Meet the brand new tech legal guidelines of 2026
As typical, 2025 was a 12 months of deep congressional dysfunction within the US. However state legislatures had been passing legal guidelines that govern every part from AI to social media to the precise to restore. Many of those legal guidelines, alongside guidelines handed in previous years, take impact in 2026 — both proper now or within the coming months.
As of January 1st, Individuals ought to have the precise to crypto ATM refunds in Colorado, wide-ranging electronics repairs in Colorado and Washington, and AI system transparency in California, amongst different issues. However a last-minute court docket ruling provided a reprieve from one high-profile state regulation: Texas’ App Retailer-based age verification rule.
For an extended rundown of tech-related rules that go into pressure in 2026 — together with a serious piece of 1 federal regulation, the Take It Down Act — learn on.
California handed a parcel of AI-related guidelines final 12 months. Probably the most distinguished is SB 53: a transparency regulation that requires main AI firms to publish security and safety particulars and protects whistleblowers. It’s a revised model of SB 1047, which Gov. Gavin Newsom vetoed after a heated battle in 2024, and it goes into impact on January 1st, 2026.
A number of different payments take care of extra particular implementations of AI. Amongst them is SB 243, one of many first rules on so-called companion chatbots, requiring them to keep up protocols for stopping suicidal ideation and self-harm, in addition to remind recognized underage customers each few hours that the system isn’t human. SB 524, one other of the payments, requires regulation enforcement businesses to “conspicuously” disclose how they use AI.
All this has arrange California as a take a look at case for the way far state AI legal guidelines can push, particularly as Donald Trump’s administration goals to ban them altogether. That battle, too, is poised to play out in 2026.
Colorado: Proper to restore and crypto ATMs
Colorado handed one of many nation’s most complete right-to-repair guidelines in 2024, requiring producers to facilitate repairs on a big swath of digital units. That regulation, HB24-1121, will lastly kick on this 12 months. The state can also be including client protections to a serious fraud vector: cryptocurrency ATMs, which — as a result of they let customers convert fiat cash into crypto and ship it to an nameless pockets — reportedly helped scammers extract a whole lot of tens of millions of {dollars} from victims this 12 months. SB25-079 requires each day transaction limits for brand spanking new and current prospects, plus refund choices for first-time customers who switch cash outdoors the US — a serious sign they may have been sending cash as a result of they had been duped by a rip-off.
Idaho: Speech protections
Idaho joins the lengthy listing of states with legal guidelines combating strategic lawsuits towards public participation, or anti-SLAPP legal guidelines, with SB 1001. Whereas this isn’t technically a tech regulation, SLAPP fits have been a key weapon of tech billionaires like Elon Musk, and limiting them helps forestall what can quantity to on-line censorship. A much-needed federal regulation stays nowhere to be seen.
Illinois: Public officers’ privateness
Beginning this 12 months, Illinois will limit sharing private data of public officers at their request. HB 576 covers common meeting members and former members, public defenders, and county clerks, amongst others, and the lined data consists of residence addresses, residence cellphone numbers, private e-mail addresses, and the identification of kids beneath 18. The aim is stopping harassment — an more and more distinguished subject — as officers “administer their public duties.”
Knowledge privateness is one other space lengthy uncared for by Congress however taken up by states, with extremely blended outcomes. Indiana’s Shopper Knowledge Safety Act goals to offer a “knowledge client invoice of rights” that features acquiring, correcting, and deleting private data an organization holds about you. However knowledge privateness and client safety teams have denounced the regulation as toothless — a 2025 privateness report card by PIRG and the Digital Privateness Info Middle (EPIC) gave it an F.
HB 15 is one other knowledge privateness framework that failed the 2025 PIRG/EPIC analysis. Kentucky and Indiana each fall beneath what that report dubs the “Virginia mannequin”: a framework they allege lets firms “proceed amassing no matter knowledge they needed as lengthy they disclosed it someplace in a privateness coverage,” whereas making opt-outs onerous.
As with so many rules, the federal rule banning difficult-to-cancel subscriptions is in authorized hell, however some states have been stepping up. Maine is becoming a member of them with LD 1642, a rule modeled on the FTC commonplace — which suggests, amongst different issues, making firms disclose the phrases of subscriptions and provide a cancellation methodology so simple as the system for signing up.
Nebraska: Age-appropriate design
LB 504 is one among a number of state-level “age-appropriate design” guidelines — it restricts app options like notifications, in-game purchases, and infinite scrolling for youngsters, aiming to fight compulsive use by stopping “darkish patterns” that maintain children on-line. The same code was blocked in California, nonetheless, so a authorized problem might materialize later this 12 months.
With AB 73, Nevada joins the slew of states attempting to curb undisclosed AI-powered electioneering. Its disclosure guidelines embody letting candidates sue in the event that they discover themselves starring in unwelcome, unlabeled AI-generated advertisements.
Oklahoma: Knowledge breach notifications
Oklahoma is broadening the scope of its knowledge breach notification guidelines with SB 626, together with by increasing them to cowl biometric knowledge and providing some new protected harbors for avoiding authorized damages.
Oregon: Deepfakes, knowledge privateness, and ticket scalpers
HB 2299 provides AI-generated (or in any other case digitally manipulated) imagery to its ban on nonconsensual sexual imagery — a transfer seen in almost each state since 2019. HB 2008 bans knowledge collectors from promoting private data and focusing on advertisements utilizing knowledge from customers they know are beneath 16, whereas including an identical all-ages ban for exact geolocation knowledge. And HB 3167 bans the sale of software program designed to facilitate ticket-scalping bots, addressing a maddening drawback the Federal Commerce Fee centered on in 2025 as effectively.
Rhode Island: Knowledge privateness
Rhode Island’s HB 7787, the Rhode Island Knowledge Transparency and Privateness Safety Act, consists of guidelines that require disclosure of how private data is collected and offered. It rounds out the trifecta of “Virginia mannequin” guidelines that failed a privateness analysis and take impact this 12 months.
Texas: AI guidelines — however not App Retailer age verification (but)
Mere weeks in the past, Texas was set to implement a brand new type of on-line age-gating: requiring app shops to examine customers’ ages and move that data to app builders. However a district court docket granted a preliminary injunction blocking SB 2420. The regulation stays value watching, nonetheless, as a result of Texas will seemingly attraction to the Fifth Circuit — which is infamous for reversing decrease court docket selections on web regulation.
Texas is enacting HB 149, an AI regulatory framework that prohibits utilizing the know-how to incite hurt, seize biometric identifiers, or discriminate based mostly on traits like race and gender or “political viewpoint.” That’s going to be one other take a look at of the Trump administration’s plan to repeal state-level AI legal guidelines, highlighting a cut up between state and federal Republicans on AI.
Virginia: Social media cut-off dates
If you happen to’re beneath 16 years outdated in Virginia, your display time might have simply been drastically decreased. SB 854 requires social media firms to confirm customers’ ages and restrict youthful teenagers to 1 hour of use per app per day. A dad or mum can select to extend or lower that restrict. Like many web rules, this one is being challenged in court docket, so its final destiny stays undecided.
Washington: Proper to restore
Washington handed a pair of right-to-repair legal guidelines, HB 1483 and SB 5680, in 2025. As iFixit explains, they require firms to make restore supplies accessible for many client electronics, block elements pairing, and supply particular protections for wheelchair customers.
The RAISE Act has been touted as a landmark AI regulation that may require massive mannequin builders to comply with new security and transparency guidelines. But it surely was significantly stripped down on the final minute, lessening its seemingly affect. Regardless, it’ll take impact on March nineteenth, 90 days after being signed late final 12 months.
Michigan: Anti-SLAPP and Taylor Swift
Michigan is one other state getting a brand new anti-SLAPP regulation — HB 4045 — as of March twenty fourth. On the identical date, it’s effectuating a package deal of guidelines generally known as the “Taylor Swift” payments, focusing on ticket bots and modeled on the federal BOTS Act.
The Take It Down Act criminalized AI-generated nonconsensual intimate imagery distribution at a federal stage in 2025, a change teams just like the Cyber Civil Rights Initiative (CCRI) known as lengthy overdue. However within the phrases of CCRI president Mary Anne Franks, it included a “poison tablet” with a broad, ambiguous requirement that on-line platforms take away such photos quickly, elevating issues about censorship and enforcement. That platform takedown provision got here with a one-year enforcement delay that may expire on Could nineteenth — so we’ll quickly work out how efficient (or disruptive) it really is.
Utah: App Retailer age verification
Utah’s App Retailer Accountability Act, SB 142, technically took impact final 12 months. However app shops got till Could sixth of 2026 to start out verifying customers’ ages with “commercially accessible strategies” and require parental consent in the event that they detect minors. One last piece — letting minors or their dad and mom sue for damages if app shops don’t comply — will take impact on December thirty first.
Colorado’s SB 24-205 is a named goal of the Trump administration’s battle on state AI legal guidelines. It requires AI firms to reveal details about high-risk techniques, and extra particularly, take “cheap care to guard shoppers” from algorithmic discrimination. Initially slated for February, it’s now set to take impact June thirtieth as an alternative.
Arkansas: Youngsters’s privateness
HB 1717 is a youngsters’s knowledge privateness rule much like the federal COPPA regulation and the proposed COPPA 2.0, barring on-line providers from amassing pointless private knowledge in the event that they’re geared toward minors or know a person is underage. It takes impact July 1st.
Utah’s HB 418, dubbed the Digital Selection Act, goals to make social media networks much less sticky by letting you progress knowledge between them. A writeup from Harvard’s Ash Middle explains the nuances, however broadly, it requires social media firms to implement open protocols that enable customers to share private knowledge throughout totally different providers. Europe has mandated knowledge portability for years and the outcomes haven’t been revolutionary, however there’s nonetheless an opportunity it might promote extra competitors on a centralized internet. Its enforcement date can also be July 1st.
Did you assume we had been carried out with California AI legal guidelines? Nicely, a delay pushed again the unique January goalpost for SB 942, which requires the federal government to develop requirements for AI detection techniques and requires lined suppliers to make such instruments accessible. Now its first provisions kick in on August 2nd, with further necessities for firms taking impact in 2027 and 2028. It’s taking over a severe subject, but in addition an incredibly messy one — and like different guidelines, it is determined by preserving the precise to state-level AI legal guidelines.