory Alabama appeal.

Timing: Enacted future duty from 2027-05-01. Disclose processing and provide the notice when the covered consumer processing begins; sensitive-data processing requires the separate consent required by section 7(b)(2).

What you can do: Use the responsible organization's stated request method. Evidize's form accepts information-access, correction, deletion, explanation and review requests; identify the organization and state. Where an appeal right applies, include the earlier reference for a privacy appeal. For sale, sharing, advertising or sensitive-use choices, use the specific method in the applicable notice. The form's automated-decision option does not carry out those other choices.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Do not apply HB351 consumer notices to ordinary applicant-role data solely because the applicant lives in Alabama.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified; current local enactments were not exhaustively certified.

13A-11-30(1), eavesdropping definition — official current text reviewed
HB351 enrolled sections 2(6), 5-7 and 12 — official enrolled text cross-checked against signed Act 2026-552
Signed Act 2026-552, sections 2(6), 3-7 and 12; signature page 30 — official signed act downloaded; substantive text and governor approval dated 2026-04-16 visually verified on 2026-09-13

Alaska

The common Evidize Privacy Notice applies alongside the information below.

AS 42.20.300-.310 addresses unauthorized interception/publication. SB85 proposes changing the existing party-consent language to all parties; the official bill record still shows committee status, not enactment.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Do not turn the unpassed SB85 all-party language into a current mandatory notice.

Unresolved research and factual questions

Full statutory text is now retrieved. Actual capture must still be classified under AS 42.20.300-.320 and relevant participant locations before invoking an exception; the pending HB86/SB85 proposals are not enacted law.
No separate AI-hiring notice identified in the reviewed official bill material; no exhaustive absence assurance.

SB85, 34th Legislature, bill status — official current bill record reviewed
Proposed amendments to AS 42.20.310; bracketed existing party language — official proposal reviewed, not current enacted-law authority
AS 42.20.310(a)(1), party-consent language — official indexed excerpt confirms party-consent text; full document and amendment verification still unavailable through direct retrieval
AS 42.20.300-.320; 42.20.390 — full legislative online 2025 compilation rendered and read on 2026-09-13; private communication authorization and oral party-consent text verified
34th Legislature HB86 status — live legislative history read on 2026-09-13: pending House Labor and Commerce, then Judiciary; not enacted

Arizona

The common Evidize Privacy Notice applies alongside the information below.

A nonparticipant's interception requires a party's consent under the reviewed wire/electronic and oral communication provisions. The statute does not make consent necessary merely because a resume is analyzed by AI.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

ARS 13-3012(9) provides the party-consent exception; classify the actual capture and participants.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified in this bounded review; local/special-sector obligations are not certified absent.

ARS 13-3005(A) — official current text reviewed
ARS 13-3012(9) — official current text reviewed

Arkansas

The common Evidize Privacy Notice applies alongside the information below.

The enacted interception provision reviewed permits participation or one participant's prior consent; it does not supply a generic AI notice duty.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

A participant/consent exception to communication interception does not authorize private visual surveillance or unrelated-device access.

Unresolved research and factual questions

Current code and subsequent amendments need a consolidated-code check before relying on a recording exception. The source is an enacted act, not a 2026 absence finding.
No additional AI-hiring-specific notice identified; state/local 2026 enactment sweep is not certified complete.

Act 1823 of 2001, section 1; Arkansas Code 5-60-120(a) — official enacted session law reviewed; consolidated 2026 text not obtained

California

The common Evidize Privacy Notice applies alongside the information below.

CCPA-covered businesses controlling collection of California residents' applicant data need timely collection disclosures; employment data is not generally exempt. CalOPPA separately governs covered commercial online collection. Covered ADMT making significant employment decisions has a future pre-use notice; genuine qualifying human involvement changes the ADMT classification.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Information before collection

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

California privacy policy and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Online privacy information

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Covered automated employment decisions from January 1, 2027

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Employment credit reports

Evidize: This entry concerns a separate activity not established as a supported Evidize hiring feature. Before introducing it or using existing data for that purpose, assess Evidize’s actual role and implement any duties it would owe.

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

In the service: Keep this as conditional information. Do not build a biometric, recording, credit, criminal-background, companion, health-data or data-broker product to satisfy the entry. Existing integrity reports and collectors still require their own classification.

When additional notices apply

If you live in California and the organization is covered by California privacy law, you must receive information about your data before it is collected. These protections can apply even when the employer is in another state. Additional notices for certain automated employment decisions begin on January 1, 2027.

Information before collection

When this applies: Only when the activity and coverage conditions described above apply.

Before collection, the notice identifies each information category, including sensitive categories, its purposes, whether it is sold or shared, and its retention period or criteria. It links to the business privacy policy and, if information is sold or shared, the actual opt-out notice. A state guide or a generic policy link that makes you search is not a substitute.

Timing: At or before collection

California privacy policy and rights

When this applies: Only when the activity and coverage conditions described above apply.

Explain applicable CCPA rights and methods, and separately report the preceding 12 months of collection categories, sources, purposes, recipient categories, sales/sharing categories and business-purpose disclosure categories (or accurate none statements). Include applicable sale/sharing and sensitive-use choices, authorized-agent and request procedures, contact and last-update information required by 11 CCR 7011. Do not replace historical facts with a list of possible future uses.

Timing: Publish the required policy and update it at least once every 12 months; the separate notice at collection must precede collection.

Online privacy information

When this applies: Only when the activity and coverage conditions described above apply.

The online policy explains collection and disclosure, any process for reviewing or correcting information, how policy changes are announced, its effective date, and how browser tracking signals and third-party tracking are handled.

Timing: Conspicuously available online

Covered automated employment decisions from January 1, 2027

When this applies: Only when the activity and coverage conditions described above apply.

For covered automated decisions from January 1, 2027, the notice identifies the specific purpose, information that affects the output, how the output is used and the role of any human reviewer. It explains your access right and request methods, the applicable opt-out or identified exception, any human-appeal process, how a decision will be made if you opt out, and the prohibition on retaliation for exercising CCPA rights. An online opt-out method must link to the interactive form, with the other required methods identified. It is delivered at or before collection for the intended automated use, or before using previously collected information for a new covered purpose.

Timing: From 2027-01-01, at/before collecting data intended for covered ADMT, or before later repurposing

Investigative employment reports

When this applies: The employer obtains a report covered by California's investigative consumer reporting law.

Before requesting the report, the employer provides a separate disclosure identifying the reporting agency, the purpose and extent of the investigation, your rights and a way to request a free copy. Written authorization is required unless a specific legal exception applies.

Timing: Before procurement; requested report copy within three business days of receipt

Employment credit reports

When this applies: The employer obtains a legally permitted employment credit report.

The notice explains why the law permits that use, identifies the report source and lets you request a free copy. A qualification score is not automatically a credit report.

Timing: Before requesting an employment credit report

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Assess business/service-provider role, CCPA thresholds and data-specific exemptions. A New York employer does not remove a California resident's relevant protection.
CalOPPA's consumer definition must be assessed for the website/service; it is not a blanket statement that every B2B datum is covered.
Ordinary photographs/video are not automatically identifying biometrics; confidential communications and actual interception are a separate CIPA analysis.

Unresolved research and factual questions

Approve actual employer/platform CCPA roles, report classification and ADMT human-involvement facts; do not infer them from a state address.
CIPA 631/632/632.7 interception and confidential-recording analysis must cover the actual telemetry/recording design and all participants; not a claim that an AI checkbox alone satisfies it.
If actual criminal/public-record background data is added, separately assess California and local fair-chance disclosures rather than reusing the resume notice.

Civil Code 1798.100(a)-(c) — official current text reviewed
11 CCR 7001(e), 7012, 7200, 7220-7221 — adopted text reviewed
CPPA adoption and phased compliance dates — official announcement reviewed
BPC 22575; read with 22577 definitions — official current text reviewed
Civil Code 1786.16(a)(2), (b), (c) — official current text reviewed
Civil Code 1785.20.5 — official current text reviewed
Penal Code 632(a), (c): confidential communication recording — official current text reviewed
BPC 22577(d), consumer definition — official current text reviewed
Civil Code 1798.130(a)(1)-(5), request methods and annual CCPA policy disclosures — official statute or adopted rule text reviewed on 2026-09-13

Colorado

The common Evidize Privacy Notice applies alongside the information below.

SB26-189 covers materially influential employment ADMT with its specified Colorado nexus; routine administration and genuine cybersecurity/fraud controls have exclusions. Using integrity results in hiring requires its own classification. Ordinary CPA employment exclusion does not remove section 6-1-1314's prospective-employee biometric rules.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Covered automated decisions from January 1, 2027

Evidize: Where Evidize is a covered developer or provider, supply the required versioned information about the technology and required direct material-update notices. Separate any duty arising when Evidize itself operates the covered interaction or decision.

Employer: The employer gives the notices and fulfills the decision-related obligations imposed on its own covered use. Provider documentation does not replace employer-specific notices.

In the service: Use Evidize’s shared provider-information document and customer update delivery. Do not add a separate employer compliance administration process.

Notice after a covered adverse decision from January 1, 2027

Evidize: This employer or deployer duty is not imposed on Evidize merely for supplying software. If Evidize actually acts as an employer, employment agency, agent or covered deployer, assess and carry out its own duties; a contract label does not establish an exemption.

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

In the service: Explain the responsibility and supply relevant product information. Do not require an employer compliance wizard, evidence upload or approval gate solely to administer the employer’s duty.

Biometric collection

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

Some biometric uses already require advance information and permission. Additional notices for covered automated hiring decisions begin on January 1, 2027. Ordinary employment records and separate consumer uses have different privacy rules.

Covered automated decisions from January 1, 2027

When this applies: Only when the activity and coverage conditions described above apply.

Before the covered use, you receive clear information that automated decision technology will be used and how to request further information.

Timing: Before covered ADMT use from 2027-01-01

Notice after a covered adverse decision from January 1, 2027

When this applies: Only when the activity and coverage conditions described above apply.

Within 30 days after a covered adverse decision, the notice explains the decision and the technology’s role. It gives simple instructions for requesting further information about the tool, version, developer and data types, categories and sources, to the extent the developer supplied that information. It explains how to request access and correction of factually incorrect or materially inaccurate personal data and meaningful human review and reconsideration to the extent commercially reasonable. The correction right does not require changes to opinions, predictions, scores or protected evaluations.

Timing: Within 30 days after an adverse decision

Biometric collection

When this applies: Only when the activity and coverage conditions described above apply.

Before covered biometric processing, the organization explains what it collects, its purpose, retention and relevant provider disclosures, and obtains any required consent. A public biometric policy is also required where the law applies.

Timing: Before collection/processing

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may access, correct, delete, obtain a portable copy and opt out of sale, targeted advertising and profiling for legal or similarly significant decisions, subject to statutory limits. Explain the internal appeal and Attorney General complaint options. Ordinary employment/applicant processing is excluded from these consumer rights; the separate biometric and 2027 ADMT laws require their own analysis.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Explain online and offline practices by data category and purpose, including sensitive data and whether each purpose involves sale, targeted advertising or significant-decision profiling.
Describe shared/sold categories and recipient categories with enough detail to identify their type, business model or processing; provide controller contact information and the notice update date.
List rights, request instructions, authorized-agent instructions, authentication process, appeal method and how universal opt-out signals are processed.
For covered significant-decision profiling, explain the decision, data used, plain-language logic, how profiling and any humans contribute, benefits/consequences, whether accuracy/fairness/bias was evaluated and the results, and the opt-out method under Rule 9.03. When human involvement is the reason for refusing a profiling opt-out, Rule 9.04(C) also requires the meaningful human role and correction/deletion method.
Communicate material privacy-notice changes through the medium normally used with consumers; obtain consent before using previously collected data for a secondary use.

Timing: Current CPA duties since 2023-07-01; universal-opt-out explanation applies from 2024-07-01. Make the privacy notice available so consumers understand processing in advance or when it occurs; provide the significant-decision profiling opt-out method at or before that processing. Communicate material changes before the changed processing and obtain required secondary-use consent.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Biometric identification is a specific activity, not every photo/video. Employer-required consent is restricted to enumerated access, timekeeping and safety/security purposes; other biometric uses require consent without employment conditioning or retaliation.

Unresolved research and factual questions

Confirm the actual ADMT exemption/nexus and biometric use, not merely the feature label. Recheck implementing rules before 2027 activation.
Recording requires a separate CRS 18-9-303/304 analysis; the AI notice does not supply interception permission.

CRS 6-1-1701, 1702 and 1704; act effective-date section — official signed session law reviewed
HB24-1130, CRS 6-1-1314(2), (4), (6) — official signed text reviewed
Signed status and July 1, 2025 effective date — official status reviewed
CRS 6-1-1303(6), 1308; Attorney General guidance on employment exclusion, consumer privacy notices and consent — official guide reviewed; read together with later biometric amendment
4 CCR 904-3 Rules 6.02-6.04, 9.03; privacy notice, changes and profiling disclosures — official adopted CPA rules text read; consumer notice provisions, not a substitute for separate biometric amendments

Connecticut

The common Evidize Privacy Notice applies alongside the information below.

PA26-15 employment notices concern automated employment-related technology used as a substantial factor in a covered decision affecting a Connecticut individual. The employer-monitoring rule is separately scoped to employees on employer premises. Ordinary consumer-privacy employment exclusions do not settle the new AI law. PA26-100 section 67 repealed PA26-15 section 1 on June 2, 2026. Replacement section 46 applies from October 1, 2026 only to qualifying personal-use media-generation subscriptions; Evidize's current commercial hiring subscriptions are outside that provision.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Interacting with employment AI from October 1, 2027

Employer: The employer gives the notices and fulfills the decision-related obligations imposed on its own covered use. Provider documentation does not replace employer-specific notices.

In the service: Use Evidize’s shared provider-information document and customer update delivery. Do not add a separate employer compliance administration process.

Employment AI notices for covered deployments from October 1, 2027

Employer: The employer gives the notices and fulfills the decision-related obligations imposed on its own covered use. Provider documentation does not replace employer-specific notices.

In the service: Use Evidize’s shared provider-information document and customer update delivery. Do not add a separate employer compliance administration process.

Employee monitoring

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

Connecticut has notice rules for certain employee monitoring. New employment AI notices apply to qualifying technology deployed on or after October 1, 2027. The rules for a website visitor or individual consumer may differ from those for an applicant. A separate subscription rule was replaced: PA26-100 covers qualifying personal-use media-generation services from October 1, 2026, not Evidize’s current commercial hiring subscriptions.

Interacting with employment AI from October 1, 2027

When this applies: Only when the activity and coverage conditions described above apply.

When you interact with covered employment AI, you are told that it is AI unless this would already be obvious to a reasonable person.

Timing: Deployments on or after 2027-10-01

Employment AI notices for covered deployments from October 1, 2027

When this applies: Only when the activity and coverage conditions described above apply.

Before the covered decision, the written notice identifies the technology by trade name, states that it has been deployed, explains its purpose and the nature of the employment decision, identifies the personal-data categories and sources and how they are assessed, and gives the organization’s contact information. If required information is withheld because it is a trade secret or otherwise legally protected, the notice explains the basis for withholding it.

Timing: Before the employment decision for deployments on or after 2027-10-01

Employee monitoring

When this applies: An employer conducts employee monitoring covered by Connecticut law.

Employees receive advance written information about the types of monitoring, and the employer posts the required notice. A limited exception needs its actual legal conditions to be met.

Timing: Before qualifying employee monitoring

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may access data and inferences, correct, delete, obtain a portable copy, opt out of sale/targeted advertising/significant automated-decision profiling, and obtain the specific parties to which their data was sold (or the permitted general list). Feasible profiling rights include questioning the result, its reason and reviewing inputs; the express correction-and-reevaluation profiling right is for housing decisions. Explain the internal appeal and Attorney General complaint method. On October 1, 2026, PA26-64 also extends deletion to the specified public-profile information and inferences. Employment-context exclusion remains.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe data categories and purposes; provide secure rights-request methods and appeal instructions, categories of data sold and categories of third parties to which data is sold, and active email or other online contact.
Clearly disclose targeted advertising and sales for targeted advertising. State whether personal data is collected, used or sold to train large language models; state the month and year of the most recent notice update.
Publish a conspicuous Privacy link on the website home page and, for applicable apps, their download/store page and settings or equally accessible location. Provide the notice in the service languages and an accessible format.
Explain consent withdrawal and provide the conspicuous sale/targeted-advertising opt-out link and applicable preference-signal method.
For a retroactive material change, electronically notify affected consumers using reasonable measures and offer a reasonable opportunity to withdraw consent to materially different future collection, processing or transfer of previously collected data.

Timing: Current expanded notice and rights text applies from 2026-07-01 under PA25-113. PA26-64 sections 13-14 operate 2026-10-01; this is separate from the employment-technology deployment threshold of 2027-10-01.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Do not apply the employer-premises monitoring provision automatically to an outside applicant at home. General consumer privacy excludes employment context.
PA26-15 distinguishes material employment decisions from excluded routine task/scheduling/safety uses. Interaction disclosure has an obvious-AI exception.
PA26-100 section 46 uses the consumer definition in CGS 42-515, excluding commercial and employment contexts. It covers a provider doing business in Connecticut that creates, codes or produces an image/audio/video-generating AI system with more than one million monthly users, makes it publicly accessible to consumers for personal use and offers it for a subscription fee. Individual purchaser status alone is insufficient.

PA26-15 sections 7-11 — official enacted PDF downloaded and text reviewed
CGS 31-48d — official current text reviewed
Connecticut Data Privacy Act; Attorney General guidance on employment exclusion and consumer notice duties — official current guide reviewed
CGS 42-515, 42-518 and 42-520; expressly marked versions operative on and after July 1, 2026 — official 2026 supplement retrieved directly and effective-version notes read on 2026-09-13
PA26-64 sections 12-14: retained employment exclusion, additional deletion scope, consent to new incompatible purposes and precise-geolocation-sale prohibition from October 1, 2026 — official enacted act read; no employment-context privacy-rights carveback inferred from earlier bill descriptions
CGS 52-570d(a), private telephonic recording; consent, recorded notification or approximately 15-second tone methods — official current consolidated text retrieved and read on 2026-09-13
PA26-100 sections 46 and 67; replacement subscription definition, key-terms notice and written acceptance; repeal of PA26-15 sections 1 and 33 — official signed act downloaded and reviewed on 2026-09-13, pages 82-84 and 153-154; approved June 2, 2026

Delaware

The common Evidize Privacy Notice applies alongside the information below.

6 Del.C. 1205C independently requires conspicuous privacy information for individual Delaware users of covered commercial online/cloud/app services. DPDPA consumer/employment exclusions do not displace that separate statute.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Online privacy information

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Employee monitoring

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

Online privacy information and employee monitoring have separate notice rules. An employment-data exclusion from the broader consumer privacy law does not remove those separate duties.

Online privacy information

When this applies: Only when the activity and coverage conditions described above apply.

The online policy identifies collection and sharing, any review or correction process, how material changes are announced, its effective date, and how browser tracking signals and third-party tracking are handled.

Timing: Conspicuously available on the online service

Employee monitoring

When this applies: An employer monitors employee phone, email or internet use within the law's scope.

The employer gives the required daily electronic notice or obtains acknowledgement of a one-time written or electronic notice before the covered monitoring.

Timing: Daily electronic notice or one-time written/electronic notice acknowledged before qualifying monitoring

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may access, correct, delete, obtain portable data, obtain categories of recipients, and opt out of sale, targeted advertising and profiling for solely automated legal or similarly significant decisions. Explain internal appeals; a denied appeal response must explain how to complain to the Delaware Department of Justice. These consumer rights exclude ordinary employment-context data and do not replace the separate Delaware online privacy policy.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe the personal-data categories processed and the purposes of processing.
Identify the categories of personal data shared with third parties and the categories of recipients.
Explain the secure request methods and how to appeal a refusal; do not require a new account solely to exercise rights.
Clearly disclose any sale or targeted advertising and explain how to opt out.
Include an active email address or other online contact mechanism. Give a conspicuous website link for sale/targeted-advertising opt-outs and recognize qualifying preference signals.

Timing: Current from 2025-01-01; preference-signal duties from 2026-01-01. Make the consumer notice reasonably accessible, clear and meaningful for the covered processing.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

6 Del.C. 12D-102(8) excludes commercial/employment consumers; 12D-103(c)(11) excludes role-related applicant/employee data. Independent reuse or consumer marketing needs separate assessment.
19 Del.C. 705 employee-monitoring notice is not automatically an outside-applicant rule.

Unresolved research and factual questions

Resolve overlapping 11 Del.C. 1335 and 2402 recording/privacy provisions against actual capture before relying on one-party recording shorthand.
No additional AI-hiring-specific notice identified in this bounded review.

6 Del.C. 1202C and 1205C — official current text reviewed
6 Del.C. 12D-102(8), 12D-103(c)(11), 12D-104 and 12D-106(c)-(e) — official statute or adopted rule text reviewed on 2026-09-13
19 Del.C. 705 — official current text reviewed

District of Columbia

The common Evidize Privacy Notice applies alongside the information below.

DC Code 23-542(b)(3) allows participant interception or prior consent of a participant, subject to the criminal/tortious/injurious-purpose restriction. It does not impose a notice merely for using AI.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

No general employment-credit-report permission is inferred; DC employment-credit restrictions and fair-chance duties must be assessed if those data are introduced.

Unresolved research and factual questions

No additional enacted algorithmic-hiring notice identified in this bounded review. Do not promote proposed algorithmic-accountability bills to binding rules.

DC Code 23-542(a), (b)(3) — official current text reviewed

Florida

The common Evidize Privacy Notice applies alongside the information below.

Covered interception requires prior consent of all parties under section 934.03(2)(d), absent a specific exception. The Digital Bill of Rights consumer definition excludes employment/commercial context and its controller definition has substantial additional thresholds. The sensitive-data sale notice in section 501.715 uses the narrower definition cross-reference 501.702(9)(a)1.-3., not the full controller threshold.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: The general DBOR privacy notice requires the full controller threshold and covered consumer processing. Separately, section 501.715 applies sensitive-data sale consent and its warning to a for-profit person doing business in Florida that collects consumer data or has it collected on its behalf, without the full billion-dollar/specified-business threshold. Ordinary employment/commercial-context data remains excluded from the consumer definition.

Covered consumers may access, correct, delete and obtain portable data; opt out of sale, targeted advertising and significant-decision profiling; opt out of sensitive-data collection/processing and collection through voice/facial recognition. Explain the conspicuously available internal appeal; provide its written outcome and reasons within 60 days. Section 501.707 does not prescribe an Attorney General complaint instruction. Ordinary employment/commercial-context data is excluded; the full DBOR controller definition has a high revenue and specified-business test.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe the personal-data categories processed and the purposes of processing. Identify sensitive data if processed.
Identify the categories of personal data shared with third parties and the categories of recipients.
Explain the secure request methods and how to appeal a refusal; do not require a new account solely to exercise rights.
Clearly disclose any sale or targeted advertising and explain how to opt out.
Update the notice at least annually and provide notice before collecting additional categories or using data for additional purposes.
For a covered controller actually selling sensitive data, use the statutory warning: NOTICE: This website may sell your sensitive personal data. For actual biometric-data sale, use: NOTICE: This website may sell your biometric personal data. Do not display either as a claim that a sale occurs without the applicable facts.
Section 501.715 separately requires the sensitive-data sale warning and prior consumer consent under its broader for-profit/business/collection scope; do not assume the full DBOR revenue threshold exempts that sale. The warning text remains the sensitive-data warning above, not a factual declaration of a sale that has not occurred.

Timing: Current DBOR duties from 2024-07-01 when covered; annual policy updates and notice before new categories/purposes. Broader section 501.715 sensitive-data sale consent scope must be assessed separately from the full controller threshold.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

A consumer statute's reference to employment as a significant decision does not override its employment-context exclusion.
Do not classify every device signal as a recorded communication or every provider as a covered DBOR controller.

Unresolved research and factual questions

If independent consumer use, sale of sensitive data or advertising is added, assess the separate DBOR notice triggers. No additional general AI-hiring notice identified here.

2026 Florida Statutes 934.03(2)(d) — official 2026 text reviewed
2026 Florida Statutes 501.702(8)-(9) — official 2026 text reviewed
2026 Florida Statutes 501.705 — official statute or adopted rule text reviewed on 2026-09-13
2026 Florida Statutes 501.708 — official statute or adopted rule text reviewed on 2026-09-13
2026 Florida Statutes 501.711 — official statute or adopted rule text reviewed on 2026-09-13
2026 Florida Statutes 501.707 — official current text read on 2026-09-13
2026 Florida Statutes 501.715 — official current text read on 2026-09-13

Georgia

The common Evidize Privacy Notice applies alongside the information below.

Audio party-consent and private-place video rules must be distinguished; the Georgia Supreme Court's Cohen case addresses OCGA 16-11-62(2) and 16-11-66(a). Do not use a one-party audio label to approve private visual surveillance.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Unresolved research and factual questions

Verify current consolidated OCGA text and the actual surveillance design before relying on a recording exception.
No additional AI-hiring-specific notice identified; official 2026/local absence review is incomplete, not an exemption finding.

State v. Cohen, S17A1265, November 2, 2017; OCGA 16-11-62(2), 16-11-66(a) — official opinion index and linked court PDF retrieved on 2026-09-13
State v. Cohen, S17A1265 (2017), division 2(a), pages 18-22; OCGA 16-11-62(2), 16-11-66(a) — official court opinion retrieved and read; distinguishes participant communication from private-place video

Hawaii

The common Evidize Privacy Notice applies alongside the information below.

HRS 803-42(b)(3)(A) contains a participant/one-party prior-consent interception exception, with criminal/tortious-purpose limits. Private-place visual recording requires a separate privacy assessment.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

AI companion or healthcare bills are not employment-notice rules simply because they mention AI.

Unresolved research and factual questions

No hiring-specific AI notice identified in this bounded review. Reclassify any conversational product if it becomes an AI companion; this hiring review does not approve that separate use.

HRS 803-42(b)(3)(A) — official current text reviewed
2026 passed-bill index, AI companion subject — official legislative index reviewed; passage is not treated as signed-act proof

Idaho

The common Evidize Privacy Notice applies alongside the information below.

Idaho Code 18-6702(2)(d) permits interception where a party gave prior consent; subsection (e) prohibits interception for a criminal purpose. The reviewed rule is activity-specific, not a generic AI notice requirement.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Unresolved research and factual questions

No additional AI-hiring-specific notice identified in this bounded review; local and sector-specific rules are not certified absent.

Idaho Code 18-6702(2)(d)-(e) — official live HTML retrieved and text reviewed

Illinois

The common Evidize Privacy Notice applies alongside the information below.

IHRA 2-102(L)(2) requires notice that an employer uses AI for the listed employment purposes. The statutory recipient wording is employee; agency rules are assigned timing, means and circumstances. Separately, Illinois-position AI video interviews and actual BIPA biometric collection have concrete pre-activity rules.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

AI used for employment purposes

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

AI analysis of recorded video interviews

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Biometric collection and storage

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Illinois requires employers to notify employees when AI is used for the employment purposes covered by its law. AI analysis of recorded video interviews and collection of identifying biometric information have separate advance information and permission requirements.

AI used for employment purposes

When this applies: Only when the activity and coverage conditions described above apply.

The Illinois statute requires notice to employees when AI is used for the employment purposes it covers. It leaves the timing and method to agency rules. The proposed timing and notice rules were withdrawn on June 26, 2026; their proposed annual and 30-day periods are not binding law. The notice describes the employer's actual AI use.

Timing: Statutory duty effective 2026-01-01; May 2026 proposal withdrawn on 2026-06-26

AI analysis of recorded video interviews

When this applies: An employer asks an applicant to submit a recorded video interview and uses AI to analyze it for an Illinois-based position.

Before asking for recorded video submissions, the employer must arrange the required notice, explanation and consent. Before the interview, the applicant is told that AI may analyze it, how the AI works and what general characteristics it evaluates, and gives consent to that described AI evaluation. Consent obtained only after the interview is too late for this requirement.

Timing: Before requesting/submitting the covered interview and before the interview

Biometric collection and storage

When this applies: The activity collects or receives biometric identifiers or information covered by Illinois law.

Before collection, a written notice explains the specific purpose and retention period, and the organization obtains the required written release. Its public retention and destruction policy is separate from ordinary video or device-screening information.

Timing: Before collection/capture/receipt

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Do not treat all video as BIPA biometric geometry or every security scan as an AI video interview.
The May 15, 2026 proposed AI timing/applicant rules were withdrawn in the June 26 Register. Proposed annual and 30-day notice periods are not binding requirements.

Unresolved research and factual questions

720 ILCS 5/14-1 and 14-2 private-conversation recording classification is separate; actual consent cannot be replaced by a resume-processing acknowledgement.
Criminal conviction-record decisions have separate IHRA notice duties if introduced; the current resume/integrity notices are not a criminal-screening package.

775 ILCS 5/2-101, 2-102(L) — official current text reviewed
820 ILCS 42/5 — official indexed text reviewed; direct retrieval intermittent
740 ILCS 14/15; read with 14/10 — official current indexed text reviewed
IDHR current rules index, Part 2520 — official live index reviewed; no adopted AI timing provision established by this retrieval
May 15, 2026 proposed AI employment rules — official proposed-rule notice reviewed, not binding final text
50 Ill. Reg. 8755 (June 26, 2026), withdrawal of proposed Part 2520 amendments — official withdrawal text read; includes proposal citation and withdrawn sections
50 Ill. Reg. 10626-10627, July 2026 regulatory agenda, Part 2520 — official agenda read; projected November first notice is not adoption
2026 Register issues 27-37, July 6 through September 11 — all 11 issues searched for Part 2520 after withdrawal; only July regulatory agenda and unrelated numeric matches found

Indiana

The common Evidize Privacy Notice applies alongside the information below.

IC 24-15 excludes commercial/employment-context consumers. Current interception definition IC 35-31.5-2-176 concerns acquisition by someone other than sender/receiver without their consent; the former 35-33.5-1-5 was repealed in 2012. Do not apply an audio/communication exception to unrelated-device or private visual capture.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may access and correct inaccuracies in data they previously provided, delete data provided by or obtained about them, obtain a portable copy or representative summary of previously provided data, and opt out of sale, targeted advertising and significant-decision profiling. Respond within 45 days, with a justified 45-day extension notice during the initial period. Explain the internal appeal; respond to an appeal within 60 days and provide an Attorney General complaint method when denied. Employment and commercial context are excluded.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe the personal-data categories processed and the purposes of processing.
Identify the categories of personal data shared with third parties and the categories of recipients.
Explain the secure request methods and how to appeal a refusal; do not require a new account solely to exercise rights.
Clearly disclose any sale or targeted advertising and explain how to opt out.

Timing: Current from 2026-01-01. Give a reasonably accessible, clear and meaningful notice with secure request methods and conspicuous sale/advertising disclosures.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

The general consumer notice is not automatically an applicant notice; separately assess independent website/consumer processing and statutory thresholds.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified; this is not an exhaustive 2026 local-law clearance.

Attorney General consumer-privacy explanation, effective date and rights — official guide reviewed; employment exclusion not established by this guide alone
IC 24-15, particularly 24-15-2-8 — official current-code entry point; initial client-rendered retrieval gap closed by the separately cited 2026 browser-rendered full statute
IC 24-15-2-8, 24-15-3-1, 24-15-4-3 through -5, 24-15-11-1 — official 2026 code rendered in legislative browser; actual notice, rights, exclusion and preemption text read
IC 35-31.5-2-176; IC 35-33.5-1 repeal by P.L.114-2012 section 72 — official 2026 code rendered and read; replaces obsolete 35-33.5-1-5 citation

Iowa

The common Evidize Privacy Notice applies alongside the information below.

The current 2026 consumer-privacy code excludes employment/commercial context and role-related applicant data. Interception has a participant/one-party-consent exception, subject to improper-purpose limits.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may confirm/access, delete data they provided, obtain a portable copy of provided data subject to the statutory limits, and opt out of sale. Iowa does not add general correction or significant-decision profiling opt-out rights in section 715D.3. Section 715D.4 separately requires sale/targeted-advertising disclosure and an opt-out method, plus the sensitive-data notice/opt-out. Explain internal appeals and the Attorney General complaint method after denial. Ordinary employment context is excluded.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe the personal-data categories processed and the purposes of processing.
Identify the categories of personal data shared with third parties and the categories of recipients.
Explain the secure request methods and how to appeal a refusal; do not require a new account solely to exercise rights.
Clearly disclose any sale or targeted advertising and explain how to opt out.
Before processing nonexempt sensitive data, provide clear notice and an opportunity to opt out; this statute uses this notice/opt-out rule rather than a general sensitive-data opt-in consent requirement. Known-child processing follows COPPA.

Timing: Current from 2025-01-01. Sensitive-data notice and opt-out must precede that processing. Request response is 90 days, with one justified 45-day extension notice; appeal response is 60 days.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

715D consumer privacy notices and sensitive-data choices are conditional on non-exempt consumer processing, not ordinary applicant data by residence alone.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified in the bounded review; independent consumer/advertising uses require separate scope assessment.

2026 Iowa Code 715D.1(7), 715D.2(3), 715D.4 — official current consolidated code reviewed
808B.2(2)(c) — official current text reviewed
2026 Iowa Code 715D.1(7), 715D.2(3), 715D.3, 715D.4(2), (5)-(7) — official statute or adopted rule text reviewed on 2026-09-13

Kansas

The common Evidize Privacy Notice applies alongside the information below.

KSA 21-6101 governs privacy intrusions, including private conversations and concealed private-place recording. Assess the actual participants, consent and capture; the provision does not impose a generic AI notice.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Unresolved research and factual questions

No additional AI-hiring-specific notice identified in this bounded review; private visual capture and actual report data require their separate classifications.

KSA 21-6101(a) — official current text reviewed

Kentucky

The common Evidize Privacy Notice applies alongside the information below.

The 2026 consumer-privacy definition excludes commercial/employment context; that exclusion remains in the enacted July 2027 definition. Eavesdropping concerns private communications of others without at least one party's consent.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may access, correct, delete, obtain portable data they provided and opt out of sale, targeted advertising and significant-decision profiling. Explain internal appeals and the Attorney General complaint method following denial. Request response is 45 days with a justified 45-day extension notice; appeal response is 60 days. Ordinary employment/commercial context is excluded.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe the personal-data categories processed and the purposes of processing.
Identify the categories of personal data shared with third parties and the categories of recipients.
Explain the secure request methods and how to appeal a refusal; do not require a new account solely to exercise rights.
Clearly disclose any sale or targeted advertising and explain how to opt out.

Timing: Current from 2026-01-01. The separate July 1, 2027 ACR rules concern the defined smart-media/ACR activity; they do not turn ordinary hiring scans into ACR.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Do not require consumer sensitive-data consent for ordinary applicant data solely by importing the consumer regime; unrelated consumer processing still needs assessment.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified. A smart-monitor/media service would require reassessment of the future ACR provisions; ordinary hiring software is not presumed to be one.

KRS 367.3611(7), current through June 2027 — official current text reviewed
KRS 367.3611(8), effective July 2027 — official enacted future text reviewed
KRS 367.3611-.3629 notice and effective-date explanation — official current guide reviewed
KRS 526.010 — official current text reviewed
KRS 367.3615 rights and appeals; effective January 1, 2026 — official statute or adopted rule text reviewed on 2026-09-13
KRS 367.3617(3)-(5), required privacy notice and sale/targeted-advertising disclosures — official statute or adopted rule text reviewed on 2026-09-13

Louisiana

The common Evidize Privacy Notice applies alongside the information below.

RS 15:1303(C)(4) permits participant/one-party-consent interception, subject to criminal/tortious/injurious-purpose restrictions. RS 9:3571.1 concerns actual credit reports, including certain free-copy rights after employment denial; it is not automatically a qualification-score rule.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Unresolved research and factual questions

No additional AI-hiring-specific notice identified. Proposed algorithmic credit legislation was not treated as enacted law; classify actual credit use if added.

RS 15:1303(C)(4) — official current text reviewed
RS 9:3571.1 — official current text reviewed

Maine

The common Evidize Privacy Notice applies alongside the information below.

Current 10 MRSA 1309 incorporates federal FCRA duties; older chapter 210 investigative-report sections 1314/1316 are repealed. The reviewed interception definition turns on authorization of a sender or receiver. LD1822 did not enact a general consumer privacy regime.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Do not apply the failed LD1822 text as law; ISP-specific privacy duties are not automatically SaaS duties.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified. Local government facial-recognition prohibitions do not establish private-platform permission or a candidate notice exemption.

10 MRSA 1309 — official current text reviewed
2013 Public Law chapter 228, replacement/repeal of former FCRA provisions — official enacted law reviewed
15 MRSA 709 — official current text reviewed
132nd Legislature LD1822 final disposition — official current status reviewed

Maryland

The common Evidize Privacy Notice applies alongside the information below.

Labor and Employment 3-717 specifically regulates creating an applicant facial template during an interview. Covered interception ordinarily requires all participants' prior consent. MODPA excludes employment-context individuals and specified role data.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Facial recognition during an interview

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

Creating a facial template during a job interview requires specific written permission. This is different from simply holding a video interview or reviewing a resume. General consumer privacy rules do not automatically apply to ordinary applicant records.

Facial recognition during an interview

When this applies: The employer creates a facial template during an interview.

A signed permission document must include the applicant's name, interview date, consent to facial recognition and whether the applicant read the document.

Timing: Before creating the facial template

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may access, correct, delete unless law requires retention, obtain a portable copy, obtain categories of recipients, and opt out of sale, targeted advertising and solely automated significant-decision profiling. Explain internal appeals and the Maryland Consumer Protection Division complaint method after denial. Request response is 45 days with a justified 45-day extension notice; appeal response is 60 days. Ordinary employment-context data is excluded.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe categories of personal data, including sensitive data, and the processing purposes.
Explain rights-request methods, appeals and consent revocation; provide an active email address or other online controller contact.
Identify shared-data categories, including sensitive data, and describe recipient categories by type, business model or processing.
Clearly disclose sale, targeted advertising or significant-decision profiling and the opt-out method; prominently state whether the data is sold or shared with third parties.

Timing: MODPA effective 2025-10-01; its application to processing began after 2026-04-01. Provide the reasonably accessible, clear and meaningful notice for covered processing.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

An ordinary video, without creating a facial template, does not itself trigger 3-717. MODPA exclusion does not remove the interview-waiver or interception rules.

Unresolved research and factual questions

Assess local restrictions, including any applicable private facial-recognition prohibition, before enabling facial recognition; a waiver is not an exemption from a separate prohibition.

Labor and Employment 3-717 — official current text reviewed
Courts and Judicial Proceedings 10-402(c)(3) — official current text reviewed
MODPA employment exclusion and covered-controller explanation; Commercial Law 14-4701 et seq. — official current Attorney General guidance reviewed
Commercial Law 14-4705(b)-(f), rights and appeal notices — official statute or adopted rule text reviewed on 2026-09-13
Commercial Law 14-4707(d)-(f), privacy notice contents and opt-outs — official statute or adopted rule text reviewed on 2026-09-13

Massachusetts

The common Evidize Privacy Notice applies alongside the information below.

Chapter 272 section 99's interception definition concerns secret recording without prior authority of all parties; do not state that every openly known recording invariably requires a particular signed form. Chapter 93 section 53 adds pre-procurement investigative-report requirements.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Investigative employment reports

When this applies: Only when the activity and coverage conditions described above apply.

Before the report is requested, the employer explains the investigation's nature and extent, the right to a copy, and obtains written permission. A requested copy is supplied when the report is completed.

Timing: Before requesting the report

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Actual investigative consumer-report classification is required; not every directly supplied resume is an investigative report.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified in this bounded review. CORI/criminal-history use, if added, requires a separate package; this guide does not approve it.

Chapter 272 section 99(B)(4), (C) — official current text reviewed
Chapter 93 section 53 — official current text reviewed

Michigan

The common Evidize Privacy Notice applies alongside the information below.

Michigan distinguishes eavesdropping on private conversations from private-place visual recording. Section 750.539d independently concerns recording/observing a private place without the consent of persons entitled to privacy.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Do not translate disputed/statutory participant-eavesdropping shorthand into permission for a third-party platform to record all private communications.

Unresolved research and factual questions

The official January 2026 legislative compilation text is now retrieved through its index. Current consolidated endpoint still returns 403; verify any subsequent amendments and participant-case application before adding communication recording. Third-party/private-place capture is not approved by a participant label.
No additional AI-hiring-specific notice identified; current local/enactment absence review is not certified complete.

MCL 750.539d — official indexed current text reviewed
Current criminal jury-instruction index identifies MCL 750.539c / instruction 41.2 — official index reviewed; not a substitute for a complete statutory/case-law interpretation
MCL 750.539a, 750.539c and 750.539d — official legislative PDF indexed text read; rendered January 16, 2026, through PA74 of 2025; current page direct requests return 403

Minnesota

The common Evidize Privacy Notice applies alongside the information below.

Chapter 325M consumer privacy excludes commercial/employment context and role-related applicant data. Chapter 13C independently adds employment-report disclosures. Interception has a party-consent exception under 626A.02.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Employment reports and your free copy

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

When additional notices apply

Employment reports and your free copy

When this applies: Only when the activity and coverage conditions described above apply.

The written notice explains the report and the right to information about its nature and extent. It includes a checkbox to request a free copy, with dispute and correction information. Extra information applies to investigative interviews.

Timing: Before obtaining the employment report; requested copy sent by the agency within 24 hours of furnishing it to the employer

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

Covered consumers may access categories, correct, delete, obtain portable data they provided, obtain a list of specific third parties receiving their data (or the permitted general list), and opt out of sale, targeted advertising and significant-decision profiling. They may question a profiling result, learn its reasons and feasible actions that could change it, inspect inputs, correct inaccurate data and have the decision reevaluated. Explain appeals and Attorney General complaint instructions. Requests normally receive a 45-day response; appeals a 45-day response with a permitted 60-day extension. Ordinary employment-context data is excluded.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Describe data categories and each category’s purposes, sold/shared categories and recipient categories; provide active email or other online contact.
Explain all rights, request and appeal methods, the retention policy and last-update date.
Clearly disclose sale, targeted advertising and significant-decision profiling. Offer a clear opt-out outside the policy as well as applicable preference-signal choices.
Provide a conspicuous home-page Privacy link and, for apps, a download/store-page and settings link; use the service languages and an accessible format.
Notify affected consumers of material changes and give a reasonable opportunity to withdraw consent before materially different future collection, use or transfer of previously collected data.

Timing: Current from 2025-07-31 for the scoped private platform/controller; a separate delayed rule for regulated postsecondary institutions is outside this private-hiring scope.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Coverage limits

Privacy employment exclusions do not remove chapter 13C. An actual consumer/investigative report is required to trigger report notices.

Unresolved research and factual questions

No additional AI-hiring-specific notice identified; independent consumer/advertising processing needs its own privacy classification.

325M.11(g), 325M.12(b)(13), 325M.16 — official current text and 2026 amendment flags reviewed
13C.02 subdivisions 1-3 — official current text reviewed
626A.02 subdivision 2(d) — official current text reviewed
325M.14 subdivisions 1-5: specific recipients, profiling explanation/reevaluation, requests and appeals — official statute or adopted rule text reviewed on 2026-09-13
325M.16 subdivision 1: privacy notice contents, retention policy, material changes, publication and accessibility — official statute or adopted rule text reviewed on 2026-09-13

Mississippi

The common Evidize Privacy Notice applies alongside the information below.

Federal employment consumer/investigative-report notices remain conditional. Mississippi interception provisions 41-29-501 et seq. require a current official-text check for the precise feature.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Unresolved research and factual questions

Current official consolidated 41-29-531(e) remains unavailable from the publisher agreement-gated library. The 2004 passed-bill text confirms historical party/prior-consent language and criminal/tortious/injurious-purpose limits, but its repealer prevents using that source alone as current authority. No recording exception is approved by this record.
No additional AI-hiring notice established from official current materials in this pass; this row is review-incomplete, not an all-clear.

Proposed historical amendment to 41-29 interception provisions — official proposal identified only; not relied on as current law or as an exception
Secretary of State identifies LexisNexis as official code publisher — official current page and its public-access library opened; statutory search is behind an agreement acceptance prompt, which was not accepted
2004 HB399 as passed, section 16 reprints 41-29-531(e); section 20 then sets a 2006 repealer — official passed-bill PDF retrieved and read; historical party/prior-consent exception text confirmed, but not relied on to establish current 2026 law or continued authority

Missouri

The common Evidize Privacy Notice applies alongside the information below.

RSMo 542.402's participant/one-party-consent exception is worded for wire communications and includes improper-purpose limits. Evaluate oral, wireless and visual capture separately instead of describing every feature as one-party recording.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary source notice content recheck with explicit conditional limits

Unresolved research and factual questions

No additional AI-hiring-specific notice identified in this bounded review; local/private-surveillance coverage is not certified absent.

RSMo 542.402.1-.2, especially 2(3) — official current text reviewed

Montana

The common Evidize Privacy Notice applies alongside the information below.

Hidden recording of a conversation requires all-party knowledge; advance warning is a stated exception. Where the state investigative-report disclosure route applies, notice is written within three days of the first report request and explains investigation-detail request rights. The state provision has an alternative for employment for which the person applied; federal duties remain separate. Report-based adverse employment action requires reporting-agency identification. Covered consumer processing needs an accessible privacy notice, including updates and material-change information.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception notice

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Investigative employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Report-based adverse decisions

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Investigative employment reports

When this applies: A covered investigative consumer report is requested under Montana law. The state has a specific employment exception explained below; federal report requirements remain separate.

Where this state notice route applies, the person requesting the investigative report explains it in writing and tells you how to request the investigation details. Montana has a specific exception for a report used for employment for which you applied; that state exception does not waive separate federal disclosure and authorization duties.

Timing: Within three days after first request

What you can do: Ask the employer which report is being requested and use the request instructions in its actual report notice. The separate federal employment-report information below still matters.

Report-based adverse decisions

When this applies: Only when the activity and coverage conditions described above apply.

If a covered report contributes to an adverse employment decision, the notice identifies the reporting agency. The separate federal steps before an adverse decision still apply.

Timing: Adverse employment action

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Separate covered consumer processing; employment exclusion does not clear advertising or independent consumer services.

Covered consumers may confirm/access data, correct inaccuracies, delete data, obtain a portable copy of data they provided, and opt out of sales, targeted advertising and significant automated profiling. Explain authorized-agent opt-outs. Respond within 45 days, with a justified notified 45-day extension; decide appeals in writing within 60 days and provide the Attorney General complaint route after denial.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Explain processed personal-data categories and purposes, categories sold or shared and recipient categories, secure rights-request and appeal routes, active contact and last-update date. Publish an accessible privacy link in each service language and relevant website/app locations. Clearly disclose sale or targeted advertising and the opt-out route; notify affected consumers of material changes and allow the required consent withdrawal opportunity.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

MCDPA excludes employment/commercial context; its sensitive-data requirements do not automatically cover applicant-role data. Recording and reporting duties are separate.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Apply the amended controller thresholds and exemptions to actual non-employment processing; do not reuse the original 2024 thresholds.

45-8-213(1)(c), warning exception (iii) — official primary text reviewed
31-3-113 investigative reports — official primary text reviewed
31-3-131 adverse action — official primary text reviewed
30-14-2802 consumer definition — official primary text reviewed
30-14-2812 privacy notice — official primary text reviewed
MCDPA and October 2025 amendments — Attorney General guidance
30-14-2808 rights, requests, appeals; 2025 amended text — official primary text reviewed September 13, 2026

Nebraska

The common Evidize Privacy Notice applies alongside the information below.

Interception exception permits a participant or one party’s prior consent, subject to unlawful-purpose limits. Covered consumer controllers need meaningful privacy notices and rights/appeal methods. Future public conversational AI notices depend on the final statutory definition and actual interface.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Separate public conversational AI services

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Separate public conversational AI services

When this applies: A separate public conversational AI service falls within the law's definition and is not covered by an exclusion.

From July 1, 2027, covered services must disclose AI interaction when a reasonable person could otherwise be misled. The law contains business and narrow-topic exclusions and additional requirements involving minors.

Timing: From July 1, 2027

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Business/processing must satisfy 87-1103 and exemptions; classify separate website or consumer-service data.

Covered consumers may confirm/access, correct, delete, obtain a portable copy of data they supplied, and opt out of sales, targeted advertising and significant profiling. Explain authentication and the request route. Requests receive a response within 45 days, with one justified notified 45-day extension; appeals receive a written decision within 60 days and a denied appeal includes an Attorney General complaint mechanism.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

State processed categories, including sensitive data, purposes, shared categories and recipient categories, each rights-request method and the appeal process. Prominently explain any sale or targeted advertising and how to opt out.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

Employment/commercial consumers and applicant-role data are excluded from general consumer privacy coverage. Small-business and other statutory exemptions require separate facts.
Workplace account-access prohibitions cannot be cured by obtaining a blanket waiver. Employer-network exceptions do not authorize every scan of a candidate’s personal device.
LB525 excludes narrow-topic, embedded-feature, primarily business-marketed, internal-business and specified customer-service applications.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.

86-290(2)(c) — official primary text reviewed
87-1102 definitions — official primary text reviewed
87-1113 privacy notice contents — official primary text reviewed September 13, 2026
Workplace Privacy Act, 48-3503 to 48-3504 — official primary text reviewed
2026 LB525, sections 13-15 and 19, final slip law — official primary text reviewed
87-1107 consumer rights — official primary text reviewed September 13, 2026
87-1108 response rules — official primary text reviewed September 13, 2026
87-1109 60-day controller appeal and Attorney General complaint — official primary text reviewed September 13, 2026
87-1114 sale/targeted-advertising disclosure — official primary text reviewed September 13, 2026

Nevada

The common Evidize Privacy Notice applies alongside the information below.

Internet-operator notices under 603A.340 depend on operator and personal/family/household consumer definitions. They address categories, sharing, changes, tracking, effective date and available amendment mechanisms; sales opt-out provisions are separate. Wire and private oral recording use different statutory tests; do not treat a generic one-party rule as telephone-call clearance.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Online privacy information

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Separate consumer health services

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Online privacy information

When this applies: Only when the activity and coverage conditions described above apply.

For an operator and consumer covered by Nevada law, the accessible notice describes collection and disclosure categories, any review or correction process, material-change notification, third-party collection across websites and its effective date. The consumer definition concerns seeking or obtaining products or services for personal, family or household purposes; ordinary hiring or business use is not automatically covered. Any applicable sale opt-out method is separate.

Timing: Website collection

Separate consumer health services

When this applies: The service actually processes consumer health information covered by Nevada's separate law.

A separate health-data privacy notice and any required collection or sharing permissions must be provided. Ordinary employment records must be classified separately; an accommodation request does not automatically make every health-data rule apply.

Timing: Before covered health collection

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Covered Nevada internet operator and personal/family/household consumer transaction under NRS603A.310/.330/.338; assess the distinct consumer-health regime separately.

The internet-operator provisions provide verified no-sale requests and a response within 60 days, extendable by 30 days with the prescribed notice. They do not create omnibus access, deletion or correction rights; describe any offered review/correction process accurately. Consumer-health rights are separate and broader, including confirmation, recipient lists, cessation of collection/sharing/sale, deletion and appeal under NRS603A.505-.520.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

The internet-operator notice identifies collected covered-information categories and recipient categories, any available review/correction process, the material-change notification process, cross-site third-party collection and the effective date. Make the designated no-sale request address available. A covered consumer-health service needs the separate health-data policy described in its notice entry.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

The website statute’s household-purpose definition is distinct from the consumer-health statute’s express employment exclusion. Do not interchange them.
Consumer-health notice/permission applies only to covered consumer health data and covered entities; applicant-role exclusion is not a universal biometric exemption.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Determine operator exemptions and actual health/biometric inferences; assess every participant location and recording mode before collection.

603A.310-.345; 603A.425 and .495-.500 — official primary text reviewed
200.620 and 200.650 — official primary text reviewed
Telephone consent interpretation in enactment explanatory text — official session-law explanation; current statute also reviewed
NRS603A.310-.345 internet notice/no-sale; .425/.490 health scope; .495-.520 health policy and rights — official current text revised April 15 2026 reviewed

New Hampshire

The common Evidize Privacy Notice applies alongside the information below.

Covered private oral/telecommunication interception generally needs all parties’ consent. The state credit-reporting law adds written investigative-report and scope-rights information. A covered consumer controller needs the Chapter 507-H privacy and rights/appeal disclosures.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Investigative employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Investigative employment reports

When this applies: The state investigative-report notice rule applies; it has an exception for employment for which you have not specifically applied. Federal report requirements remain separate.

The person requesting the investigative report supplies the required written notice and explains how you can request its nature and scope. The three-day notice period runs from when that person first requests the report, not from your later request for a copy.

Timing: Within three days after first request

What you can do: To learn what the investigation covers, send the written request described in the report notice to the person who requested the report.

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: 35,000 consumers excluding payment-only data, or 10,000 with over 25% gross revenue from sales, subject to entity/data exemptions.

Covered consumers may confirm/access, correct, delete, obtain portable data, and opt out of sales, targeted advertising and profiling for solely automated significant decisions. Explain authorized-agent opt-outs. Requests receive a response within 45 days, with a justified notified 45-day extension; appeals receive a written decision within 60 days and a denied appeal includes an Attorney General complaint route.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Give accessible personal-data categories, purposes, shared categories and recipient categories, rights-request and appeal instructions, active email or online contact, and last-update date. Clearly disclose sales or targeted advertising and the opt-out route, including the applicable website link and preference signal.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

Chapter 507-H excludes employment/commercial roles and applicant-role data. Chapter 359-N biometric restrictions concern state agencies; they are not a general private-employer consent mandate.
The state investigative-report notice rule has an alternative for employment for which the person has not specifically applied; this does not remove applicable federal duties.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Narrow criminal-evidence interception exceptions do not create an ordinary interview exception.

570-A:2 interception exceptions — official primary text reviewed
507-H:4 rights/appeals and :6 III-V notice; source also includes 2026 chapter168 future child-sale amendment, operative January1 2027 — official primary text reviewed September 13, 2026
359-B:6, :9, :13 and :15 — official primary text reviewed
359-N biometric restrictions — official primary text reviewed

New Jersey

The common Evidize Privacy Notice applies alongside the information below.

One participant’s prior consent can satisfy the private interception exception unless the purpose is criminal, tortious or otherwise injurious. Before requesting a covered investigative report, give precise nature/scope and copy-right information and obtain written authorization; the state timing is earlier than the federal three-day investigative deadline.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Investigative employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Investigative employment reports

When this applies: Only when the activity and coverage conditions described above apply.

Before requesting the investigative report, the employer explains the investigation's precise nature and extent, your copy rights, and obtains written authorization.

Timing: Before report request

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: 100,000 consumers excluding payment-only processing, or 25,000 and revenue/discounts from sales, plus statutory nexus and exemptions; no invented percentage threshold.

Covered consumers may confirm/access, correct, delete, obtain portable data and opt out of sales, targeted advertising and significant profiling, including applicable authorized-agent requests. Respond within 45 days, with a justified notified 45-day extension. A controller appeal requires a written decision within 45 days; denial must include a Division of Consumer Affairs complaint route. A new account cannot be required merely to exercise rights.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

State processed categories, purposes, shared categories and third-party categories, rights and appeal instructions, controller contact, material-change notification process, notice effective date and active email/online contact. Clearly disclose sales, targeted advertising or significant profiling and how to opt out.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

Privacy consumer definition excludes employment and commercial roles.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Confirm currently operative implementing rules for the selected non-employment processing; do not render introduced A4730 (2026) as enacted law.

2A:156A-4(d) — official primary text reviewed
56:8-166.6 notice, .7 request and 45-day appeal, .10 rights, .11 authorized agents — official enacted HTML fetched and reviewed September 13, 2026
56:11-33 investigative disclosure and authorization — official primary text reviewed

New Mexico

The common Evidize Privacy Notice applies alongside the information below.

HB28’s proposed general AI notice and appeal scheme did not become law in the 2026 session. Federal employment-report packages remain conditional on actual report classification. This entry does not establish recording or website-data clearance.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Unresolved research and factual questions

Official current compilation access for NMSA30-12-1 remains blocked (403). The historical party-consent rule is not certified against current text here; actual recording remains a pre-activation legal review item. HB214 and HB28 died, so their proposed notices are not binding.
Deployment-specific municipal rules and actual communication/privacy expectations still require identification; this is not a statewide exemption.

2026HB28 Artificial Intelligence Transparency Act; died — official bill status reviewed; proposal is not current notice law
Credit Report Security Act amendments — enacted text; freeze provisions are not a general investigative-report notice
2026HB214 Consumer Information Privacy Act; action postponed indefinitely, died — official bill status reviewed; proposed dates are not operative law
NMSA30-12-1 current compilation — official portal returned403; current section text not retrieved, not claimed verified

New York

The common Evidize Privacy Notice applies alongside the information below.

NY employee electronic-monitoring notice is given upon hire, acknowledged and posted; applicant AEDT duties are separate. NYC covered AEDT use requires public audit information and, for NYC-resident candidates/employees, use/qualifications notice at least ten business days before use, alternative/accommodation request information, and data-source/type/retention information through the specified website/request route. Employment and investigative reports trigger state disclosures, and criminal-conviction reports require Article 23-A information. NYC criminal-history adverse decisions have their own analysis, copy and response process.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employee monitoring

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

New York City advance automated hiring notice

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

New York City information requests

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

New York City automated hiring tool audit information

Employer: The employer or other covered organization must complete the notices, audit, publication, response or monitoring obligations described here when its actual use is covered.

Employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Criminal-history employment reports

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

New York City criminal-history decisions

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

New York City has special rules for certain automated hiring tools. Coverage depends on the job or employment agency, the tool's actual use and, for the individual notice, the person's residence. Separate statewide rules cover certain monitoring and employment reports.

Employee monitoring

When this applies: The employer conducts covered employee phone, email or internet monitoring.

The employer gives a notice and obtains acknowledgement upon hire, and keeps the required notice posted for employees.

Timing: Upon hire and posted

New York City advance automated hiring notice

When this applies: The tool and screening use are covered by New York City law and the applicant or employee is a New York City resident.

The notice identifies automated screening and the qualifications or characteristics it assesses. It explains how to request an alternative process or accommodation. A qualifying website notice can satisfy the advance period before a later application arrives.

Timing: At least ten business days before use

New York City information requests

When this applies: Only when the activity and coverage conditions described above apply.

The employer or employment agency publishes on its employment website the types and sources of data and its retention policy, and instructions for making a written request. It supplies the requested information within 30 days. If information is withheld under a legal exception, it explains why. These information duties are separate from the advance automated-use notice.

Timing: Publish the employment-website information and written-request instructions; respond within 30 days of a written request.

New York City automated hiring tool audit information

When this applies: Only when the activity and coverage conditions described above apply.

The employer makes the required independent bias-audit summary and tool-distribution information publicly available. A recent audit and continued access to its public information are separate requirements.

Timing: Before use and six months after last use

Employment reports

When this applies: Only when the activity and coverage conditions described above apply.

Before a covered employment report is obtained, the employer gives the required state notice and provides reporting-agency information on request. Separate restrictions determine whether credit information may be used at all.

Timing: Before procurement

Investigative employment reports

When this applies: Only when the activity and coverage conditions described above apply.

Before the report is requested, the employer gives the required notice, obtains authorization and explains applicable inquiry and copy rights. A written application requires the written notice route.

Timing: Before procurement

Criminal-history employment reports

When this applies: Only when the activity and coverage conditions described above apply.

Where the relevant report and employment-offer rules apply, the person receives New York Correction Law Article 23-A, which addresses employment decisions involving prior convictions.

Timing: With applicable offer and criminal report

New York City criminal-history decisions

When this applies: Only when the activity and coverage conditions described above apply.

Before a covered criminal-history decision, the employer provides the inquiry and written assessment, allows at least five business days after receipt to respond, and follows the required final-decision process.

Timing: Before criminal history adverse action

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

52-c employee monitoring is not a universal pre-hire candidate acknowledgement law; generic maintenance/protection processes have a narrow exception.
NYC AEDT job/employment-agency nexus and actual tool function matter; the ten-day applicant notice has a NYC-residence condition. A New York headquarters alone neither establishes nor eliminates every duty.
LL144 does not independently require granting every requested alternative. Credit-report bans/exceptions cannot be cured by a notice.

Unresolved research and factual questions

Verify NYC commercial-establishment customer biometric signage against the current code before applying it to a job applicant; introduced expansion bills are not current-law proof.
Other New York local criminal-history and credit restrictions need deployment-specific review.

Civil Rights Law 52-c electronic monitoring — official primary text reviewed
Penal Law 250.00 recording/interception definitions — official primary text reviewed
Local Law 144 / Admin. Code 20-871 and implementing rule — official agency interpretation of nexus, notice and audit requirements
NYC Admin. Code 20-870 to 20-874 — city code publisher
380-b employment report restrictions; current revision April 24, 2026 — official primary text reviewed
380-c prior investigative disclosure/authorization — official primary text reviewed
380-g(d) Article 23-A copy — official primary text reviewed
NYC Fair Chance written analysis, inquiry copy and five-business-day response — official agency guidance

North Carolina

The common Evidize Privacy Notice applies alongside the information below.

15A-287 permits interception with at least one party’s consent. The 2026 Fair AI Hiring Act proposal is not enacted on the reviewed official bill record.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.

15A-287(a) — official primary text reviewed
H1161 Omnibus AI Protection; committee referral May4 2026 — official bill history reviewed; no enactment shown
H462 Personal Data Privacy/Social Media Safety; referred to Commerce April29 2025 — official bill history reviewed; no enactment shown
current General Statutes and session-law index through S.L.2026-30 — official code index reviewed; not certification of every local ordinance
55A Article18 Personal Privacy Protection Act concerns nonprofit associations/public-agency disclosure — official text reviewed; not a universal private-website notice law

North Dakota

The common Evidize Privacy Notice applies alongside the information below.

12.1-15-02 permits a participant or prior consent of one party, subject to unlawful-purpose limits. The reviewed 2026 AI memorandum describes laws in other states; it is not a North Dakota hiring notice enactment.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.

12.1-15-02(3)(c) — official primary text reviewed
2026 legislative AI memorandum — official comparative memorandum, not binding law
51-30 personal-information breach notification — official current code PDF reviewed; incident-triggered, not universal precollection notice

Ohio

The common Evidize Privacy Notice applies alongside the information below.

2933.52(B)(4) supplies a private participant/one-party prior-consent exception subject to criminal, tortious and injurious-purpose limits. It does not itself require a general AI notice.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.

2933.52(B)(4) — official primary text reviewed
Chapter1349 trade practices; privacy/security and sector-specific internet provisions — official current chapter reviewed; sector triggers distinguished from general hiring
1349.19 breach notification — official current section reviewed; incident trigger distinct from precollection notice

Oklahoma

The common Evidize Privacy Notice applies alongside the information below.

Before procuring an employment consumer report, the state written notice includes a checkbox to elect a free copy; transmit that election to the reporting agency. Interception has a participant/one-party prior-consent exception. Enacted SB546 adds covered-consumer privacy notices from January 2027.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment report copy requests

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Employment report copy requests

When this applies: Only when the activity and coverage conditions described above apply.

The employment-report disclosure includes a checkbox to request a free copy. If selected, that request is passed to the reporting agency when the employer requests the report.

Timing: Before procurement

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Future covered consumer processing: 100,000 consumers or 25,000 with over 50% gross sales revenue, subject to statutory nexus/exemptions; inactive before 2027-01-01.

From January 1, 2027, covered consumers may confirm/access, correct, delete supplied or obtained data, obtain a portable copy of supplied digital data, and opt out of sales, targeted advertising and significant profiling. Respond within 45 days, with a justified notified 45-day extension; decide appeals in writing within 60 days and supply an Attorney General complaint route after denial.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

From January 1, 2027, state processed categories including sensitive data, purposes, rights and appeal instructions, and shared categories/recipient categories. Clearly disclose any sale or targeted advertising and the opt-out route. Provide the prescribed secure request methods, with the exclusively-online/direct-relationship email exception assessed separately.

Timing: Future requirement from January 1, 2027; enacted March 20, 2026. It does not apply before that effective date.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

SB546 excludes employment/commercial context and applicant-role data.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Harmonize any legacy state freeze-rights form with current federal law; do not reproduce superseded fees.

24 O.S.148 copy election; 158 state rights text — official primary text reviewed
13 O.S.176.4(5) — official primary text reviewed
2026 SB546 sections 1, 8, 16-17 and 22 — official primary text reviewed
SB546 approved March 20, 2026 — official enactment history

Oregon

The common Evidize Privacy Notice applies alongside the information below.

165.540 distinguishes telecommunications consent from specifically informing all participants in a covered conversation. Where the substantially-job-related credit-history exception is used, disclose the employer’s reasons in writing. Future AI-companion disclosures concern sustained human-like relationship systems, not automatically a business résumé tool.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception notice

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Employment credit reports

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Separate AI companion services

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Employment credit reports

When this applies: Only when the activity and coverage conditions described above apply.

If the employer relies on the exception for credit history substantially related to the job, it gives the reasons for that use in writing.

Timing: Before job related credit use

Separate AI companion services

When this applies: A separate service falls within Oregon's AI companion definition.

From January 1, 2027, covered companion services disclose that output is artificial when it could reasonably be confused with a person and provide the applicable reminders for interactions with minors. This is not a general notice requirement for resume ranking.

Timing: From January 1, 2027

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Covered non-employment processing: 100,000 consumers excluding payment-only transactions or 25,000 and over 25% gross revenue from data sales, subject to exemptions.

Covered consumers may access data and categories, request a list of specific third parties other than natural persons to whom the controller disclosed their data or, at the controller's option, any personal data; correct inaccuracies; delete supplied, obtained and derived data; receive portable data; and opt out of sales, targeted advertising and significant profiling. Requests: 45 days plus a justified notified 45-day extension. Appeals: written decision within 45 days, with Attorney General complaint information after denial.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Identify the controller and registered/assumed business names; processed categories including sensitive data; purposes; shared categories including sensitive data; recipient categories with enough detail about their processing; active contact; secure request/appeal methods; and any targeted-advertising or significant-profiling uses and opt-out route. Clearly provide sale/advertising opt-out access and required preference-signal handling.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

OCPA excludes employment/applicant-role data.
Portland’s private face-recognition restriction depends on a place of public accommodation within the city; notice cannot cure a prohibited use.
The AI-companion definition requires a relationship/companionship design and excludes specified functions; no universal hiring-chatbot notice is inferred.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Check 2026 ORS amendment tables and actual conversation modality/privacy expectations before treating the recording exception as satisfied.

165.540(1)(a), (c) and exceptions — official primary text reviewed
659A.320(2)(d) — official primary text reviewed
OCPA controller coverage and notice duties — Attorney General guidance
employment/applicant exclusion — Attorney General guidance
Portland Code Chapter 34.10 face-recognition restriction — official primary text reviewed
2026 chapter 85, sections 1-2 — official primary text reviewed
ORS646A.574 specific-third-party access, correction, deletion and opt-outs; .576 45-day appeals; .578 privacy notice — official primary text reviewed September 13, 2026

Pennsylvania

The common Evidize Privacy Notice applies alongside the information below.

Covered private wire/oral/electronic interception generally requires all parties’ prior consent. If criminal-history information causes refusal to hire in whole or part, 9125(c) requires written notice. Philadelphia’s amended Fair Chance process requires preliminary decision information, rights and evidence-submission instructions with at least ten business days before final action.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Criminal-history decisions

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Philadelphia criminal-history decisions

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Criminal-history decisions

When this applies: Only when the activity and coverage conditions described above apply.

An applicant is notified in writing when criminal-history information contributes to a refusal to hire.

Timing: Refusal to hire

Philadelphia criminal-history decisions

When this applies: Only when the activity and coverage conditions described above apply.

Before a final covered criminal-history decision, the employer gives the required preliminary notice and rights information, explains what evidence the person can provide, and allows at least ten business days to respond.

Timing: Before final criminal history adverse action

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

Narrow interception exceptions are not blanket remote-interview permission. Criminal-history procedures do not apply merely because an AI security signal exists.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Confirm exact Philadelphia ordinance coverage, response calculation and final-notice template for actual criminal-record use. Separate website/privacy and other local overlays remain open.

18 Pa.C.S.5704(4) — official primary text reviewed
18 Pa.C.S.9125(b)-(c) — official primary text reviewed
Philadelphia Fair Chance amendments, notice/response requirements — official June 2026 enforcement form

Rhode Island

The common Evidize Privacy Notice applies alongside the information below.

11-35-21(c)(3) permits private participant/one-party prior consent subject to unlawful-purpose limits. Chapter 6-48.1 separates website/controller designation and specified data-practice disclosures from the thresholded consumer-rights section; do not impose or remove every website duty using only the rights threshold.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Online data practices

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Separate AI companion services from January 1, 2027

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

When additional notices apply

Covered websites must explain their data practices, including applicable sale and recipient information. Those website notice requirements and broader consumer privacy rights have different coverage rules.

Online data practices

When this applies: Only when the activity and coverage conditions described above apply.

Where the website provision applies to collection, storage and sale of nonexempt customer information, the notice lists collected categories, identifies every third party to whom that information has been sold or may be sold, and provides an active email or online contact method. Recipient categories alone are insufficient for those sale disclosures. Sale and targeted advertising also require conspicuous disclosure when applicable. Employment-role data exclusions and the separate thresholds for broader consumer rights still need to be assessed.

Timing: Covered website processing

Separate AI companion services from January 1, 2027

When this applies: Only when the activity and coverage conditions described above apply.

Clearly notify the user verbally or in writing that they are not communicating with a human. A defined relationship-simulating companion must also provide immediate appropriate crisis-service referrals when suicidal ideation, self-harm or possible harm to others is detected. Customer-service-only, efficiency/research/technical-assistance and solely internal/employee-productivity systems have express exclusions; ordinary ATS analysis is not assumed covered.

Timing: From January 1 2027 at the beginning and at least every 3 hours of continuing covered AI-companion interaction; crisis referral when specified expressions are detected.

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Section 6 for-profit rights threshold is 35,000 consumers excluding payment-only data or 10,000 and over 20% sales revenue; section 3 website duties must be assessed independently.

For section6 covered customers, explain confirmation/access, correction, deletion, portable copies and opt-outs for sales, targeted advertising and significant solely automated profiling, including authorized-agent opt-outs. Requests: 45 days plus a justified notified 45-day extension. Appeals: written decision within 60 days and Attorney General complaint information after denial. Section3 website disclosures have their own trigger and do not automatically establish section6 threshold coverage.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

For the separate section3 website trigger, disclose collected categories, identify all third parties to whom personally identifiable information has been sold or may be sold, and give active email/online contact in the agreement/addendum or customary conspicuous notice location. Clearly disclose sales or targeted advertising. For section6 covered rights, explain secure rights requests and the appeal process; do not replace the specific third-party list with recipient categories.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

Customer definition and applicant-role data exemptions exclude ordinary employment context.
Section 3’s collection/storage/sale trigger and targeted-advertising/sale disclosure need actual facts; it is not a notice requirement for every website with no further conditions.

Unresolved research and factual questions

Classify the actual product against the enacted companion definition before adding that use; no relationship-simulating companion is established by this register.

11-35-21(c)(3) — official primary text reviewed
6-48.1-2 customer definition — official primary text reviewed
6-48.1-3 website/controller notice and exceptions — official primary text reviewed
6-48.1-6 thresholded rights — official primary text reviewed
2026 enacted subject index — official index
2026ch375 §§6-64-1 to -3 and §2; definition, notification and January1 2027 commencement — official primary text reviewed September 13, 2026

South Carolina

The common Evidize Privacy Notice applies alongside the information below.

17-30-30(C) permits a participant or one party’s prior consent, subject to unlawful-purpose limits. H3593’s proposed all-party rule remained a proposal in the official history reviewed.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.

17-30-30(C) — official primary text reviewed
H3593 status — official bill history; not enacted text
H3401 Technology Transparency; referred to Judiciary January14 2025 — official history reviewed; no enactment shown
39-1-90 breach notification — official current code reviewed; incident trigger distinct from precollection notice

South Dakota

The common Evidize Privacy Notice applies alongside the information below.

The reviewed interception provisions distinguish a participant’s presence/consent from interception by an outsider. SB170’s general consumer-chatbot notice proposal was tabled, so it is not an enacted notice trigger.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.
The reviewed 2026 chatbot/minor bills SB168 and SB170 did not enact notice duties. The harmful-content age-verification law has a separate product trigger that is not established for current hiring services.

23A-35A-20 — official current provision; site rendering limited
2006 enacted 23A-35A-20 amendment — historical primary text; current site also checked
2026index: SB168 deferred41st legislative day; SB170 tabled; SB110 deferred41st legislative day — official final legislative index reviewed; bills did not become law
23A-35A-20 recording/interception; party-consent structure — official current statute retrieved and reviewed; latest displayed history2017ch108§16
22-24-69/-70 harmful-to-minors-content age verification and data retention — official current text reviewed; defined harmful-content platform, not ordinary hiring SaaS

Tennessee

The common Evidize Privacy Notice applies alongside the information below.

TIPA requires covered consumer privacy notices with categories, purposes, rights/appeal and sharing information. The private interception exception permits a participant/one-party prior consent subject to unlawful-purpose limits.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Tennessee nexus, over $25 million annual revenue and either 175,000 consumers or 25,000 plus the statutory 50% sales-revenue condition; employment data does not supply an automatic consumer trigger.

Covered consumers may confirm/access, correct, delete supplied or obtained information, obtain a portable copy of information they supplied, and opt out of sales, targeted advertising and significant profiling. Requests: 45 days plus a justified notified 45-day extension. Provide a conspicuous, free appeal route; decide within 60 days in writing and give the Attorney General and Reporter complaint route after denial.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

State processed personal-information categories and purposes, sold categories and categories of purchasers, and how to exercise rights and appeal. Clearly disclose any sale or targeted advertising and the opt-out route. Describe secure request methods without requiring creation of a new account.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

TIPA excludes commercial/employment consumers; separately assess applicant-role data and entity exemptions.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Current statutory amendments to the recording provision should be checked before activating a new collector.

TIPA, 47-18-3301 et seq.; scope and notice — Attorney General current implementation guidance
39-13-601(b)(5) — official appellate opinion quoting recording exception
47-18-3304 and -3305, pages1097-1099, consumer rights and notice — official code compilation text reviewed; current AG implementation guidance separately confirms operation since July 1 2025

Texas

The common Evidize Privacy Notice applies alongside the information below.

TDPSA requires a meaningful privacy notice for covered consumer processing and additional conspicuous language for actual sales of sensitive/biometric data. CUBI ordinarily requires informing and obtaining consent before commercial biometric capture, but the January 2026 amendments add purpose-specific AI exceptions. Do not label all security biometric operations either exempt or consent-required without classification.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Biometric collection

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

Some biometric collection requires advance information and permission. Texas has purpose-specific exceptions, so the actual use must be checked. A security label alone does not decide whether an exception applies. Ordinary employment records and separate consumer uses also have different privacy rules.

Biometric collection

When this applies: Only when the activity and coverage conditions described above apply.

Before covered commercial biometric capture, the person is informed and gives consent. The actual identification, training or security purpose and any later use must be checked against the law's exceptions.

Timing: Before nonexempt commercial capture

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Covered non-employment consumer processing under the state nexus, small-business and entity/data tests; actual sales trigger the extra sensitive/biometric sale notice.

Covered consumers may confirm/access, correct, delete supplied or obtained data, obtain a portable copy of supplied digital data, and opt out of sales, targeted advertising and significant profiling. Requests: 45 days plus a justified notified 45-day extension. Appeals: written decision within 60 days and Attorney General complaint access after denial. Explain the applicable authorized-agent/preference-signal opt-out route and secure request methods.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

State processed categories including sensitive data, purposes, shared categories and recipient categories, rights/appeal procedures and request methods. Prominently disclose sales or targeted advertising and opt-out access. If sensitive or biometric data is sold, display the statute's separate conspicuous sensitive-data or biometric-data sale warning; do not imply such sales occur without facts.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

TDPSA excludes employment/commercial consumers and employment-role data; small-business and other exemptions need actual facts.
CUBI 503.001(e)(2) excludes specified AI activity unless used to uniquely identify a specific individual; (e)(3) excludes specified security/fraud/integrity activity. Later nonexempt commercial use changes the analysis.
TRAIGA’s 552.051 disclosure duties are not a blanket notice statute for every private hiring analysis.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
Verify current Penal Code PDF and actual recording mode before relying on the party-consent exception.

TDPSA, 541.001-.003 and .102-.103 — official primary text reviewed
HB149 amendments to 503.001(b), (b-1), (e)-(f); TRAIGA 552.051 — official primary text reviewed
HB149 enacted history — official primary text reviewed
Penal Code 16.02(c)(4) — official PDF target; current HTML route redirected, exact PDF text requires confirmation

Utah

The common Evidize Privacy Notice applies alongside the information below.

Current 13-77-103 requires supplier disclosure of generative AI in a covered consumer transaction when clearly asked; regulated-occupation high-risk interactions have proactive requirements. This is not a universal notice for internal hiring analysis. Adult sensitive-data processing under UCPA uses clear notice and opportunity to opt out, rather than an invented universal opt-in rule.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

AI interactions in covered consumer services

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

AI interactions in covered consumer services

When this applies: AI interacts with a consumer in a service covered by Utah's law; extra rules apply to certain regulated occupations.

A clear question about AI involvement must receive the required disclosure. Certain higher-risk interactions in regulated occupations require disclosure before the interaction, even without a question.

Timing: At question or before covered high risk interaction

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: At least $25 million revenue and either 100,000 consumers or 25,000 with over 50% revenue from data sales, subject to nexus and exemptions.

Covered consumers may confirm/access, delete personal data they supplied, obtain a portable copy of data they supplied, request correction of inaccuracies (since July 1, 2026), and opt out of sales or targeted advertising. Respond within 45 days, with a justified notified 45-day extension. The UCPA does not establish the general significant-profiling opt-out or controller appeal right found in several other states; do not imply those rights come from this statute.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

State processed categories, purposes, rights-request method, shared categories and third-party categories. Clearly disclose sales or targeted advertising and opt-out instructions. Before covered adult sensitive-data processing, provide clear notice and an opportunity to opt out; child-data processing has separate COPPA requirements.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

UCPA excludes employment/commercial consumers and applicant-role data. Child-data rules are separate.
One-party recording exceptions retain criminal/tortious-purpose limits.

Unresolved research and factual questions

Classify any consumer chatbot, regulated professional interaction or covered multimedia AI-provider activity before selecting those notices; do not treat text-only ATS analysis as a proven trigger.

13-77-101 and -103 — official primary text reviewed
13-61-102 applicability/exemptions — official primary text reviewed
13-61-302 privacy/sensitive-data notice — official primary text reviewed
77-23a-4(7)(b) — official primary text reviewed
2026 AI provenance chapter 72C — future operative primary text
HB418 §2 amending13-61-201(4): correction right effective July1 2026 — official enrolled text and supersession note on prior code PDF reviewed

Vermont

The common Evidize Privacy Notice applies alongside the information below.

13 V.S.A.2605(d) requires knowledge and consent for surveillance/recording of a person inside a home where privacy is reasonably expected. For permitted employment credit-report uses, 21 V.S.A.495i adds written consent each time, written reasons for access and adverse-action reasons; the credit-use restriction is separate from notice. Act138 amended broker disclosures apply January 1 2027; Act145 comprehensive consumer privacy notices and rights apply January 1 2028 to covered non-employment processing. Neither is a blanket current hiring-AI notice.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording in a private home

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment credit reports

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Data broker privacy information from January 1, 2027

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Data broker registration information

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

When additional notices apply

Recording in a private home

When this applies: Only when the activity and coverage conditions described above apply.

Covered recording or surveillance inside a home requires the person's knowledge and consent where there is a reasonable expectation of privacy.

Timing: Before private home surveillance

Employment credit reports

When this applies: Only when the activity and coverage conditions described above apply.

For each legally permitted access to an employment credit report, the employer obtains written consent and explains the reasons. Required reasons must also accompany an adverse decision.

Timing: Each permitted credit report access

Data broker privacy information from January 1, 2027

When this applies: Only when the activity and coverage conditions described above apply.

The broker registration must include the current privacy policy and a URL explaining offered deletion and opt-out methods, what opting out covers, authorized-agent availability and activities excluded from opt-out. Registration and required updates are separate duties. Act138 orders a deletion-mechanism feasibility study; it does not enact the mandatory 2028 deletion mechanism found in an earlier draft.

Timing: From January 1 2027 for a covered data broker under the amended definitions.

Data broker registration information

When this applies: Only when the activity and coverage conditions described above apply.

A covered data broker must provide identifying/contact details, offered opt-out procedures and limits, third-party opt-out availability, activities without opt-out, purchaser-credentialing information, prior-year breach figures and known-minor data practices in its Secretary of State registration. This is a data-broker public filing duty, not a universal applicant disclosure. Future privacy-policy and website-page additions are recorded separately.

Timing: Current annual data-broker registration; existing law operative January 1, 2019. Amended duties begin January 1, 2027.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: From January 1 2028: Vermont business/targeting nexus and preceding-year processing of at least 35,000 consumers, at least 3,000 consumers' sensitive data (excluding payment-only data), or offering at least 3,000 consumers' personal data for sale; subject to exemptions. Consumer-health provisions have a separate threshold rule.

From January 1 2028, covered consumers may confirm/access, correct, delete, obtain portable data and opt out of sales, targeted advertising and significant profiling; obtain the applicable list of third-party purchasers; and, where technically feasible, question a profiling result and review its input/reasons. Explain authorized-agent opt-outs. Requests: 45 days plus a justified notified 45-day extension. Appeals: written decision within 60 days and Attorney General complaint access after denial.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

From January 1 2028, state processed categories, purposes and processing description; rights/appeal methods; sold categories and purchaser categories; targeted advertising; active contact; whether data is collected, used or sold to train large language models; and last-update month/year. Provide accessible privacy links in each service language and required web/app locations. Explain material-change notices and withdrawal opportunities.

Timing: Enacted June 16 2026; operative January 1 2028.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

A general software security label is not the statutory private-investigator/security-guard exception.
The state credit-report definition/use prohibition is not automatically a classification of every first-party integrity signal.
Act145 consumer rights and Act138 amended broker consumer definition exclude commercial/employment contexts and specified business-role transactions. Independent consumer data brokerage or unrelated reuse still requires separate classification; a direct relationship does not automatically exempt third-party sourced data.

Unresolved research and factual questions

Private-home surveillance and remote participants still require actual purpose/location classification. Neither the enacted broker law nor the consumer privacy law establishes approval of current supplier practices.

13 V.S.A.2605(d) — official primary text reviewed
21 V.S.A.495i — official primary text reviewed
9 V.S.A.2480a and 2480e — official primary text reviewed
H211, Act 138 approved June 16, 2026 — official bill history
Act138 §§1,2,5; 9VSA2430,2446: broker privacy information January1 2027; deletion study July1 2026 — official final enacted PDF, all 41pages retrieved; operative provisions reviewed
Act145 §1 9VSA2415a-e and §4: comprehensive privacy law operative January1 2028 — official final enacted PDF, all 54pages retrieved; coverage, notice, rights and effective date reviewed
9 VSA2446(a)(3), existing annual broker registration information — official current HTML fetched September 13, 2026; January 2027 changes read separately in Act138

Virginia

The common Evidize Privacy Notice applies alongside the information below.

59.1-578 requires covered consumer privacy notices and clear targeted-advertising/sale opt-out information. 19.2-62(B)(2) permits a party or one party’s prior consent for interception.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Consumer privacy notice and rights

Employer: The employer provides its own applicable privacy and automated-decision notices and handles the rights owed for its hiring process.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: 100,000 consumers or 25,000 and over 50% gross data-sales revenue, with state nexus and exclusions; separately assess non-employment consumer services.

Covered consumers may confirm/access, correct, delete supplied or obtained data, receive a portable copy of data they supplied, and opt out of sales, targeted advertising and significant profiling. Requests: 45 days plus a justified notified 45-day extension. Appeals: written decision within 60 days and Attorney General complaint access after denial.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

State processed categories and purposes, shared categories and recipient categories, secure rights-request methods and appeal instructions. Clearly disclose sales or targeted advertising and how to opt out; a new account cannot be required solely to exercise rights.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

VCDPA excludes employment/commercial consumers and applicant-role data. Entity and regulated-data exemptions require separate classification.

Unresolved research and factual questions

No additional general private-hiring AI notice was identified in the bounded official-source review. This is not an exhaustive clearance of local ordinances, regulated professions or later enactments.
A veto of a prior-year AI proposal is not proof that all 2026 proposals or local enactments are absent.

59.1-575/-576 coverage, -577 rights and appeals, -578 notice; current code including2026 amendments — official primary text reviewed September 13, 2026
19.2-62(B)(2) — official primary text reviewed

Washington

The common Evidize Privacy Notice applies alongside the information below.

Private conversations generally need all-party consent; an effective recording announcement can establish consent and must itself be recorded when the conversation is recorded. State employment/investigative-report rules add disclosures, state rights and a meaningful pre-adverse response opportunity. Permitted job-related credit-report use requires written reasons. Seattle has a separate criminal-record explanation/response process.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Biometric enrollment

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative employment reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Employment credit reports

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Seattle criminal-history decisions

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Separate consumer health data notice

Employer: The organization remains responsible for any separately conducted activity covered by this rule. Ordinary résumé ranking does not establish that activity.

When additional notices apply

Employment reports, identifying biometric information and consumer health information have separate rules. The additional notices depend on the actual activity; ordinary resume analysis does not automatically trigger all of them. Seattle has additional rules for criminal-history decisions.

Biometric enrollment

When this applies: Only when the activity and coverage conditions described above apply.

Before covered commercial biometric enrollment, the organization follows the law's notice, consent or prevention-of-later-commercial-use route. The legal definitions and security exceptions determine which route applies.

Timing: Before covered commercial enrollment

Employment reports

When this applies: Only when the activity and coverage conditions described above apply.

The employer supplies the required report information and, before an adverse decision, the state rights information and a reasonable chance to respond. Federal requirements apply separately.

Timing: Before procurement and before adverse action

Investigative employment reports

When this applies: The state investigative-report notice rule applies; it has an exception for employment for which you have not specifically applied. Federal report requirements remain separate.

The person requesting the report provides written information about the investigation, how to request its nature and scope, and the state rights summary. The three-day period runs from the first request for the report, not from your later request for a copy.

Timing: Within three days after first request

What you can do: Use the report notice to send a written request for the investigation details to the person who requested the report, and contact the reporting agency to dispute report inaccuracies.

Employment credit reports

When this applies: Only when the activity and coverage conditions described above apply.

If the employer relies on the exception for a credit report substantially related to the job, it explains those reasons in writing.

Timing: Before permitted job related credit report

Seattle criminal-history decisions

When this applies: Only when the activity and coverage conditions described above apply.

Before a covered criminal-record decision, the employer identifies the information being considered and gives the person the required chance to explain or correct it, including the two-business-day response period.

Timing: Before criminal record adverse action

Separate consumer health data notice

When this applies: Only when the activity and coverage conditions described above apply.

Publish a prominent homepage link to a health-data policy identifying categories, purposes/use, sources, shared categories, third-party categories and specific affiliates, and rights methods. Covered people may confirm/access, obtain the list and contacts of health-data recipients, withdraw collection/sharing consent and request deletion. Requests:45 days plus a justified notified 45-day extension; appeals:45 days with written reasons and Attorney General complaint access after denial. New undisclosed categories/purposes require prior disclosure and affirmative consent; collection/sharing and sale permissions remain separate.

Timing: Before covered consumer-health collection/sharing; operative March 31 2024, or June 30 2024 for small businesses.

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Website and other consumer uses

When this applies: Consumer-health data, including qualifying health inferences, of Washington residents or collected in Washington, in an individual/household context; employment context excluded. Assess regulated-entity/data exceptions.

Covered people may confirm/access, obtain health-data recipient lists and contact details, withdraw collection/sharing consent and request deletion. Respond within 45 days, with one justified notified 45-day extension. Decide appeals in writing within 45 days, giving Attorney General complaint access after denial.

What the organization's notice must explain

The organization responsible for the processing supplies its own accurate details. This guide explains the required content; it does not publish that organization's notice.

Maintain the separate consumer-health privacy policy with data categories, collection purposes/use, sources, shared categories, recipient categories, specific affiliates and rights-request methods; prominently link it on the homepage. Obtain separately required collection/sharing consent and sale authorization; general terms are not permission.

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with open items

Coverage limits

19.375 has narrow commercial-purpose/enrollment definitions, excludes specified photo/video/audio material, and has a security-purpose exception. It does not universally demand both written notice and opt-in consent for every biometric feature.
State report notice alternatives do not remove the federal standalone written disclosure and authorization requirements when FCRA applies.
The state investigative-report notice rule has an alternative for employment for which the person has not specifically applied; this does not remove applicable federal duties.
RCW19.373 consumer-health coverage excludes employment context. Mere collection of hiring records is not proof of separate consumer-health processing; health inferences in an independent consumer service require separate review.

Unresolved research and factual questions

Seattle applicability and actual criminal-record procedure must be assessed separately; the two-business-day response period is not a universal AI review period.
2026 HB2144 employee-monitoring text remained a proposal in the reviewed official status; do not encode its proposed 30-day notice as current law.

RCW9.73.030(1),(3) — official primary text reviewed
RCW19.375.010-.020 — official primary text reviewed
RCW19.182.020, .050, .080 and .110 — official primary text reviewed
Seattle Fair Chance Employment explanation/response procedure — official agency guidance
RCW19.373.010 consumer-health scope, policy, permissions, rights or sale authorization — official primary text reviewed September 13, 2026
RCW19.373.020 consumer-health scope, policy, permissions, rights or sale authorization — official primary text reviewed September 13, 2026
RCW19.373.030 consumer-health scope, policy, permissions, rights or sale authorization — official primary text reviewed September 13, 2026
RCW19.373.040 consumer-health scope, policy, permissions, rights or sale authorization — official primary text reviewed September 13, 2026
RCW19.373.070 consumer-health scope, policy, permissions, rights or sale authorization — official primary text reviewed September 13, 2026

West Virginia

The common Evidize Privacy Notice applies alongside the information below.

62-1D-3(e) permits a participant or one party’s prior consent subject to criminal/tortious-purpose limits. 21-5H-1 protects employees and potential employees from compelled personal-account access; a privacy notice does not override that restriction.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Coverage limits

Incidental acquisition of credentials through permitted employer monitoring is not permission to access the private account.

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.
HB5123 and HB4868 histories show no enactment; neither supplies binding comprehensive consumer-privacy notices.

62-1D-3(e) — official primary text reviewed
21-5H-1 personal accounts — official primary text reviewed
2026 HB5123 introduced text — proposal, not verified enactment
HB5123 Consumer Data Protection Act; committee referral February3 2026 — official bill history reviewed; no enactment shown
HB4868 Consumer Privacy Act; last action House Judiciary referral January 28, 2026; not enacted — official bill history reviewed; no enactment shown

Wisconsin

The common Evidize Privacy Notice applies alongside the information below.

The official appellate opinions apply 968.31(2)(c)’s participant/one-party prior-consent exception with unlawful-purpose limits. Evidentiary admissibility has separate conditions; lawful interception is not automatic permission for every later use.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.
The current 968.31 recording source is verified; prior-consent and unlawful-purpose exceptions require actual facts, not a universal all-party checkbox.

968.31(2)(c) — official appellate opinion
968.31 and 885.365 — official appellate opinion
current 968.31 — official section HTML and current chapter PDF fetched September 13, 2026; current chapter certified September 4, 2026
968.31(2)(c) prior one-party consent except criminal/tortious/other injurious purpose — official current PDF reviewed; certified September 4 2026 through 2025WisconsinAct247
AB172 consumer privacy proposal; failed March23 2026 under SenateJointResolution1 — official proposal history fetched and reviewed

Wyoming

The common Evidize Privacy Notice applies alongside the information below.

7-3-702(b)(iv) permits a participant or one party’s prior consent, except for specified criminal/tortious purposes. The 2026 technology survey is comparative material, not a Wyoming private-hiring notice law.

Who is responsible for each requirement

These notes explain legal roles. They do not decide Evidize's role for an unassessed activity or require an employer compliance setup workflow.

Recording or interception permission

Employer: The employer is responsible for recording or monitoring it separately carries out or directs, and for its own applicable notices and permissions.

Employment consumer reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

Investigative reports

Employer: A covered report user supplies the required employment disclosure, authorization and adverse-action notices. State additions apply only when their conditions are met.

When additional notices apply

If communication is recorded or intercepted

When this applies: A feature actually records or intercepts protected communications. Resume analysis alone does not trigger this requirement.

If a covered employment report is obtained

When this applies: The actual service is a consumer report furnished by a consumer reporting agency for employment purposes. A product name does not decide this classification.

Federal employment-report requirements

Official sources and scope

This guide identifies notice requirements for the stated activities. It does not approve an employer's use or establish an exemption for an unassessed activity.

Recorded review status: primary sources reviewed with scope limits

Unresolved research and factual questions

Actual deployment city, communication mode, participant locations and any sector-specific product still require classification; the bounded state-source review does not clear every municipal ordinance.

7-3-702(b)(iv) — official 2026 statute
2026 legislative technology survey — official comparative memorandum
HB181 government surveillance/data provisions — official introduced text; not private-employer notice or enacted-law evidence
2026 interim AI/data-privacy studies — official final topic list reviewed; study topics do not create notice duties