Following a few years of growing interest in technology policy among state legislators, 2024 saw a significant increase in the number of bills addressing a wide range of tech topics, including artificial intelligence (AI), children’s online safety, and consumer data privacy, among others. Additionally, notable proposals in states such as California, Florida, Minnesota, Maryland, New York, and Vermont, swiftly moved through the legislative process. With a growing number of states having trifecta control—where the same party holds the governor’s office and both legislative chambers—it became increasingly challenging for problematic proposals to be halted or amended during state legislative sessions. As of August 19, 2024, there are 23 Republican trifectas, 17 Democratic trifectas, and 10 divided governments where neither party holds trifecta control.
In 2024, another major shift occurred with the widespread integration of AI into everyday life, which in turn sparked a heightened eagerness among legislators to regulate AI’s use and its impacts. With these dynamics at play, it has become increasingly important to emphasize that state-level tech policies can profoundly impact digital services operating both nationally and internationally, affecting not only large corporations but also smaller businesses and startups. While policymakers are right to focus on services that contribute significantly to the U.S. economy, it’s essential to also consider the potential adverse effects on consumers and innovation, as well as the legal implications of the bills and regulations they advance. Many proposals raise serious constitutional concerns and may conflict with federal laws such as Section 230.
So, what developments occurred in the state tech policy landscape in 2024, and what should we expect for 2025?
Consumer Data Privacy
As of writing, 19 states have passed some form of consumer data privacy legislation into law, including Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island, which passed laws during the 2024 legislative session. Additionally, three states (Texas, Florida, and Oregon) had their privacy laws go into effect on July 1, with Montana’s law set to go into effect later this year, on October 1. For the most part, the majority of the states who took up data privacy this year sought to promote interoperability and passed legislation that were, by and large, aligned with other states’ laws existing privacy laws. Maryland’s law is an exception to this trend, as the new law includes strict and restrictive provisions concerning data minimization. Law in this area has typically focused on prohibiting certain practices and acts that pose too much risk to consumers or offer no benefits. Maryland’s stricter approach to data minimization would prevent covered businesses from having such flexibility to use collected data for new and potentially-beneficial uses. This, in turn, could negatively impact innovation and business in the state.
Additionally, health data privacy was still a topic of interest for legislators in 2024, with the first two state health data privacy laws, in Washington and Nevada, both going into effect earlier this year.
Online Safety and Content Moderation
This year witnessed a surge in proposals aimed at strengthening online protections for young people. While many digital services invest in tools, settings, and features to enhance privacy and safety measures across social media and all corners of the internet, some legislative proposals extend beyond these essential safeguards in problematic and concerning ways. Many lawmakers advanced laws under the pretense of protecting children, but in reality, these measures impose content moderation mandates and curtail First Amendment-protected speech. Proposals generally differ across party lines with Republicans passing laws requiring age verification and parental consent, such as Tennessee’s HB 1891/SB 2097, while Democrats proposed legislation requiring chronological feeds and content reporting mechanism requirements, such as California’s AB 2481.
States like Florida have banned social media use altogether for those under 16, despite the current federal standard under the Children’s Online Privacy Protection Act (COPPA), which sets the minimum age at 13. While other states, like New York, attempt to take a different approach, looking to regulate the “algorithms” utilized on social media platforms as a means of trying to limit teens’ use of such sites. New York’s law requires social media companies to conduct some form of age verification for all of their users, and an ongoing rule-making process conducted by the Attorney General will provide further clarity as to what that will entail, though pending litigation in other states could signal a similar fate for New York’s law.
As states continue to pass laws that conflict with federal standards and infringe upon the First Amendment, further litigation is likely. Courts have enjoined laws requiring content moderation on websites in Arkansas, California, Florida, Mississippi, Ohio, and Texas. A similar law in Utah is also facing legal challenges, though a decision on whether to enjoin the law is still pending. As more decisions are handed down by the courts, lawmakers should pass legislation that aligns with these rulings and existing law.
With that in mind, many lawmakers continued to strengthen their privacy measures for children online consistent with federal law and constitutional protections. For example, Virginia’s HB 707/SB 361 provided enhancements to Virginia’s consumer data protection framework that went into effect in 2023, by adding additional protections for children such as prohibiting a controller from processing the personal data and geolocation of a known child among other things. These guardrails establish common sense practices that simplify compliance for businesses while ensuring robust protection of children’s online data.
Artificial Intelligence
The year 2024 marked a significant turning point in the tech landscape with the widespread integration of AI into everyday life for many Americans. From using generative AI to draft emails to quickly finding answers to questions, AI has become an integral part of daily routines. However, the rapid adoption of AI also brought to light several challenges, including digital replicas of individuals’ likeness and potential biases in employment decisions. These concerns prompted lawmakers to take action to protect their constituents from the potential implications of AI. Yet, in a twist of overcorrection, some legislators introduced regulations that went too far, imposing infeasible laws that stifle innovation rather than fostering it.
This year, many tech industry advocates found themselves searching for the elusive “sweet spot” in AI legislation—striking a balance between protecting consumers and fostering innovation, all while ensuring the industry remains competitive. Some proposals that accomplished this goal were Minnesota’s HF1370/SF1394 criminalizing the creation of sex-related deepfakes, Illinois’ HB 3773 regulating the use of AI in employment decisions by employers to protect against discrimination based on the basis of protected classes, and Arizona’s SB 1359 that would make it illegal for anyone to distribute fake or manipulated media (deepfakes) about a political candidate or party without including a clear disclosure that it’s not real. The common thread among these states and their respective bills is that they aim to hold bad actors accountable while adhering to federal laws like Section 230 and the First Amendment. By doing so, they craft policies that seek to protect their citizens without risking a lawsuit that could invalidate the law and ultimately leave everyone unprotected.
Unfortunately, states like California and Colorado took a different path, introducing proposals that disregarded federal law and could end up stifling innovation. In Colorado, SB 205 was introduced by Senator Rodriguez (D). When the bill passed the legislature and was sent to Governor Polis (D) for signature, the Governor insisted that more work be done during the 2025 session to “work closely with stakeholders to craft future legislation for my signature that will amend this bill to conform with evidence based findings and recommendations for the regulation of this industry.” Since then, Gov. Polis, Colorado Attorney General Phil Weiser, and Sen. Rodriguez issued a letter to “innovators, consumers, and all those interested in the AI space” outlining their commitments to address specific concerns.
Although the California legislative session doesn’t end until September 1, several problematic AI-related bills remain in play. The most contentious of these is SB 1047, introduced by Senator Wiener (D). This sweeping bill, projected to cost millions to implement, aims to regulate AI, among other ways, by defining key terms critical to AI innovation, including the term “artificial intelligence” itself. It mandates that AI developers complete a range of tasks before training or releasing an AI model to the public and establishes a new “Frontier Model Division” within the California Department of Technology to oversee and enforce these regulations. Due to the bill’s controversial nature, numerous organizations and federal legislators, including Speaker Emerita Nancy Pelosi, have voiced their opposition. The fate of this bill is one to watch as the 2024 California legislative session comes to a close.
Takeaways from 2024 Legislative Sessions/Closing
As 2024 state legislative sessions largely draw to a close, there is much in the tech policy space to reflect on. While many proposals raised concerns regarding constitutionality, conflicts with federal law, and risks of stifling innovation, others adeptly threaded the needle of addressing perceived concerns while maintaining constitutional protections and allowing consumers to still benefit from technological advances. When state lawmakers return to state capitols in 2025, they will undoubtedly continue their focus on data privacy, online safety, and AI, among other topics. The measured and practical approaches adopted in other states can serve as an example as they forge ahead.
