Privacy used to be mostly about what people told you. AI adds two newer questions: what can be worked out from information, and where the data that trained a tool came from. Information current as of October 7, 2026. I will update this post if the rules change.
This is general education, not legal advice.
What regulators are saying
Europe: AI models are not automatically anonymous. In December 2024 the European Data Protection Board (EDPB) issued Opinion 28/2024 on AI models and personal data. In plain terms: European regulators say a model is not automatically “anonymous” just because it is a model. They look at whether personal information could be pulled back out of it, either directly or by asking it questions. They also say a model built on improperly gathered personal data can create legal problems for the organizations that use it, unless the model has been properly anonymized.
Maryland: a state privacy law is already on the books. According to the Maryland Attorney General, the Maryland Online Data Privacy Act took effect on October 1, 2025. It gives residents rights to know what data businesses hold, correct it, delete it, and opt out of targeted advertising and the sale of their data. It treats categories such as a child’s data, precise location, biometric and health data as sensitive, and it bars selling sensitive data. It applies to businesses that meet size thresholds, so check whether it reaches your organization or your vendors, and check the Attorney General’s page for when specific requirements began to apply. Ask counsel if you are unsure.
What is actually changing
This section is my analysis. Two shifts matter most for community organizations:
- From what you share to what can be inferred. A tool that analyzes attendance, messages or survey answers may draw conclusions about a person that they never told you. Treat conclusions about people with the same care as the data behind them.
- From collection to the whole life of the data. Consent at the moment of collection is no longer the whole story. You also need to know whether a vendor keeps what you enter, whether it trains its models on it, and whether you can have it deleted.
What you can do now
- Keep names, case details and other sensitive information out of public AI tools. See the staff guide on my Resources page.
- Ask every AI vendor whether your data is used to train its models and how long it is kept. My vendor review checklist has the questions.
- Collect less. Data you never gather cannot be leaked, inferred from or mishandled.
- Tell families and participants plainly how you use AI and what you do not do. My post on explaining your AI use to families and funders can help.
If you do only one thing this month, ask your most-used AI vendor whether it trains on your data.
Join the conversation
What privacy question about AI do your staff or families ask most? Send it to me through the contact page in general terms. Please do not include names, ages, schools or any details that could identify a child or family. I may answer common questions, without naming anyone, in a future post.
Sources (all free to read)
- European Data Protection Board: Opinion 28/2024 on AI models and personal data
- European Data Protection Board: news release on the opinion
- Maryland Office of the Attorney General: Data privacy in Maryland
This post is general education, not legal advice. Jackson Allen LLC is not a law firm. For questions about your organization’s obligations, talk to a qualified attorney.
