As traditional, 2025 was a 12 months of deep congressional dysfunction within the US. However state legislatures had been passing legal guidelines that govern every part from AI to social media to the precise to restore. Many of those legal guidelines, alongside guidelines handed in previous years, take impact in 2026 — both proper now or within the coming months.
As of January 1st, Individuals ought to have the precise to crypto ATM refunds in Colorado, wide-ranging electronics repairs in Colorado and Washington, and AI system transparency in California, amongst different issues. However a last-minute court docket ruling supplied a reprieve from one high-profile state legislation: Texas’ App Retailer-based age verification rule.
For an extended rundown of tech-related laws that go into power in 2026 — together with a significant piece of 1 federal legislation, the Take It Down Act — learn on.
California: AI transparency, chatbots, and extra
California handed a parcel of AI-related guidelines final 12 months. Essentially the most distinguished is SB 53: a transparency legislation that requires main AI corporations to publish security and safety particulars and protects whistleblowers. It’s a revised model of SB 1047, which Gov. Gavin Newsom vetoed after a heated struggle in 2024, and it goes into impact on January 1st, 2026.
A number of different payments cope with extra particular implementations of AI. Amongst them is SB 243, one of many first laws on so-called companion chatbots, requiring them to take care of protocols for stopping suicidal ideation and self-harm, in addition to remind identified underage customers each few hours that the system isn’t human. SB 524, one other of the payments, requires legislation enforcement companies to “conspicuously” disclose how they use AI.
All this has arrange California as a check case for the way far state AI legal guidelines can push, particularly as Donald Trump’s administration goals to ban them altogether. That struggle, too, is poised to play out in 2026.
Colorado: Proper to restore and crypto ATMs
Colorado handed one of many nation’s most complete right-to-repair guidelines in 2024, requiring producers to facilitate repairs on a big swath of digital gadgets. That legislation, HB24-1121, will lastly kick on this 12 months. The state can also be including client protections to a significant fraud vector: cryptocurrency ATMs, which — as a result of they let customers convert fiat cash into crypto and ship it to an nameless pockets — reportedly helped scammers extract a whole lot of hundreds of thousands of {dollars} from victims this 12 months. SB25-079 requires day by day transaction limits for brand new and present clients, plus refund choices for first-time customers who switch cash exterior the US — a significant sign they may have been sending cash as a result of they had been duped by a rip-off.
Idaho: Speech protections
Idaho joins the lengthy checklist of states with legal guidelines combating strategic lawsuits in opposition to public participation, or anti-SLAPP legal guidelines, with SB 1001. Whereas this isn’t technically a tech legislation, SLAPP fits have been a key weapon of tech billionaires like Elon Musk, and limiting them helps forestall what can quantity to on-line censorship. A much-needed federal legislation stays nowhere to be seen.
Illinois: Public officers’ privateness
Beginning this 12 months, Illinois will limit sharing private data of public officers at their request. HB 576 covers basic meeting members and former members, public defenders, and county clerks, amongst others, and the coated data contains house addresses, house cellphone numbers, private e-mail addresses, and the id of youngsters underneath 18. The purpose is stopping harassment — an more and more distinguished subject — as officers “administer their public duties.”
Information privateness is one other space lengthy uncared for by Congress however taken up by states, with extremely combined outcomes. Indiana’s Client Information Safety Act goals to supply a “knowledge client invoice of rights” that features acquiring, correcting, and deleting private data an organization holds about you. However knowledge privateness and client safety teams have denounced the legislation as toothless — a 2025 privateness report card by PIRG and the Digital Privateness Info Middle (EPIC) gave it an F.
HB 15 is one other knowledge privateness framework that failed the 2025 PIRG/EPIC analysis. Kentucky and Indiana each fall underneath what that report dubs the “Virginia mannequin”: a framework they allege lets corporations “proceed gathering no matter knowledge they needed as lengthy they disclosed it someplace in a privateness coverage,” whereas making opt-outs onerous.
As with so many laws, the federal rule banning difficult-to-cancel subscriptions is in authorized hell, however some states have been stepping up. Maine is becoming a member of them with LD 1642, a rule modeled on the FTC commonplace — which implies, amongst different issues, making corporations disclose the phrases of subscriptions and supply a cancellation technique so simple as the system for signing up.
Nebraska: Age-appropriate design
LB 504 is one in every of a number of state-level “age-appropriate design” guidelines — it restricts app options like notifications, in-game purchases, and infinite scrolling for kids, aiming to fight compulsive use by stopping “darkish patterns” that preserve children on-line. The same code was blocked in California, nevertheless, so a authorized problem may materialize later this 12 months.
With AB 73, Nevada joins the slew of states making an attempt to curb undisclosed AI-powered electioneering. Its disclosure guidelines embody letting candidates sue in the event that they discover themselves starring in unwelcome, unlabeled AI-generated adverts.
Oklahoma: Information breach notifications
Oklahoma is broadening the scope of its knowledge breach notification guidelines with SB 626, together with by increasing them to cowl biometric knowledge and providing some new protected harbors for avoiding authorized damages.
Oregon: Deepfakes, knowledge privateness, and ticket scalpers
HB 2299 provides AI-generated (or in any other case digitally manipulated) imagery to its ban on nonconsensual sexual imagery — a transfer seen in almost each state since 2019. HB 2008 bans knowledge collectors from promoting private data and focusing on adverts utilizing knowledge from customers they know are underneath 16, whereas including the same all-ages ban for exact geolocation knowledge. And HB 3167 bans the sale of software program designed to facilitate ticket-scalping bots, addressing a maddening downside the Federal Commerce Fee centered on in 2025 as effectively.
Rhode Island: Information privateness
Rhode Island’s HB 7787, the Rhode Island Information Transparency and Privateness Safety Act, contains guidelines that require disclosure of how private data is collected and bought. It rounds out the trifecta of “Virginia mannequin” guidelines that failed a privateness analysis and take impact this 12 months.
Texas: AI guidelines — however not App Retailer age verification (but)
Mere weeks in the past, Texas was set to implement a brand new type of on-line age-gating: requiring app shops to examine customers’ ages and cross that data to app builders. However a district court docket granted a preliminary injunction blocking SB 2420. The legislation stays value watching, nevertheless, as a result of Texas will doubtless attraction to the Fifth Circuit — which is infamous for reversing decrease court docket choices on web regulation.
Texas is enacting HB 149, an AI regulatory framework that prohibits utilizing the expertise to incite hurt, seize biometric identifiers, or discriminate primarily based on traits like race and gender or “political viewpoint.” That’s going to be one other check of the Trump administration’s plan to repeal state-level AI legal guidelines, highlighting a cut up between state and federal Republicans on AI.
Virginia: Social media closing dates
In the event you’re underneath 16 years previous in Virginia, your display time could have simply been drastically diminished. SB 854 requires social media corporations to confirm customers’ ages and restrict youthful teenagers to 1 hour of use per app per day. A mum or dad can select to extend or lower that restrict. Like many web laws, this one is being challenged in court docket, so its final destiny stays undecided.
Washington: Proper to restore
Washington handed a pair of right-to-repair legal guidelines, HB 1483 and SB 5680, in 2025. As iFixit explains, they require corporations to make restore supplies out there for many client electronics, block elements pairing, and supply particular protections for wheelchair customers.
The RAISE Act has been touted as a landmark AI legislation that may require massive mannequin builders to comply with new security and transparency guidelines. Nevertheless it was considerably stripped down on the final minute, lessening its doubtless affect. Regardless, it’ll take impact on March nineteenth, 90 days after being signed late final 12 months.
Michigan: Anti-SLAPP and Taylor Swift
Michigan is one other state getting a brand new anti-SLAPP legislation — HB 4045 — as of March twenty fourth. On the identical date, it’s effectuating a package deal of guidelines generally known as the “Taylor Swift” payments, focusing on ticket bots and modeled on the federal BOTS Act.
The Take It Down Act criminalized AI-generated nonconsensual intimate imagery distribution at a federal stage in 2025, a change teams just like the Cyber Civil Rights Initiative (CCRI) known as lengthy overdue. However within the phrases of CCRI president Mary Anne Franks, it included a “poison capsule” with a broad, ambiguous requirement that on-line platforms take away such photos quickly, elevating considerations about censorship and enforcement. That platform takedown provision got here with a one-year enforcement delay that can expire on Might nineteenth — so we’ll quickly work out how efficient (or disruptive) it really is.
Utah: App Retailer age verification
Utah’s App Retailer Accountability Act, SB 142, technically took impact final 12 months. However app shops got till Might sixth of 2026 to start out verifying customers’ ages with “commercially out there strategies” and require parental consent in the event that they detect minors. One last piece — letting minors or their mother and father sue for damages if app shops don’t comply — will take impact on December thirty first.
Colorado’s SB 24-205 is a named goal of the Trump administration’s battle on state AI legal guidelines. It requires AI corporations to reveal details about high-risk techniques, and extra particularly, take “affordable care to guard customers” from algorithmic discrimination. Initially slated for February, it’s now set to take impact June thirtieth as a substitute.
Arkansas: Kids’s privateness
HB 1717 is a kids’s knowledge privateness rule much like the federal COPPA legislation and the proposed COPPA 2.0, barring on-line providers from gathering pointless private knowledge in the event that they’re geared toward minors or know a person is underage. It takes impact July 1st.
Utah’s HB 418, dubbed the Digital Selection Act, goals to make social media networks much less sticky by letting you progress knowledge between them. A writeup from Harvard’s Ash Middle explains the nuances, however broadly, it requires social media corporations to implement open protocols that permit customers to share private knowledge throughout totally different providers. Europe has mandated knowledge portability for years and the outcomes haven’t been revolutionary, however there’s nonetheless an opportunity it may promote extra competitors on a centralized net. Its enforcement date can also be July 1st.
Did you assume we had been accomplished with California AI legal guidelines? Nicely, a delay pushed again the unique January goalpost for SB 942, which requires the federal government to develop requirements for AI detection techniques and requires coated suppliers to make such instruments out there. Now its first provisions kick in on August 2nd, with further necessities for corporations taking impact in 2027 and 2028. It’s taking over a critical subject, but additionally an extremely messy one — and like different guidelines, it will depend on preserving the precise to state-level AI legal guidelines.