Platform Algorithm Harm: Enacted Law vs. Proposals — Know the Difference

There is currently no comprehensive US federal statute regulating algorithmic decision-making generally. The Algorithmic Accountability Act has been reintroduced in Congress repeatedly since 2019 — including versions in 2022, 2023, and again in the current 119th Congress (2025–2026) — and has never been enacted. If you see it referenced as if it were current law, that reference is wrong; it remains a proposal.

What DOES exist federally is enforcement under existing law by existing regulators, applied to algorithmic conduct. The clearest example: in December 2023, the FTC settled with Rite Aid over its use of facial recognition surveillance, alleging the company deployed the technology without assessing accuracy or bias, disproportionately in stores in neighborhoods with more residents of color, generating many false "shoplifter" matches. The consent order required Rite Aid to delete the images and any algorithms/models built from them (a remedy commentators call "algorithmic disgorgement"), banned facial recognition use for five years except in narrow circumstances with affirmative consent, and imposed ongoing monitoring — all under the FTC's existing Section 5 authority over "unfair or deceptive" practices, not a new AI-specific statute.

At the state and city level, a small number of genuinely enacted (not proposed) algorithm-specific laws exist. NYC Local Law 144 (enacted, effective January 1, 2023, actively enforced by the Department of Consumer and Worker Protection since July 2023) requires employers using "automated employment decision tools" to evaluate NYC candidates or employees to commission an independent annual bias audit, publish a summary, and give candidates 10 business days' notice — with penalties from $500 for a first violation up to $1,500 per day for continued non-compliance. Illinois' Biometric Information Privacy Act (BIPA, enacted 2008) separately gives individuals a private right of action over unconsented collection of biometric identifiers, which has been used in disputes over facial-recognition and similar algorithmic systems.

Colorado's SB 24-205 (the "Colorado AI Act") is a genuinely useful case study in reading algorithm-law headlines carefully. It was enacted in 2024 with an original effective date of February 1, 2026. In August 2025, Colorado postponed it to June 30, 2026. Then, on May 14, 2026, Colorado's governor signed SB 26-189, which REPLACES the original law before it ever took effect — stripping out its duty-of-care, risk-management, and impact-assessment provisions and substituting a narrower framework focused on disclosure and transparency for automated decision-making, with a new effective date of January 1, 2027. In short: as of mid-2026, the original, more protective Colorado AI Act never actually governed anyone, and a different, narrower law is what will eventually apply. verify the current status directly, since this is an unusually fast-moving example and may have changed again by the time you read this

The EU AI Act (Regulation (EU) 2024/1689) is genuinely enacted, but its obligations are phased in over several years and some deadlines have themselves been pushed back. Prohibited AI practices (for example, certain biometric categorization, manipulative or exploitative AI, and specified social-scoring uses) have applied since February 2, 2025, with the highest penalty tier (up to €35 million or 7% of global turnover). Transparency obligations (for example, disclosing that you're interacting with an AI system) apply from August 2, 2026. But the compliance deadlines for high-risk AI systems — the category most relevant to algorithmic decisions about employment, credit, insurance, and similar consequential areas — were pushed back under a 2026 simplification package to December 2, 2027 for standalone high-risk systems and August 2, 2028 for AI embedded in products covered by other EU safety law. If a source tells you high-risk AI Act obligations are already in force in 2026, check the date again.

The EU Digital Services Act (Regulation (EU) 2022/2065) is separate from the AI Act and already fully in force for designated Very Large Online Platforms and Search Engines (VLOPs/VLOSEs — platforms with more than 45 million monthly active EU users). Article 38 requires these platforms to offer at least one recommender-system option that is not based on profiling — meaning you have an enforceable right today to opt out of a personalized algorithmic feed on a qualifying platform (several major platforms, including TikTok, have implemented a non-personalized feed option in the EU specifically to comply with this rule).

There is no general US federal right to an explanation of, or to opt out of, an algorithmic decision outside the specific contexts covered by existing law (e.g., certain credit decisions under the Fair Credit Reporting Act / Equal Credit Opportunity Act, which are older, non-AI-specific statutes that happen to apply when the underlying process involves an algorithm).

A law being "enacted" does not mean its obligations are in effect yet — as the EU AI Act's phased timeline and Colorado's replaced law both illustrate, always check the specific applicability date of the specific provision you're relying on, not just whether the underlying law exists.

Employer or platform-side AI disclosure/audit laws (like NYC Local Law 144) generally create obligations enforced by a city/state agency; they don't necessarily give the affected individual a direct right to sue for a specific outcome, though enforcement can indirectly benefit you by forcing a compliant audit or process change.

Complaints grounded in an existing, well-established law (FCRA/ECOA for credit, Title VII/state law for employment discrimination, BIPA for biometric collection) tend to have clearer, more predictable outcomes than complaints framed purely as "the algorithm was unfair" without tying to a specific enacted legal right.

Regulatory enforcement actions (FTC, state AGs, NYC DCWP, EU Digital Services Coordinators) can produce real changes to a platform's practices, but individual complainants usually do not receive a direct personal payout from these actions — the primary benefit is often systemic (a practice stops or an audit is required) rather than individual compensation.

This page can help you distinguish enacted, currently-effective law from proposals and superseded bills so you pursue the right framework, but it cannot predict whether a specific regulator will act on your complaint, and it is not a guarantee of any particular remedy.