Your Client’s Website Has AI Now: State AI Acts, Chatbot Disclosure Laws, and the Federal Preemption Fight

Donata Stroink-Skillrud, President | Termageddon LLC

Donata Stroink-Skillrud is the president of Termageddon LLC and the legal engineer behind its privacy policy generator, writing the policy questions and text and keeping them up to date as privacy and technology legislation changes. A licensed attorney and Certified Information Privacy Professional, she co-founded Termageddon in 2016 after years of fielding client questions about privacy policies and terms of service in private practice. She chairs the ePrivacy Committee of the American Bar Association and hosts the Privacy Lawls podcast.

• Education & Credentials

Donata is a licensed attorney in Illinois (ARDC No. 6320882) and a Certified Information Privacy Professional (CIPP). Her interest in privacy law began when she was personally affected by the 2013 Target data breach, and she went on to practice privacy and technology law before founding Termageddon.

• Recognition & Leadership

Donata is a Fellow of the American Bar Foundation and a member of the American Bar Association’s Rule of Law Initiative Board. She previously served as the ABA’s Representative to the United Nations Economic and Social Council, and as Vice-Chair of the ABA’s ePrivacy Committee before becoming its Chair.

• Professional Involvement

Donata chairs the American Bar Association’s ePrivacy Committee and has served on the ABA’s Science and Technology Council and its Cybersecurity Legal Task Force. She has chaired the Chicago Chapter of the International Association of Privacy Professionals and the Chicago Bar Association’s Privacy and Cybersecurity Committee. She hosts the Privacy Lawls podcast and speaks nationally on website privacy compliance, including “Building WordPress Websites with ‘Privacy by Design’ in Mind” at WordCamp US 2024.

• Experience

Donata’s work centers on the legal obligations of businesses that operate websites and digital tools. At Termageddon, she monitors changing privacy and technology legislation and converts new requirements into the policy questions and text the company’s generator produces, keeping businesses’ website policies current as laws change. Before founding the company, she practiced privacy and technology law in private practice, advising clients on privacy policies and terms of service.

SESSION 1 – The 2026 State AI Law Wave — What Is Live, What Is Delayed, and What Washington Is Doing About It | 12:00pm – 1:00pm

This session discusses the international landscape such as the EU AI Act and maps the state AI statutes now enforceable and those arriving later in 2026: Texas TRAIGA’s prohibited-use regime and attorney general enforcement; California’s suite of January 1, 2026 laws, including companion chatbot disclosures (SB 243), training data transparency (AB 2013), healthcare AI restrictions (AB 489), and frontier model obligations (TFAIA); Illinois’s discriminatory-AI employment amendment (HB 3773); and the Colorado AI Act’s reasonable-care duties for high-risk AI systems, delayed to June 30, 2026. Attorneys will then examine the December 11, 2025 federal executive order — its AI litigation task force, the Commerce and FTC deliverables due March 11, 2026, the FCC preemption proceeding, and funding conditions on states — and learn how to counsel clients on complying with statutes that are simultaneously live and under constitutional attack.

BREAK | 1:00pm – 1:10pm

SESSION 2 – Counseling the AI-Enabled Business — Disclosures, Chatbot Litigation Risk, and a Practical Compliance Program | 1:10pm – 2:10pm

This session translates the new AI legal landscape into a practical counseling framework. Attorneys will learn how to build an AI inventory that identifies every chatbot, generative tool, and algorithmic system a client deploys and maps each to the statutes it triggers; how to draft the disclosures and consent flows that chatbot and bot-disclosure laws now require; and how to update privacy policies, terms of service, and vendor contracts to address AI training rights, data reuse, and indemnification. The session also covers the extension of CIPA wiretapping and eavesdropping theories to AI chatbots and AI-powered session analytics — including how plaintiffs allege that third-party AI vendors “listen in” on customer conversations — and closes with a compliance-program roadmap covering impact assessments, employment AI audits, and documentation practices that position clients defensibly with regulators and plaintiffs alike.