Key Issues Shaping State-Level Tech Policy

We’re taking a moment to reflect on the 2024 state legislative session and what it means for the future of digital rights at the state level. Informed by insights from the State of State Technology Policy 2024 report by NYU’s Center on Technology Policy and EFF’s own advocacy work in state legislatures, this blog breaks down the key issues (Privacy, Children’s Online Safety, Artificial Intelligence, Competition, Broadband and Net Neutrality, and Right to Repair), taking a look back at last year’s developments while also offering a preview of the challenges and trends we can expect in state-level tech policy in the years ahead. 

To jump ahead to a specific issue, you can click on the hyperlinks below: 

Privacy

Children’s Online Safety and Age Verification

Artificial Intelligence

Competition

Broadband and Net Neutrality

Right to Repair

Privacy

State privacy legislation saw notable developments in 2024, with Maryland adopting a stronger privacy law that includes enhanced protections, such as prohibiting targeted advertising to teens, requiring opt-in consent to process health data, and broadening the definition of sensitive data to include location data. This places Maryland’s law ahead of similar measures in other states. In total, seven states—Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island—joined the ranks of states with comprehensive privacy laws last year, regulating the practices of private companies that collect, store, and process personal data. This expands on the 12 states that had already passed similar legislation in previous years (for a total of 19). Additionally, several of the laws passed in previous years went into effect in 2024.

In 2025, states are expected to continue enacting privacy laws based on the flawed Washington Privacy Act model, though states like Maryland have set a new standard. We still believe these bills must be stronger. States will likely also take the lead in pursuing issue-specific privacy laws covering genetic, biometric, location, and health data, filling gaps where federal action is unlikely (or likely to be weakened by business pressure).

Private Right of Action

A key issue in privacy regulation remains the debate over a private right of action (PRA), which is one of EFF’s main recommendations in comprehensive consumer privacy recommendations and would allow individuals to sue companies for privacy violations. Strong enforcement sits at the top of EFF’s recommendations for privacy bills for good reason. A report from the EPIC and the U.S. PIRG Education Fund highlighted that many state privacy laws provide minimal consumer protections largely due to the absence of private rights of action. Without a PRA, companies are oft