All this has set up California as a test case for how far state AI laws can push, especially as Donald Trump\u2019s administration aims to ban them altogether<\/a>. That fight, too, is poised to play out in 2026.<\/p>\n Colorado: Right to repair and crypto ATMs<\/p>\n Colorado passed one of the country\u2019s most comprehensive right-to-repair rules<\/a> in 2024, requiring manufacturers to facilitate repairs on a large swath of electronic devices. That law, HB24-1121<\/a>, will finally kick in this year. The state is also adding consumer protections to a major fraud vector: cryptocurrency ATMs, which \u2014 because they let users convert fiat money into crypto and send it to an anonymous wallet \u2014 reportedly helped scammers extract hundreds of millions of dollars<\/a> from victims this year. SB25-079<\/a> requires daily transaction limits for new and existing customers, plus refund options for first-time users who transfer money outside the US \u2014 a major signal they might have been sending money because they were duped by a scam.<\/p>\n Idaho: Speech protections<\/p>\n Idaho joins the long list of states with laws combating strategic lawsuits against public participation, or anti-SLAPP laws, with SB 1001<\/a>. While this isn\u2019t technically a tech law, SLAPP suits have been a key weapon of tech billionaires like Elon Musk, and limiting them helps prevent what can amount to online censorship<\/a>. A much-needed federal law<\/a> remains nowhere to be seen.<\/p>\n Illinois: Public officials\u2019 privacy<\/p>\n Starting this year, Illinois will restrict sharing personal information of public officials at their request. HB 576<\/a> covers general assembly members and former members, public defenders, and county clerks, among others, and the covered information includes home addresses, home phone numbers, personal email addresses, and the identity of children under 18. The goal is preventing harassment \u2014 an increasingly prominent issue<\/a> \u2014 as officials \u201cadminister their public duties.\u201d<\/p>\n Data privacy is another area long neglected by Congress but taken up by states, with highly mixed results. Indiana\u2019s Consumer Data Protection Act<\/a> aims to provide a \u201cdata consumer bill of rights\u201d that includes obtaining, correcting, and deleting personal information a company holds about you. But data privacy and consumer protection groups have denounced the law as toothless \u2014 a 2025 privacy report card<\/a> by PIRG and the Electronic Privacy Information Center (EPIC) gave it an F.<\/p>\n HB 15<\/a> is another data privacy framework that failed the 2025 PIRG\/EPIC evaluation. Kentucky and Indiana both fall under what that report dubs the \u201cVirginia model\u201d: a framework they allege lets companies \u201ccontinue collecting whatever data they wanted as long they disclosed it somewhere in a privacy policy,\u201d while making opt-outs onerous.<\/p>\n As with so many regulations, the federal rule banning difficult-to-cancel subscriptions is in legal hell<\/a>, but some states have been stepping up. Maine is joining them with LD 1642<\/a>, a rule modeled on the FTC standard \u2014 which means, among other things, making companies disclose the terms of subscriptions and offer a cancellation method as simple as the system for signing up.<\/p>\n Nebraska: Age-appropriate design<\/p>\n LB 504<\/a> is one of multiple state-level \u201cage-appropriate design\u201d rules \u2014 it restricts app features like notifications, in-game purchases, and infinite scrolling for children, aiming to combat compulsive use by stopping \u201cdark patterns\u201d that keep kids online. A similar code was blocked in California<\/a>, however, so a legal challenge could materialize later this year.<\/p>\n With AB 73<\/a>, Nevada joins the slew of states<\/a> trying to curb undisclosed AI-powered electioneering. Its disclosure rules include letting candidates sue if they find themselves starring in unwelcome, unlabeled AI-generated ads.<\/p>\n Oklahoma: Data breach notifications<\/p>\n Oklahoma is broadening the scope of its data breach notification rules with SB 626<\/a>, including by expanding them to cover biometric data and offering some new safe harbors for avoiding legal damages.<\/p>\n Oregon: Deepfakes, data privacy, and ticket scalpers<\/p>\n HB 2299<\/a> adds AI-generated (or otherwise digitally manipulated) imagery to its ban on nonconsensual sexual imagery \u2014 a move seen in nearly every state<\/a> since 2019. HB 2008<\/a> bans data collectors from selling personal information and targeting ads using data from users they know are under 16, while adding a similar all-ages ban for precise geolocation data. And HB 3167<\/a> bans the sale of software designed to facilitate ticket-scalping bots, addressing a maddening problem the Federal Trade Commission focused on<\/a> in 2025 as well.<\/p>\n Rhode Island: Data privacy<\/p>\n Rhode Island\u2019s HB 7787<\/a>, the Rhode Island Data Transparency and Privacy Protection Act, includes rules that require disclosure of how personal information is collected and sold. It rounds out the trifecta of \u201cVirginia model\u201d rules that failed a privacy evaluation<\/a> and take effect this year.<\/p>\n Texas: AI rules \u2014 but not App Store age verification (yet)<\/p>\n Mere weeks ago, Texas was set to implement a new form of online age-gating: requiring app stores to check users\u2019 ages and pass that information to app developers. But a district court granted a preliminary injunction<\/a> blocking SB 2420<\/a>. The law remains worth watching, however, because Texas will likely appeal to the Fifth Circuit \u2014 which is notorious for reversing lower court decisions on internet regulation.<\/p>\n Texas is enacting HB 149<\/a>, an AI regulatory framework that prohibits using the technology to incite harm, capture biometric identifiers, or discriminate based on characteristics like race and gender or \u201cpolitical viewpoint.\u201d That\u2019s going to be another test of the Trump administration\u2019s plan to repeal state-level AI laws, highlighting a split between state and federal Republicans on AI.<\/p>\n Virginia: Social media time limits<\/p>\n If you\u2019re under 16 years old in Virginia, your screen time may have just been drastically reduced. SB 854<\/a> requires social media companies to verify users\u2019 ages and limit younger teens to one hour of use per app per day. A parent can choose to increase or decrease that limit. Like many internet regulations, this one is being challenged in court<\/a>, so its ultimate fate remains undecided.<\/p>\n Washington: Right to repair<\/p>\n Washington passed a pair of right-to-repair laws, HB 1483<\/a> and SB 5680<\/a>, in 2025. As iFixit explains<\/a>, they require companies to make repair materials available for most consumer electronics, block parts pairing, and provide specific protections for wheelchair users.<\/p>\n The RAISE Act<\/a> has been touted as a landmark AI law that would require large model developers to follow new safety and transparency rules. But it was significantly stripped down<\/a> at the last minute, lessening its likely impact. Regardless, it\u2019ll take effect on March 19th, 90 days after being signed late last year.<\/p>\n Michigan: Anti-SLAPP and Taylor Swift <\/p>\n Michigan is another state getting a new anti-SLAPP law \u2014 HB 4045<\/a> \u2014 as of March 24th. On the same date, it\u2019s effectuating a package of rules known as the \u201cTaylor Swift\u201d bills<\/a>, targeting ticket bots and modeled on the federal BOTS Act<\/a>.<\/p>\n The Take It Down Act criminalized<\/a> AI-generated nonconsensual intimate imagery distribution at a federal level in 2025, a change groups like the Cyber Civil Rights Initiative (CCRI) called long overdue. But in the words of CCRI president Mary Anne Franks, it included a \u201cpoison pill\u201d with a broad, ambiguous requirement<\/a> that online platforms remove such images rapidly, raising concerns about censorship and enforcement. That platform takedown provision came with a one-year enforcement delay that will expire on May 19th \u2014 so we\u2019ll soon figure out how effective (or disruptive) it actually is.<\/p>\n Utah: App Store age verification<\/p>\n Utah\u2019s App Store Accountability Act, SB 142<\/a>, technically took effect last year. But app stores were given until May 6th of 2026 to start verifying users\u2019 ages with \u201ccommercially available methods\u201d and require parental consent if they detect minors. One final piece \u2014 letting minors or their parents sue for damages if app stores don\u2019t comply \u2014 will take effect on December 31st.<\/p>\n Colorado\u2019s SB 24-205<\/a> is a named target<\/a> of the Trump administration\u2019s war on state AI laws. It requires AI companies to disclose information about high-risk systems, and more specifically, take \u201creasonable care to protect consumers\u201d from algorithmic discrimination. Originally slated for February, it\u2019s now set<\/a> to take effect June 30th instead.<\/p>\n Arkansas: Children\u2019s privacy<\/p>\n HB 1717<\/a> is a children\u2019s data privacy rule similar to the federal COPPA law and the proposed COPPA 2.0, barring online services from collecting unnecessary personal data if they\u2019re aimed at minors or know a user is underage. It takes effect July 1st.<\/p>\n Utah\u2019s HB 418<\/a>, dubbed the Digital Choice Act, aims to make social media networks less sticky by letting you move data between them. A writeup from Harvard\u2019s Ash Center<\/a> explains the nuances, but broadly, it requires social media companies to implement open protocols that allow users to share personal data across different services. Europe has mandated data portability<\/a> for years and the results haven\u2019t been revolutionary, but there\u2019s still a chance it could promote more competition on a centralized web. Its enforcement date is also July 1st.<\/p>\n Did you think we were done with California AI laws? Well, a delay<\/a> pushed back the original January goalpost for SB 942<\/a>, which requires the government to develop standards for AI detection systems and requires covered providers to make such tools available. Now its first provisions kick in on August 2nd, with additional requirements for companies taking effect in 2027 and 2028. It\u2019s taking on a serious issue, but also an incredibly messy one<\/a> \u2014 and like other rules, it depends on preserving the right to state-level AI laws.<\/p>\n Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Adi RobertsonClose Senior Editor, Tech & Policy<\/p>\n Posts from this author will be added to your daily email digest and your homepage feed.<\/p>\n FollowFollow<\/p>\n See All by Adi Robertson<\/a><\/p>\n AnalysisCloseAnalysis<\/p>\n Posts from this topic will be added to your daily email digest and your homepage feed.<\/p>\n FollowFollow<\/p>\n See All Analysis<\/a><\/p>\n PolicyClosePolicy<\/p>\n Posts from this topic will be added to your daily email digest and your homepage feed.<\/p>\n FollowFollow<\/p>\n![\"Adi](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/01\/ADI_ROBERTSON.0.jpg\"\/)
Adi Robertson<\/p>\n