As ordinary, 2025 was a yr of deep congressional dysfunction within the US. However state legislatures had been passing legal guidelines that govern all the things from AI to social media to the precise to restore. Many of those legal guidelines, alongside guidelines handed in previous years, take impact in 2026 — both proper now or within the coming months.
As of January 1st, Individuals ought to have the precise to crypto ATM refunds in Colorado, wide-ranging electronics repairs in Colorado and Washington, and AI system transparency in California, amongst different issues. However a last-minute courtroom ruling supplied a reprieve from one high-profile state legislation: Texas’ App Retailer-based age verification rule.
For an extended rundown of tech-related rules that go into power in 2026 — together with a serious piece of 1 federal legislation, the Take It Down Act — learn on.
California: AI transparency, chatbots, and extra
California handed a parcel of AI-related guidelines final yr. Essentially the most outstanding is SB 53: a transparency legislation that requires main AI firms to publish security and safety particulars and protects whistleblowers. It’s a revised model of SB 1047, which Gov. Gavin Newsom vetoed after a heated battle in 2024, and it goes into impact on January 1st, 2026.
Several other bills cope with extra particular implementations of AI. Amongst them is SB 243, one of many first rules on so-called companion chatbots, requiring them to keep up protocols for stopping suicidal ideation and self-harm, in addition to remind identified underage customers each few hours that the system isn’t human. SB 524, one other of the payments, requires legislation enforcement companies to “conspicuously” disclose how they use AI.
All this has arrange California as a check case for a way far state AI legal guidelines can push, particularly as Donald Trump’s administration goals to ban them altogether. That battle, too, is poised to play out in 2026.
Colorado: Proper to restore and crypto ATMs
Colorado handed one of many nation’s most comprehensive right-to-repair rules in 2024, requiring producers to facilitate repairs on a big swath of digital units. That legislation, HB24-1121, will lastly kick on this yr. The state can be including shopper protections to a serious fraud vector: cryptocurrency ATMs, which — as a result of they let customers convert fiat cash into crypto and ship it to an nameless pockets — reportedly helped scammers extract hundreds of millions of dollars from victims this yr. SB25-079 requires each day transaction limits for brand spanking new and current clients, plus refund choices for first-time customers who switch cash exterior the US — a serious sign they may have been sending cash as a result of they had been duped by a rip-off.
Idaho: Speech protections
Idaho joins the lengthy listing of states with legal guidelines combating strategic lawsuits in opposition to public participation, or anti-SLAPP legal guidelines, with SB 1001. Whereas this isn’t technically a tech legislation, SLAPP fits have been a key weapon of tech billionaires like Elon Musk, and limiting them helps stop what can amount to online censorship. A much-needed federal law stays nowhere to be seen.
Illinois: Public officers’ privateness
Beginning this yr, Illinois will prohibit sharing private data of public officers at their request. HB 576 covers normal meeting members and former members, public defenders, and county clerks, amongst others, and the coated data consists of dwelling addresses, dwelling telephone numbers, private e-mail addresses, and the id of youngsters beneath 18. The purpose is stopping harassment — an more and more prominent issue — as officers “administer their public duties.”
Information privateness is one other space lengthy uncared for by Congress however taken up by states, with extremely combined outcomes. Indiana’s Consumer Data Protection Act goals to offer a “information shopper invoice of rights” that features acquiring, correcting, and deleting private data an organization holds about you. However information privateness and shopper safety teams have denounced the legislation as toothless — a 2025 privacy report card by PIRG and the Digital Privateness Data Middle (EPIC) gave it an F.
HB 15 is one other information privateness framework that failed the 2025 PIRG/EPIC analysis. Kentucky and Indiana each fall beneath what that report dubs the “Virginia mannequin”: a framework they allege lets firms “proceed gathering no matter information they wished as lengthy they disclosed it someplace in a privateness coverage,” whereas making opt-outs onerous.
As with so many rules, the federal rule banning difficult-to-cancel subscriptions is in legal hell, however some states have been stepping up. Maine is becoming a member of them with LD 1642, a rule modeled on the FTC commonplace — which suggests, amongst different issues, making firms disclose the phrases of subscriptions and provide a cancellation technique so simple as the system for signing up.
Nebraska: Age-appropriate design
LB 504 is one among a number of state-level “age-appropriate design” guidelines — it restricts app options like notifications, in-game purchases, and infinite scrolling for youngsters, aiming to fight compulsive use by stopping “darkish patterns” that preserve youngsters on-line. An analogous code was blocked in California, nonetheless, so a authorized problem might materialize later this yr.
With AB 73, Nevada joins the slew of states making an attempt to curb undisclosed AI-powered electioneering. Its disclosure guidelines embody letting candidates sue in the event that they discover themselves starring in unwelcome, unlabeled AI-generated adverts.
Oklahoma: Information breach notifications
Oklahoma is broadening the scope of its information breach notification guidelines with SB 626, together with by increasing them to cowl biometric information and providing some new protected harbors for avoiding authorized damages.
Oregon: Deepfakes, information privateness, and ticket scalpers
HB 2299 provides AI-generated (or in any other case digitally manipulated) imagery to its ban on nonconsensual sexual imagery — a transfer seen in nearly every state since 2019. HB 2008 bans information collectors from promoting private data and concentrating on adverts utilizing information from customers they know are beneath 16, whereas including the same all-ages ban for exact geolocation information. And HB 3167 bans the sale of software program designed to facilitate ticket-scalping bots, addressing a maddening drawback the Federal Trade Commission focused on in 2025 as properly.
Rhode Island: Information privateness
Rhode Island’s HB 7787, the Rhode Island Information Transparency and Privateness Safety Act, consists of guidelines that require disclosure of how private data is collected and offered. It rounds out the trifecta of “Virginia mannequin” guidelines that failed a privacy evaluation and take impact this yr.
Texas: AI guidelines — however not App Retailer age verification (but)
Mere weeks in the past, Texas was set to implement a brand new type of on-line age-gating: requiring app shops to test customers’ ages and cross that data to app builders. However a district courtroom granted a preliminary injunction blocking SB 2420. The legislation stays value watching, nonetheless, as a result of Texas will doubtless enchantment to the Fifth Circuit — which is infamous for reversing decrease courtroom selections on web regulation.
Texas is enacting HB 149, an AI regulatory framework that prohibits utilizing the know-how to incite hurt, seize biometric identifiers, or discriminate based mostly on traits like race and gender or “political viewpoint.” That’s going to be one other check of the Trump administration’s plan to repeal state-level AI legal guidelines, highlighting a cut up between state and federal Republicans on AI.
Virginia: Social media deadlines
In the event you’re beneath 16 years previous in Virginia, your display time might have simply been drastically lowered. SB 854 requires social media firms to confirm customers’ ages and restrict youthful teenagers to 1 hour of use per app per day. A dad or mum can select to extend or lower that restrict. Like many web rules, this one is being challenged in court, so its final destiny stays undecided.
Washington: Proper to restore
Washington handed a pair of right-to-repair legal guidelines, HB 1483 and SB 5680, in 2025. As iFixit explains, they require firms to make restore supplies obtainable for many shopper electronics, block elements pairing, and supply particular protections for wheelchair customers.
The RAISE Act has been touted as a landmark AI legislation that might require giant mannequin builders to comply with new security and transparency guidelines. However it was significantly stripped down on the final minute, lessening its doubtless influence. Regardless, it’ll take impact on March nineteenth, 90 days after being signed late final yr.
Michigan: Anti-SLAPP and Taylor Swift
Michigan is one other state getting a brand new anti-SLAPP legislation — HB 4045 — as of March twenty fourth. On the identical date, it’s effectuating a bundle of guidelines known as the “Taylor Swift” bills, concentrating on ticket bots and modeled on the federal BOTS Act.
The Take It Down Act criminalized AI-generated nonconsensual intimate imagery distribution at a federal stage in 2025, a change teams just like the Cyber Civil Rights Initiative (CCRI) known as lengthy overdue. However within the phrases of CCRI president Mary Anne Franks, it included a “poison tablet” with a broad, ambiguous requirement that on-line platforms take away such pictures quickly, elevating issues about censorship and enforcement. That platform takedown provision got here with a one-year enforcement delay that can expire on Might nineteenth — so we’ll quickly work out how efficient (or disruptive) it really is.
Utah: App Retailer age verification
Utah’s App Retailer Accountability Act, SB 142, technically took impact final yr. However app shops got till Might sixth of 2026 to start out verifying customers’ ages with “commercially obtainable strategies” and require parental consent in the event that they detect minors. One last piece — letting minors or their mother and father sue for damages if app shops don’t comply — will take impact on December thirty first.
Colorado’s SB 24-205 is a named target of the Trump administration’s warfare on state AI legal guidelines. It requires AI firms to reveal details about high-risk methods, and extra particularly, take “affordable care to guard customers” from algorithmic discrimination. Initially slated for February, it’s now set to take impact June thirtieth as a substitute.
Arkansas: Kids’s privateness
HB 1717 is a kids’s information privateness rule much like the federal COPPA legislation and the proposed COPPA 2.0, barring on-line providers from gathering pointless private information in the event that they’re aimed toward minors or know a person is underage. It takes impact July 1st.
Utah’s HB 418, dubbed the Digital Selection Act, goals to make social media networks much less sticky by letting you progress information between them. A writeup from Harvard’s Ash Center explains the nuances, however broadly, it requires social media firms to implement open protocols that enable customers to share private information throughout totally different providers. Europe has mandated data portability for years and the outcomes haven’t been revolutionary, however there’s nonetheless an opportunity it might promote extra competitors on a centralized net. Its enforcement date can be July 1st.
Did you assume we had been finished with California AI legal guidelines? Properly, a delay pushed again the unique January goalpost for SB 942, which requires the federal government to develop requirements for AI detection methods and requires coated suppliers to make such instruments obtainable. Now its first provisions kick in on August 2nd, with extra necessities for firms taking impact in 2027 and 2028. It’s taking over a severe difficulty, but in addition an incredibly messy one — and like different guidelines, it relies on preserving the precise to state-level AI legal guidelines.