Learn about the new technology laws of 2026

As usual, 2025 was a year of profound dysfunction in the US Congress. But state legislatures have been passing laws governing everything from artificial intelligence to social media to the right to repair. Many of these laws, along with rules passed in past years, will go into effect in 2026 — either now or in the coming months.

Starting January 1, Americans should have the right to crypto ATM refunds in Colorado, large-scale electronics repairs in Colorado and Washington, and AI system transparency in California, among other things. But a last-minute court ruling offered a reprieve on one high-profile state law: Texas’ App Store-based age verification rule.

For a longer summary of the technology-related regulations that will take effect in 2026 — including a key part of one federal law, the Take It Down Act — read on.

California: AI transparency, chatbots, and more

California passed a set of rules related to artificial intelligence last year. The most notable of these is SB 53: the Transparency Act that would require major AI companies to publish safety and security details and protect whistleblowers. It is a revised version of SB 1047, which Gov. Gavin Newsom vetoed after a heated battle in 2024, and will take effect on Jan. 1, 2026.

Several other bills Dealing with more specific applications of artificial intelligence. Among them SB 243one of the first regulations on so-called companion chatbots, requiring them to maintain protocols to prevent suicidal ideation and self-harm, as well as reminding known underage users every few hours that the system is not human. SB 524another of the bills, would require law enforcement agencies to “clearly” disclose how they use artificial intelligence.

All of this makes California a test case for how far state AI laws can go, especially as the Donald Trump administration aims to Block them completely. This battle is also expected to end in 2026.

Colorado: Right to ATM Repair and Cryptocurrency

Colorado passed one of the country The most comprehensive right to repair rules In 2024, which will require manufacturers to facilitate repairs of a wide range of electronic devices. that law, HB24-1121will finally start this year. The state is also adding consumer protections to a major vector of fraud: cryptocurrency ATMs, which — because they allow users to convert fiat money into cryptocurrencies and send them to an anonymous wallet — have reportedly helped scammers extract them. Hundreds of millions of dollars One of this year’s victims SB25-079 It requires daily transaction limits for new and existing customers, as well as refund options for first-time users transferring money outside the US — a key sign that they may have been sending money because they were scammed by a scam.

Idaho: Protecting Speech

Idaho joins the long list of states with laws against strategic lawsuits against public participation, or anti-SLAPP laws, with SP1001. Although not technically a law, SLAPP suits have been a key weapon for tech billionaires like Elon Musk, and limiting them helps prevent what could happen. It amounts to Internet censorship. A A much-needed federal law It is still nowhere to be seen.

Illinois: Privacy of Public Officials

Starting this year, Illinois will restrict the sharing of personal information to public employees upon their request. H.B. 576 Covering members of the General Assembly and former members, public defenders, and county employees, among others, the information covered includes home addresses, home phone numbers, personal email addresses, and the identity of children under the age of 18. The goal is to prevent harassment – which is increasing Notable case – As officials who “administer their public duties.”

Data privacy is another area that Congress has long neglected but that states have taken up, with very mixed results. Indiana Consumer data protection law It aims to provide a Data Consumer Bill of Rights that includes obtaining, correcting, and deleting personal information the company holds about you. But data privacy and consumer protection groups denounced the law as toothless – A 2025 Privacy Report Card By PIRG and the Electronic Privacy Information Center (EPIC) gave it an F grade.

HP 15 It is another data privacy framework that failed PIRG/EPIC’s 2025 assessment. Both Kentucky and Indiana fall under what this report calls the “Virginia Model”: a framework they claim allows companies to “continue collecting any data they want as long as they disclose it somewhere in the privacy policy,” while making opting out onerous.

As with many regulations, the federal rule prohibits subscriptions that are difficult to cancel He is in legal hellbut some countries have intensified. Who is joining them? LD1642a rule modeled on Federal Trade Commission (FTC) standards — which means, among other things, making companies disclose the terms of subscriptions and offer a cancellation method as simple as a sign-up system.

Nebraska: Age-appropriate design

504 lbs It’s one of several nationwide “age-appropriate design” rules — it restricts app features like notifications, in-game purchases and infinite scrolling for kids, aiming to combat compulsive use by stopping “dark patterns” that keep kids online. The code was similar Banned in CaliforniaHowever, a legal challenge may arise later this year.

with A B 73Nevada joins A large number of countries Trying to curb undeclared election campaigns that rely on artificial intelligence. Its disclosure rules include allowing candidates to sue if they find themselves starring in unwelcome, unclassified ads generated by artificial intelligence.

Oklahoma: Data Breach Notifications

The state of Oklahoma is expanding its data breach reporting rules by SB 626including by expanding it to include biometric data and introducing some new safe harbors to avoid legal damages.

Oregon: Deepfakes, data privacy, and ticket dealers

HP 2299 AI-generated (or digitally manipulated) images add to its ban on non-consensual sexual images – a move seen in Almost every country Since 2019. HP 2008 It prohibits data collectors from selling personal information and targeting ads using data from users they know to be under 16, adding a similar prohibition for all ages for precise geolocation data. and H.B. 3167 Prohibits the sale of software designed to facilitate ticket scalping bots, addressing an annoying problem The Federal Trade Commission focused on And in 2025 as well.

Rhode Island: Data Privacy

rhode island HP 7787the Rhode Island Data Transparency and Privacy Protection Act, includes rules requiring disclosure of how personal information is collected and sold. It completes the tripartite rules of the “Virginia Model” rules. Failed privacy assessment It goes into effect this year.

Texas: AI rules — but no App Store age verified (yet)

Just a few weeks ago, Texas was poised to implement a new form of online age profiling: requiring app stores to verify users’ ages and pass that information to app developers. But a local court Grant a preliminary order ban SP2420. However, the law is still worth a watch, because Texas will likely appeal to the Fifth Circuit – which is notorious for overturning lower court decisions on internet regulation.

Texas He is age H.B. 149an AI regulatory framework that prohibits the use of technology to incite harm, capture biometric identifiers, or discriminate based on characteristics such as race and gender. or “Political point of view.” This will be another test of the Trump administration’s plan to roll back state-level AI laws, highlighting the divide between state and federal Republicans on AI.

Virginia: Time limits of social media

If you are under 16 in Virginia, your screen time may have been significantly reduced. SP854 It requires social media companies to verify users’ ages and limit younger teens to one hour of usage per app per day. The parent can choose to increase or decrease this limit. Like many Internet regulations, this is the case Appeal in courtSo her final fate is still unknown.

Washington: Right to Repair

Washington passed a pair of right-to-repair laws, H.B. 1483 and SP5680in 2025. As iFixit explainsIt requires companies to provide repair materials for most consumer electronic devices, prohibits coupling of parts, and provides specific protections for wheelchair users.

the Lifting law It has been described as a landmark AI law that requires developers of large models to follow new rules of safety and transparency. But it was Noticeably stripped At the last minute, which reduces their potential impact. Regardless, it will take effect on March 19, 90 days after it was signed late last year.

Michigan: Anti-SLAPP and Taylor Swift

Michigan is another state getting a new anti-SLAPP law – HP 4045 – As of March 24th. On the same date, a package of rules will be activated Known as the Taylor Swift bills.is targeted at ticket bots and is modeled after Federal BOTS Act.

the The Take It Down law has been criminalized Distribution of non-consensual intimate images generated by artificial intelligence at the federal level in 2025, which change groups like the Cyber ​​Civil Rights Initiative (CCRI) have called long overdue. But in the words of CCRI President Mary Anne Franks, it involved a “poison pill” with Broad and vague requirements Online platforms quickly remove such images, raising concerns about censorship and enforcement. This deplatforming requirement came with a one-year implementation delay that will expire on May 19 — so we’ll soon find out how effective (or subversive) it actually is.

Utah: App Store age verification

utah App Store Accountability Act, SB 142technically came into effect last year. But app stores have been given until May 6, 2026 to start verifying users’ ages using “commercially available methods” and requesting parental consent if they detect minors. One final piece — allowing minors or their guardians to sue for damages if app stores don’t comply — will go into effect on December 31.

Colorado SB 24-205 He is a Named target From the Trump administration’s war on state artificial intelligence laws. It requires AI companies to disclose information about high-risk systems and, more specifically, take “reasonable care to protect consumers” from algorithmic discrimination. Originally scheduled for February, It’s set now To take effect on June 30 instead.

Arkansas: Children’s Privacy

HP 1717 It is a children’s data privacy rule similar to the federal COPPA law and the proposed COPPA 2.0 law, which prevents online services from collecting unnecessary personal data if they target minors or know that a user is underage. It takes effect on July 1.

Utah H.B. 418Dubbed the Digital Choice Act, it aims to make social media networks less persistent by allowing you to transfer data between them. A Writing from the Harvard Ash Center This app explains the nuances, but it broadly requires social media companies to implement open protocols that allow users to share personal data across different services. Europe has Mandatory data portability For years the results have not been revolutionary, but there is still an opportunity to foster more competition on a centralized web. The implementation date is also July 1.

Do you think we’re done with California’s AI laws? Good, delay The original January goal post was pushed back SP942which requires the government to develop standards for AI detection systems and requires covered service providers to make these tools available. Its first provisions now come into effect on August 2, with additional requirements for businesses coming into effect in 2027 and 2028. It’s a serious matter, but it’s also… An incredibly messy one Like other rules, it depends on preserving the right to AI laws at the state level.