Skip to content

State Children’s Privacy Law Tracker / Changelog

Tracker changelog

The State Children’s Privacy Law Tracker is a litigation-aware map of US state law for shipping connected products to kids. It is reviewed monthly, and court-order changes land within the week. This page records every change to the dataset: what moved, and in which state. The current data is dated October 1, 2026. For the machine-readable version, download the JSON export.

Monthly refresh, run by hand.

All 108 tracked laws in all 51 jurisdictions were re-read against their primary sources and confirmed in a browser, one researcher per state, with an independent check on every proposed change, so asOfDate moves to 2026-10-01. The pending-bill threshold (a bill is tracked once it passes at least one chamber) is applied for the first time: 18 pending bills that never left their house of origin, or died there, are dropped (Michigan 6, Pennsylvania 4, Illinois 2, Virginia 2, and one each in New Jersey, New York, Ohio and Tennessee). 13 laws and bills are added: ten conversational-AI entries (California AB 1064, vetoed; Maine L.D. 1727 and Utah SB 226, in force; Illinois SB 316, Massachusetts c. 93N, New York S 9408-A and A 3411-B, Pennsylvania SB 1090 and HB 2006, and Virginia SB 796, pending) and three pending comprehensive-privacy bills (Illinois, Massachusetts, Pennsylvania). Pennsylvania’s map tile moves from pending to none, because every remaining Pennsylvania entry is an AI or comprehensive bill. Federal: Senate Commerce advanced four of the five kids’ bills on 2026-08-05, not all five; the SCREEN Act needs a revote. Every AI-chatbot law now also records the strongest rule it imposes on minors' access to the AI itself (bans minors, parental consent required, blocks features for minors, off by default for minors, bans chatbot toys, age check without a block, or safeguards only), read from the enacted text, or the latest passed version for a bill, and confirmed in a browser; three laws are re-filed so the AI view is complete, with no map change.

Dataset held 108 tracked laws & bills after this change.

  • Result, 28 AI laws: no enacted law bans minors from AI chatbots. Enacted rules that limit access are off-by-default settings (California SB 243 as amended by SB 1119, from 2027-07-01; New York Safe by Design, from 2027-01-01; Nebraska LB 504 as amended by LB 838), a feature block behind age assurance (Georgia SB 540, from 2027-07-01) and a chatbot-toy sale ban (California SB 867, from 2027-01-01). Colorado HB26-1263 requires an age estimate but blocks nothing. The rest add safeguards only. The stronger rules are in bills: a conditional ban in vetoed California AB 1064 (minors barred from companion chatbots that fail its safety conditions), parental consent in Pennsylvania HB 2006, feature blocks in Michigan SB 760 and New York S 9051-B, and a chatbot-toy ban in New York S 9408-A.
  • Michigan: SB 760 (LEAD for Kids Act) re-filed from social media to AI companion: it is a standalone chatbot bill with no social-media provisions. Michigan's map tile is unchanged (pending).
  • New York: Safe by Design Act (GBL Art. 45-B) also tagged AI companion: GBL 1540(7) keeps integrated AI companions off by default for minors. It stays filed under social media, so the map is unchanged.
  • Nebraska: Age-Appropriate Online Design Code (LB 504 as amended by LB 838) also tagged AI companion: 87-1302(3)(k) lists a feature that increases usage through the illusion of talking with a human being seeking intimacy, and 87-1304(3) sets every opt-out safeguard to the most protective default, so that feature starts off for known minors. The requires text now says the defaults start switched off rather than calling them opt-out controls.
  • Colorado: HB26-1263: requires now says operators estimate the age of account holders or users, as the statute reads (it said and).
184 more changes · 44 states
  • Alabama: AL APDPA: requires rewritten. Removed the sentence saying the Act adds nothing beyond COPPA, which contradicted its own 13-15 consent rule, and the unsourced '21st state' claim. Added parent rights, the AG's 45-day notice-and-cure and the $15,000 per-violation cap.
  • Alabama: AL APDPA: sourceUrl moved from the Secretary of State image scan to the ALISON enrolled text (same Act 2026-552).
  • Alabama: AL HB161: litigation adds the Fifth Circuit argument in the Texas SB 2420 appeal (2026-08-04, no merits decision yet). Dropped an unsourced AG-statement clause. Still no suit found against Alabama's law.
  • Alabama: AL HB161: requires age-verification wording aligned to Sec. 2 (commercially available methods, or a system that complies with AG rules).
  • Alabama: out-of-scope list added (HB 164 adult-site age verification; SB 186 device obscenity filter).
  • Alaska: re-checked the whole 34th Legislature (681 bills; 87 chaptered, 28 vetoed, none awaiting the governor); no in-scope law, laws stay empty.
  • Alaska: added out-of-scope notes for HB 47 (House-passed Alaska Social Media Regulation Act, stripped by the Senate substitute, still in Senate Judiciary at the 2026-05-20 adjournment) and for HB 318, SB 262, HB 46 and HB 367 (never passed their house of origin).
  • Arizona: AZ HB 2311 (vetoed): corrected requires against the final Senate-engrossed text. The sexual-content safeguards covered all account holders, not only minors, and the bill would have taken effect from and after 2027-09-30, i.e. 2027-10-01.
  • Arizona: AZ out-of-scope list: replaced the HB 2991 note, which pointed at a tracked entry that does not exist. HB 2991 and identical SB 1747 died at the 2026-06-13 sine die; neither became law.
  • Arkansas: AR Act 901: effectiveDate 2025-08-03 -> 2025-08-05 (Ark. AG Op. 2025-032; 08-03 was the Sunday the 90-day window would have closed, not the effective date); effectiveNote added.
  • Arkansas: AR Act 901: requires/ages rewritten. The design-harm ban covers any user. The private right is the parent's suicide-harm suit (under 16), and the $10k penalty attaches to that section, per the W.D. Ark. PI order.
  • Arkansas: AR Act 901: litigation notes that the PI binds the AG and prosecutors against NetChoice members only and does not reach the parent's private action in 4-88-1503(b).
  • Arkansas: AR Act 900: ages/appliesToUnder 18 -> 16 (sec. 1 lowers 'minor' to under 16; no under-18 provision remains).
  • Arkansas: AR Act 900: effectiveNote added for the staged date (Section 2 from 2026-04-21, other sections 2025-08-05 by default); requires now covers the addictive-practices ban, quarterly audit, parent dashboard and anti-circumvention duty.
  • Arkansas: AR Acts 689/900/901: 8th Cir. briefing updated. State's Act 900 opening brief filed 2026-08-10 (Act 901 brief 2026-04-09); NetChoice's combined response in 26-1096/26-1962 extended to 2026-10-09; no argument date. Dropped the stale 'consolidated opening brief' and clerk-notice wording.
  • Arkansas: AR Act 952: requires no longer says the act mandates parental consent for under-13s; its consent duty covers teens (teen or parent).
  • Arkansas: AR out-of-scope list: Act 612 of 2023 in force 2023-08-01, not 2023-07-31 (Ark. AG Op. 2023-031).
  • California: CA SB 976: litigation restated from the orders. 2024-12-31 PI enjoins H&S 27002(a), 27002(b)(1), 27005 (unappealed); 9th Cir. 25-146 reversed only on the like-count default 27002(b)(3) and remanded to enjoin it; en banc denied 2025-11-06, mandate 2025-11-14, no cert petition. Old text said 'UPHELD' and 'enjoined ONLY the like-count'.
  • California: CA SB 976: added Meta / TikTok / Google v. Bonta (N.D. Cal. 5:25-cv-09792/09789/09795): PI denied 2026-08-05 ('Bonta may enforce' 27001(a), 27002(b)(2), 27002(b)(4)); injunction pending appeal denied 2026-08-21; 9th Cir. 26-5120/5121/5132 referred IPA motions to the merits panel 2026-09-17. Status stays in_force.
  • California: CA SB 976: requires now names the enjoined provisions; sourceUrl moved from the 9th Cir. opinion to codified H&S Ch. 24; billNumber gains Ch. 321, Stats. 2024.
  • California: CA SB 243 / SB 1119: requires adds the under-16 disable-access parental control (B&P 21812(d)(3)(B)(ii)), the no-linked-parent lock on defaults (21812(d)(3)(D)) and the 16-17 memory carve-out.
  • California: CA AB 1064 (LEAD for Kids Act) added as a vetoed ai_companion entry: vetoed 2025-10-13, veto consideration stricken 2026-01-22.
  • California: CA evaluated, not added: SB 903 vetoed 2026-09-30 (AI therapy); AB 1609 Ch. 733 (support bots); AB 1979, AB 1705, SB 1247, AB 2007 signed 2026-09-30 (out of scope); AB 2561 Ch. 478; AB 2023 and SB 300 dead on the inactive file.
  • California: CA re-verified, no change: AB 1043/AB 1856, AB 56, CAADCA/AB 2246, CCPA 1798.120, AB 1709, SB 867.
  • Colorado: CO HB24-1136: 10th Cir. vacated the 2026-11-16 argument on Colorado's unopposed motion (No. 25-1456, entries 92-93, 2026-09-22); no new date yet and the case is not on the November calendar. Injunction scope restated as all of Section 4 (C.R.S. 6-1-1601, both options); district case stayed pending appeal.
  • Colorado: CO HB24-1136: effectiveNote added (act effective 2024-08-07; platform duty 2026-01-01, enjoined; resource bank 2025-07-01).
  • Colorado: CO SB26-051: requires corrected to the enacted penalty ($2,500 per minor harmed by each negligent violation, $7,500 per minor harmed by each intentional one) plus app-side duties; effectiveNote adds the 2029-01-01 existing-device deadlines (C.R.S. 6-30-103).
  • Colorado: CO SB24-041: requires corrected: the no-consent bar covers targeted ads, sale and significant-decision profiling; precise geolocation is allowed without consent only if necessary, time-limited and signaled to the minor.
  • Colorado: CO HB26-1263: requires corrected (rewards ban limited to unpredictable intervals; tools for both minor and parent); effectiveNote now says in force since 2026-08-12 with no referendum on the 2026 ballot; litigation narrowed to this act.
  • Colorado: CO out-of-scope list: SB25-201 and HCR26-1002 annotated as dead; HB25-1231 removed (criminal-conduct bill, not age verification).
  • Connecticut: CT PA 26-15 Sec. 39: requires adds the daily Surgeon General warning (default for anyone not determined an adult), the 9 p.m.-8 a.m. notification curfew, default settings, parent resets, annual disclosures from 2028-03-01 and the CUTPA hook; ages notes the warning default.
  • Connecticut: CT PA 26-15 Secs. 4-6 (AI companions): requires expanded to the Sec. 5 crisis protocol, anti-impersonation and notice cadence, the full Sec. 6 list, parental tools and AG-only enforcement; ages now notes the hourly under-18 notice has no knowledge qualifier; sourceUrl now the public act PDF.
  • Connecticut: CT PA 25-113 (42-529a/b): requires adds the targeted-ad/sale ban, data-minimization limits and consent-gated significant-decision profiling; effectiveNote no longer pins the 42-522 2026-08-01 impact-assessment date on the minors' assessment.
  • Connecticut: CT CTDPA minors: billNumber adds PA 25-113 and PA 26-64; requires notes PA 26-64 re-enacts 42-520(a) from 2026-10-01 with the minors rule unchanged.
  • Delaware: DPDPA effectiveNote updated. Delaware Code ch. 12D now prints the HB 380 text (effective 2027-01-01) beside the current text and cites 85 Del. Laws c. 463; the chaptered act is still not posted online.
  • Florida: FL HB 3 (501.1736): requires drops 'verifiable'; the statute says a parent or guardian 'provides consent' and prescribes no method; 90-day dispute window applies to under-14 terminations too.
  • Florida: FL HB 3: litigation updated; CCIA supplemental briefs filed 2026-06-29 (11th Cir. 25-11881, no ruling, stay of PI still in effect); AG enforcement suits v. Snap (N.D. Fla. 3:25-cv-00676, TI and remand denied 2025-08-13, appeal 25-12814 argued 2026-03-10, undecided) and v. TikTok (St. Lucie County, e-filed 2026-06-15) added.
  • Florida: FL 501.1735: Roblox docket (M.D. Fla. 3:26-cv-00057) filings of 2026-09-11 and 2026-09-14 noted; motion to dismiss still pending.
  • Florida: FL Digital Bill of Rights: litigation field added; AG v. Roku (pleaded 501.71(2)(d) and 501.715; negotiated resolution announced 2026-06-26, no fine) and AG v. Netflix (e-filed 2026-09-09, Count V 501.715).
  • Florida: FL Digital Bill of Rights: requires now states the $1B controller threshold for the processing rule and that 501.715's sale rule binds any for-profit business doing business in Florida.
  • Florida: no new in-scope law (2026 regular session and special sessions D-F); AI companion bills SB 482 and SB 2-D passed the Senate and died in the House; recorded as evaluated.
  • Georgia: Georgia SB 351: requires rewritten from O.C.G.A. 39-6-2 to 39-6-4 as enacted. Age verification is one branch of a choice (verify ages, or apply the minor protections to every account holder); parental consent is 'express' consent by listed methods, not 'verifiable'; the 'treat unverifiable users as minors' default is not in the Act and is removed; AG-only enforcement terms added.
  • Georgia: Georgia SB 351: status, dates and litigation re-verified, no change. Signed 2024-04-23 as Act 463, effective 2025-07-01 (legislature status page). The preliminary injunction in NetChoice v. Carr (N.D. Ga. 1:25-cv-02422) stands: the district case is stayed and administratively closed pending appeal, and the 11th Cir. appeal (No. 25-12436), argued 2026-03-10, shows no opinion, stay or judgment.
  • Georgia: Georgia SB 540: requires adds the 39-5-6(j) age-assurance gate before any feature that can generate sexually explicit content (no sale, use only for age verification, 24-hour retention cap), corrects the minor trigger to knows-or-should-know or minor-directed, limits the parental tools to accounts known to belong to minors, and states the full carve-out list and the AG penalty.
  • Georgia: Georgia SB 540: Act 518 and the 2026-05-11 signing, previously unconfirmed, confirmed on the legislature's status page; effective 2027-07-01 unchanged; no court challenge found.
  • Georgia: Georgia SB 540: entry renamed to a descriptive name; the Act has no short title.
  • Georgia: Georgia SB 351 and SB 540: sourceUrl moved from the client-rendered legis.ga.gov bill pages to the Governor's signed-legislation PDFs of the as-passed text.
  • Hawaii: HI SB 3001 (Act 248): requires reworded to match CD1. Disclosure trigger is 'would be led to believe' it is human; the bar is on claiming to provide professional mental-health care (not 'licensed provider'); enforcement is AG or Office of Consumer Protection under HRS 480-2 (was 'AG-enforced'). Status, dates and no-litigation posture re-verified unchanged.
  • Hawaii: HI SB 3001: sourceUrl moved to data.capitol.hawaii.gov copy of the same CD1 text; www host 403s scripted source checks.
  • Hawaii: HI out-of-scope list: HB 1212 note now uses the bill's actual title (Relating to Pornographic Websites); still dead at 2026 sine die.
  • Hawaii: HI evaluated, not added: SB 2761 (app-store/social-media age verification + parental consent for under-16s) passed Senate 2026-03-10, House JHA deferred it 2026-04-01, died at 2026-05-08 sine die (biennium end); HB 1782 (AI companions/minors) passed both chambers in different drafts, no conference draft, died; HB 1753 / Act 252 (social media account deletion) has no minors' provisions.
  • Idaho: ID HB 542: requires rewritten from enacted text (Idaho Code 48-2102 to 48-2105). Adds the $1B worldwide ad-revenue coverage threshold, 14-day age-estimate windows with 80%/90% 'older than 16' tests, the seven-year account carve-out, the notice-and-dispute termination process, the reasonable-efforts defense and AG enforcement; 'public like counts' and 'algorithmic feeds' replaced with the statute's terms; parental time controls corrected to an optional separate password.
  • Idaho: ID S 1297: minor trigger corrected from 'known minors' to actual knowledge or reasonable certainty of under-18 age (48-2202(4)). requires restated from 48-2203 to 48-2205: minors' AI disclosure shown as unconditional; sexual-content limits and human-simulation limits (sentience claims, emotional dependence, romantic innuendo, adult-minor role-play) match 48-2204(3)-(4); the mental-health claim bar is limited to knowing claims; the $500,000 cap is tied to civil penalties.
  • Illinois: IL HB 5511 (PA 104-0664): requires rewritten from the enacted Act. Operators request an OS/app-store age signal and are not required to verify age themselves (Sec. 20(b)); added the reliance safe harbor, gifted-currency, night-notification, search-indexing and autoplay duties; an addictive feed for a minor is unlawful without parental consent, not merely limited.
  • Illinois: IL HB 5511: effectiveNote adds the staged dates (manufacturers 2028-01-01, age interface for older devices before 2028-07-01, operators' signal requests by 2028-07-01).
  • Illinois: IL HB 5511: litigation re-sourced. No challenge found on NetChoice's docket list or in RECAP; NetChoice v. Illinois (2026-09-11) and NetChoice v. Chicago are tax suits.
  • Illinois: IL SB 2316 dropped: never left Senate committee (last action 2025-06-02, Rule 3-9(a) re-referral); below the crossed-one-chamber bar.
  • Illinois: IL SB 51 (Age-Appropriate Design Code Act) dropped: never left Senate committee (last action 2025-04-11, Rule 3-9(a) re-referral). Corrects the 2026-09-01 entry, which said it died in committee; it was re-referred, not killed.
  • Illinois: IL SB 316 (AI Companion Model Safety Act) added as pending ai_companion: passed the Senate 57-0-0 on 2026-05-21; in House Rules since 2026-05-31.
  • Illinois: IL SB 340 (Illinois Consumer Data Privacy Act) added as pending comprehensive: passed the Senate 54-3-0 on 2026-05-21; known-child data needs COPPA parental consent, and teens 13-16 must opt in to targeted ads or sale.
  • Indiana: IN HEA 1408: requires corrected against codified IC 24-16 (ban covers content/recs/ads based on the teen's usage patterns, not all algorithmic recs; parent gets an optional separate password, not a parent account; added coverage test, demographic-data re-check, 30-day notice/termination path).
  • Indiana: IN HEA 1408: sourceUrl moved from the iga.in.gov bill page (script-unreadable shell) to the codified IC 24-16 PDF.
  • Indiana: IN HEA 1408: litigation replaced with the verified negative (no suit on NetChoice/CCIA pages or RECAP in IN federal courts / 7th Cir.); dropped the speculative 'challenge widely anticipated' clause.
  • Indiana: IN CDPA: requires tightened to the statute: known-child data must be processed per COPPA (dropped the 'actually knows' gloss), added parent's right to act for a known child.
  • Indiana: IN out-of-scope list: HB 1321 (2025) note now records it never left House Judiciary.
  • Iowa: added a new out-of-scope list with HF 864 / 2026 Iowa Acts ch. 1143, adult-content age verification (sites/apps with 33%+ content pornographic for minors), approved 2026-06-01, effective 2026-07-01.
  • Iowa: ICDPA and SF 2417 browser-verified against chaptered text, bill history and the 2026 Code & Acts Sections Amended report; no field changes.
  • Kentucky: KY KCDPA: sourceUrl repointed from the HB 15 status page (no minors text) to the chaptered act, 2024 Ky. Acts ch. 72.
  • Kentucky: KY KCDPA: requires reworded. Consent and COPPA processing are alternatives under KRS 367.3617(1)(e), not cumulative. The COPPA safe harbor is scoped to parental-consent obligations (KRS 367.3613(4)). Dropped the 'Virginia model' framing.
  • Louisiana: LA Act 456 (SB 162): litigation restated from the dockets; the 2025-12-15 permanent injunction covers ten named NetChoice members only (as-applied, facial challenge not reached); 5th Cir. No. 26-30016 argued 2026-09-01, undecided; No. 26-30223 is the State's fees appeal, not an appeal of the injunction.
  • Louisiana: LA Act 456: requires rewritten from the enrolled act (verify-or-protect-everyone disjunction, 5M-account threshold, express parental consent); sourceUrl moved from the bill-status page to the enrolled act; effectiveNote added on the Act 656 effective-date amendment and the court's 2025-07-01 recital.
  • Louisiana: LA Act 185 (HB 977): removed the unsupported 'accurate age ratings' duty; developer age-signal duties restated as mandatory; consent gate now lists pre-loaded apps and enabling in-app purchases.
  • Louisiana: LA Act 185: litigation line dropped an unsourced NetChoice-intent claim and the stale 'preliminarily-enjoined Texas/Utah' reference; no challenge found.
  • Louisiana: LA Act 656 (HB 577): requires now says account holders, not users; adds the actual-knowledge minor definition and the residency/age-estimation safe harbors.
  • Louisiana: LA Act 502 (SB 386): known-child rule restated as consent-or-COPPA (disjunctive), applicability thresholds added; cure window tied to the AG's pre-investigation notice; speculative 'too newly signed for suit' replaced with a checked no-challenge line.
  • Louisiana: LA out-of-scope list: Material Harmful to Minors Act now cited as enacted at R.S. 9:2800.28 and codified at R.S. 9:2800.29.
  • Maine: added L.D. 1727 / PL 2025 ch. 294 (10 M.R.S. ch. 241, §1500-DD), age-neutral AI chatbot disclosure in trade and commerce, in force since 2025-09-24; ai_companion, so ME rollup stays none; lawCount +1.
  • Maryland: MD Kids Code: litigation updated from the docket; Second Amended Complaint (dormant Commerce Clause claim) allowed 2026-07-07 (ECF 90-91), answered 2026-08-04 (ECF 98); discovery referred to MJ Coulson, protective-order ruling 2026-09-23 (ECF 111); no injunction, stays in_force.
  • Maryland: MD Kids Code: requires corrected; default settings must offer 'a high level of privacy' (Com. Law 14-4805(3)), not the 'highest level'.
  • Maryland: MD MODPA: requires corrected; known-child data is sensitive data usable only where strictly necessary for a requested product or service and never sold; the old 'consent in accordance with COPPA' wording was wrong (14-4707(a)(1)-(2)).
  • Maryland: MD MODPA: recorded 2026 amendment HB 711 (Ch. 874, eff. 2026-07-01); under-18 targeted-ad and sale bans unchanged; sensitive data now includes data a controller infers to indicate a sensitive category.
  • Massachusetts: MA S.2581 (House social-media/school-phone version): renamed to the House's own title for its version (old name matched no bill version); sourceUrl moved from the frozen H.5366 amendment page to the S.2581 page that carries the conference history; dropped a dangling 'see newLaws' pointer and an unsourced advocacy line; requires now notes the Senate version has no social-media provisions. Status unchanged: in conference since 2026-05-20.
  • Massachusetts: MA S.3175 (addictive feeds): requires corrected - the AG's regulations, not platforms, must include an age-check method that avoids government ID and biometrics, and nonprofit and open-source platforms are excluded by definition, not optionally exempted; effectiveNote added (text dates: in effect 2027-08-01, AG rules by 2027-03-01); informal-session rule wording narrowed to what Senate Rule 7 and House Rule 44 say. Status unchanged: in House Ways and Means since 2026-07-15.
  • Massachusetts: MA added: S.2619, Massachusetts Data Privacy Act minors' provisions (pending, comprehensive). Passed both chambers in different versions; in conference since 2026-06-17. Both versions bar targeted ads to, and sale of, minors' data.
  • Massachusetts: MA added: H.5576 / S.3228 proposed G.L. c. 93N, chatbot disclosure by commercial entities (pending, ai_companion, age neutral). Senate-only text; in conference since 2026-07-30.
  • Michigan: MI SB 757: requires rewritten from the Senate-passed S-1 text; the feed ban covers every user unless the operator has determined the user is not a minor or has parental consent, not only known minors.
  • Michigan: MI SB 758: renamed to its statutory short title (Kids Code Act); requires rewritten from the Senate-passed S-2 text; effectiveNote records the July 1, 2026 date in the text and the tie bar to SB 759.
  • Michigan: MI SB 759: renamed; requires corrected: the bill only makes violating the kids code act an unfair practice under the Michigan Consumer Protection Act (the duties listed before belong to SB 758).
  • Michigan: MI SB 760: requires rewritten from the Senate-passed S-1 text; binds narrowed to operators; billNumber, ages and effectiveNote added; dangling 'see chatbotLaws' pointer removed.
  • Michigan: dropped HB 4388, SB 190, HB 4429, SB 284, HB 5357 and SB 359 under the cross-one-chamber rule; none has passed its house of origin. Michigan now tracks SB 757-760, all pending in House Communications and Technology.
  • Minnesota: MN HF 4138: sourceUrl repointed to 2026 Minn. Laws ch. 111 (the bill-status page shows a wrong 07/01/2026 effective date).
  • Minnesota: MN HF 4138: requires corrected from ch. 111: $10,000 is a floor (greater of actual or statutory damages), six addictive features not three, AG enforcement limited to knowing/reckless violations, no-sale rule for child-account data added.
  • Minnesota: MN HF 4138: NetChoice filed its PI motion in No. 0:25-cv-02741 on 2026-09-15; it targets 325M.33(1)-(5) only, not HF 4138. 'Threatened a challenge' narrowed to the veto-letter opposition.
  • Minnesota: MN MCDPA: signedDate corrected 2024-05-19 -> 2024-05-24 (ch. 121 signature block).
  • Minnesota: MN warning label: requires notes MDH's guidelines were rescinded and reissued 2026-06-01 with a single prescribed label; litigation adds the State's 2026-08-12 reply; the AG enforcement pause is now sourced to the office's 2026-07-01 statement, and the entry notes that no stipulation or order records it.
  • Mississippi: MS HB 1224: requires rewritten from the enacted (as-sent-to-governor) text; the old text described the pre-conference committee substitute (age verification, parental consent, safe harbor), none of which is in the law. It is a misrepresentation / addictive-design defective-product statute with AG and narrow parent remedies.
  • Mississippi: MS HB 1224: sourceUrl repointed from the committee substitute (HB1224CS) to the as-sent-to-governor PDF (HB1224SG); no-suit statement narrowed to the sources re-checked.
  • Mississippi: MS HB 1126: requires corrected to the act's social-interaction coverage test, 'express' (not 'verifiable') parental consent, harmful-material-only ad limit, knowing-and-willful penalty condition, and the parent-only declaratory/injunctive action.
  • Mississippi: MS HB 1126: litigation now cites the live appeal (5th Cir. No. 25-60348) and the as-applied scope of the 2025-06-18 injunction (eight NetChoice members); injunction still stayed, no decision after the 2026-02-03 argument; status unchanged (in_force).
  • Mississippi: SB 2346 (2023) adult-content age-verification law recorded in the out-of-scope list.
  • Montana: MT SB 297: under-13 consent restated as parent/guardian consent that COPPA VPC satisfies (statute deems COPPA compliance sufficient; it does not require it), in both ages and requires.
  • Montana: MT SB 297: requires now lists the direct-messaging safeguard against unsolicited contact from unconnected adults (MCA 30-14-2811(3)(b)), with its email/private-messaging exemption.
  • Nebraska: NE LB 383: requires rewritten from Neb. Rev. Stat. 86-1702/86-1703. The age check covers people opening an account on or after 2026-07-01, not every user (the Act's 'user' has no account). Added parent-consent verification, revocation, the AG penalty and the private civil action.
  • Nebraska: NE LB 383: sourceUrl moved from the omnibus slip law to codified 86-1703 (Sec. 28, the section the injunction addresses).
  • Nebraska: NE LB 383: NetChoice v. Hilgers docket re-read. Newest D. Neb. entry is still 48 (2026-09-04), and the 8th Cir. public search shows no opinion or argument in 26-2478 or 26-2486. Preliminary injunction posture unchanged.
  • Nebraska: NE LB 504: effectiveNote narrowed. 87-1309 delayed only AG civil-penalty actions to 2026-07-01.
  • Nebraska: NE LB 525: requires and ages now cover the Sec. 14(5) parent/guardian tools for minors 13-17, say 'reasonable measures to prevent' instead of 'block', and drop the false 'caption reads agricultural' line.
  • Nebraska: all four laws re-verified against primary sources. No status or date changes; Data Privacy Act sections 87-1101 to 87-1130 still unamended since LB 1074.
  • New Hampshire: New Hampshire HB 1460: removed the self-expiring '(after today, so not yet in force)' from requires. Status enacted_future, signed 2026-06-19 (Ch. 168) and effective 2027-01-01 re-verified on gc.nh.gov; no change. The merged RSA 507-H:6 now carries I(e-1) with Source '2026, 168:1, eff. Jan. 1, 2027'.
  • New Hampshire: New Hampshire RSA 507-H (SB 255) minors' provisions re-verified unchanged: Ch. 5, approved 2024-03-06, effective 2025-01-01. RSA 507-H:6, I(d) and I(g) and 507-H:3, III match the requires text. No challenge found on CourtListener (D.N.H., 1st Cir.).
  • New Hampshire: New Hampshire HB 143 (Laws 2025, ch. 270; RSA 639:3, III-a and RSA 507:8-k) evaluated, not added. It is a criminal-conduct and AG-enforcement statute aimed at AI chat operators, so it is outside the tracker's scope.
  • New Hampshire: New Hampshire SB 648 (2026 adult-site age verification) recorded in the out-of-scope list: passed the Senate 2026-03-26, killed Inexpedient to Legislate in the House 2026-05-14.
  • New Jersey: dropped S3993 (minor social-media consent bill). Only action is a 3/19/2026 Senate committee referral, so it fails the crossed-one-chamber rule; re-add if it passes the Senate.
  • New Jersey: NJ Kids Code (A4015, P.L.2026 c.73): requires rewritten to the enacted third reprint. The old text described introduced S3413 (profiling, heightened-risk and materially-detrimental duties that are not in the enacted act) and the superseded age-estimation deletion wording.
  • New Jersey: NJ Kids Code: ages now states the act's actual-knowledge standard (counts inferences and attributed ages); effectiveNote records 2027-09-01 as derived from the 2026-08-11 approval under sec. 17; litigation field added (no challenge found).
  • New Jersey: NJ out-of-scope list: added S1826/A5305, adult-content age-verification bills, introduced only.
  • New York: dropped S8102-B / A8893 app-store and device age-assurance bill; neither left committee.
  • New York: added S 9408-A chatbot-toy sale ban (pending; passed both houses 2026-06-01/02, not delivered to the Governor).
  • New York: added A 3411-B generative-AI inaccuracy-notice bill (pending; passed both houses 2026-01-28 / 2026-03-09, not delivered to the Governor). NY net +1 law.
  • New York: NY Child Data Protection Act: requires corrected to the actual-knowledge / primarily-directed trigger (no 'should know'); sourceUrl now codified GBL Art. 39-FF; litigation added, incl. AG enforcement discretion on the device age-flag duty.
  • New York: NY Safe by Design: requires rewritten (age-assurance trigger, covered-platform scope incl. gaming prong, integrated AI companions off by default for all covered minors); litigation no longer calls the NYC Bar an industry group.
  • New York: NY GBL Art. 47: requires corrected (opening not-human notice need not exceed once a day) and adds Sec. 1703 AG penalties of up to $15,000/day; billNumber now Secs. 1700-1704.
  • New York: NY SAFE for Kids: effectiveNote adds the Sec. 1508(1) 180-day AG enforcement lag (2027-07-24, derived).
  • North Carolina: NC HB 301: requires rewritten to match the Senate's Sixth Edition now in conference. Changes: AG-only unfair-trade enforcement plus a child's private claim capped at $10k; the platform test (10% of under-16 daily users at 2+ hrs/day, algorithmic content selection, an addictive feature); and the new ban on using under-16 data for algorithmic recs/ads or selling it.
  • North Carolina: NC HB 301: removed 'verifiable' parental consent. No edition of the bill ever said it; the text reads 'parent or guardian provides consent'.
  • North Carolina: NC HB 301: effectiveNote added. Part I would take effect 2027-01-01 if enacted as the Sixth Edition reads; conference can change that.
  • North Carolina: NC HB 301: litigation adds the Res. 2026-6 windows for a conference report (reconvenes 10-26, 11-16, 11-30; sine die 12-18). Status stays pending (it passed both chambers).
  • North Carolina: NC HB 301: dropped the unsourced Meta/Zenger app-store clearinghouse sentence. Neither the editions (v0-v6) nor the recorded amendments (A1-A5) contain an app-store provision.
  • North Dakota: corrected HB 1561 (adult-site age verification, out of scope) signing date to Apr. 10, 2025 per S.L. 2025 ch. 464 "Approved April 10, 2025"; was Apr. 11 (filing date).
  • Ohio: dropped the App Store Accountability bills (HB 226 / SB 167 / HB 302 / SB 175). None has passed a chamber, so none is tracked. Sub. SB 175 (committee substitute: OS age-bracket signals, no parental consent) is on the Senate calendar but has had no floor vote.
  • Ohio: OH HB 33 (R.C. 1349.09): sourceUrl moved from the Sixth Circuit opinion PDF to the codified section on codes.ohio.gov.
  • Ohio: OH HB 33: effectiveNote added. The section took effect 2023-10-03 but applies from 2024-01-15 under H.B. 33 Sec. 803.380.
  • Ohio: OH HB 33: requires rewritten from the codified text (child-directed trigger, moderation-features list, 30-day withdrawal, AG-only enforcement, penalty ladder, 90-day cure).
  • Ohio: OH HB 33: still enacted_enjoined. 6th Cir. No. 25-3371 mandate stayed for a cert petition (ECF 61, 2026-08-17), no later docket entry; litigation now quotes the stay order's terms.
  • Oklahoma: OK SB 546 re-verified, no change: signed 2026-03-20 (Ch. 8), effective 2027-01-01, not amended by any 2026 enrolled bill, no court challenge found on RECAP.
  • Oklahoma: OK out-of-scope list: added three dead bills that each passed at least one chamber: HB 1275 (under-16 social media ban), HB 3544 (AI companion ban for under-18s) and SB 1521 (AI chatbot safeguards for minors). Also reworded the SB 838 note so it no longer calls SB 838 HB 1275's companion, and it now says the bill died.
  • Oregon: OR OCPA: requires corrected to the HB 2008 text: profiling ban limited to profiling for legal or similarly significant decisions; added the all-consumer ban on selling location data within 1,750 feet; noted a child's personal data is sensitive data.
  • Oregon: OR OCPA: sourceUrl repointed from the OLIS overview shell to the chaptered HB 2008 act (2025 Or. Laws ch. 251).
  • Oregon: OR SB 1546: requires now lists the all-user AI notice, the protocol's content bar and the minor duties (no human/sentience claims, emotional dependence, romance or sexual content, engagement rewards, guilt-trip exit messages, misrepresentation).
  • Oregon: OR SB 1546: dropped the claim that its private right of action is unique among 2026 companion-AI statutes.
  • Pennsylvania: dropped SB 22, HB 1430, HB 1729 and HB 2215 because none has passed a chamber; each still sits at its committee referral (2025-01-24, 2025-05-08, 2025-07-14, 2026-02-11) with no report or floor vote.
  • Pennsylvania: added HB 78 Consumer Data Privacy Act minors' provisions (comprehensive, pending): House 127-76 on 2025-10-01; Senate C&T re-reported as amended 2026-06-24 (PN 3688), second consideration 2026-06-25. Known-child data is sensitive (COPPA processing); no targeted ads or sale without consent for known-and-willfully-disregarded under-16s.
  • Pennsylvania: added SB 1090 (ai_companion, pending): Senate 49-1 on 2026-03-17, in House C&T since 2026-03-18. Disclosure, crisis protocol, 3-hour break reminders and sexual-content measures for known or should-have-known minors.
  • Pennsylvania: added HB 2006 AI Companion Safety Act (ai_companion, pending): House 133-70 on 2026-09-28. Age assurance before access and verifiable parental consent for under-18s.
  • Pennsylvania: rollupStatus pending -> none. No kids-targeted law remains; HB 78 (comprehensive) and SB 1090 / HB 2006 (ai_companion) are rollup-excluded.
  • Pennsylvania: the 2026-11-30 end of session is now cited to PA Const. art. II sec. 2 ('Their term of service shall begin on the first day of December next after their election') and sec. 4 (continuing body).
  • Pennsylvania: the out-of-scope list gains SB 603 (adult-content age verification, 18 Pa.C.S. 7672; reported by Senate Judiciary 2026-09-28).
  • Rhode Island: RI RIDTPPA: billNumber now cites both enacted vehicles, S 2500 Sub A aa (P.L. 2024 ch. 430) and H 7787 Sub A aa (ch. 453), plus R.I. Gen. Laws ch. 6-48.1.
  • Rhode Island: RI RIDTPPA: dropped signedDate 2024-06-28. The chapter header records 'Enacted' only and the governor's action could not be read on a primary source. Enactment dates moved to effectiveNote; effective 2026-01-01 and in_force unchanged.
  • Rhode Island: RI RIDTPPA: requires tightened. The COPPA safe harbor covers only the parental-consent obligation (6-48.1-4(c)); added the parent/guardian rights clause (6-48.1-5(f)); dropped the unsourced 'unlike most newer state laws' comparison.
  • Rhode Island: RI AI Companion Models (P.L. 2026 ch. 376): requires adds the harm-to-others protocol, crisis referral on detection and annual AG reports from 2027-07-01 (6-64-2). Corrected the Legislative Council note: the explanation never mentioned 16-point type or a private right of action; those were in the introduced text.
  • Rhode Island: RI AI Companion Models: effectiveNote narrowed to what the chapter header shows; billNumber cites H 7350 Sub A as amended for ch. 375.
  • South Carolina: SC SHASM Act: requires corrected; $10,000 is the floor (greater of $10,000 or actual damages) for reckless or knowing violations, not a cap; adds the treat-as-child-unless-80%/90%-confident age-estimation rule, birth-date rule, punitive damages, reasonable-efforts defense and AG enforcement.
  • South Carolina: SC Age-Appropriate Code Design Act: NetChoice v. Wilson posture updated through the Aug. 13, 2026 docket entry; PI motion still undecided, no injunction; Section 230 preemption claim added; removed the unstated 'first audit deadline July 1, 2026' inference.
  • South Carolina: SC out-of-scope list: H.3424 note now names the 125th Session and Act 198 dates, to tell it apart from the unrelated 126th-Session H.3424.
  • Tennessee: dropped HB 2254 (114th GA). It is a consumer-protection caption bill that the tracker had mislabelled as an App Store Accountability Act (the app-store text was only an unadopted Senate amendment). It and SB 2263 were deferred to summer study in committee and died when the 114th General Assembly adjourned sine die.
  • Tennessee: TN HB 1891 (Pub. Ch. 899): requires corrected to the enacted text. Senate Amendment 2 struck the 14-day re-verification of existing accounts before enactment, and the Act covers only accounts created on or after 2025-01-01.
  • Tennessee: TN HB 1891 litigation: PI-denial date corrected to 2025-06-18 (ECF 78/79). The Sixth Circuit mandate issued 2026-09-21 and the district court ordered supplemental PI briefing. Still no injunction; status stays in_force.
  • Texas: TX SCOPE Act (HB 18): litigation rewritten. CA5 withheld the mandate on 2026-09-14 while Texas's rehearing petitions are pending, so the Feb 7, 2025 injunction (monitoring/filtering, targeted ads, unlawful ads, 509.057 age verification) is still in force for all providers. If the panel ruling stands, only monitoring/filtering stays enjoined, and only for CCIA/NetChoice members (the Aug 30, 2024 order is limited to the parties). Status stays in_force.
  • Texas: TX SCOPE Act (HB 18): requires rewritten from enacted ch. 509. Removed the parental-consent-to-open-an-account and terms-approval duties, which the statute does not contain. Added the no-purchase, no-geolocation and no-targeted-ads defaults, parent review/delete rights and algorithm disclosure.
  • Texas: TX App Store Accountability Act (SB 2420): litigation dates corrected. Both SCOTUS applications were filed 2026-06-10, Texas responded 2026-06-22, and there were two PIs (both 2025-12-23). Dropped the unverified word 'expedited'. Status unchanged.
  • Texas: HB 581 (age verification for AI sexual-image tools, ch. 129B) added to the out-of-scope list.
  • Texas: TX TDPSA (HB 4): re-verified, no change.
  • Utah: UT SB 194: requires rewritten from the enacted text: 95%-accurate age assurance, not verification; parental consent only to change privacy defaults or lift data confidentiality; no account-creation consent and no curfew. The 3-hour cap, 10:30 p.m.-6:30 a.m. block and consent to use are HB 464 affirmative-defense conditions.
  • Utah: UT SB 194: litigation notes the 2024-09-10 PI by its terms covers only Utah Code 13-71, not HB 464's private right of action (78B-3-1101 to 1106); 10th Cir. 24-4100 still undecided; sourceUrl repointed to the enrolled SB 194 PDF.
  • Utah: UT App Store Act: sourceUrl repointed to enrolled HB 498; effectiveNote records HB 498 moving duties and private action to 2027-05-06, the 12-month window for existing accounts, and SB 142's original 2026-05-06 / 2026-12-31 dates; litigation names CCIA v. Brown, 2:26-cv-00094, voluntarily dismissed by stipulation 2026-04-21 with the State agreeing the amended Act has no government enforcement; age-category names match the statute.
  • Utah: UT UCPA: requires quotes the statute's 'known child'; litigation added: the State's 2025-06-30 Snap suit pleads the known-child clause over My AI, and Snap's federal suit (2:25-cv-00490) was dismissed on Younger abstention 2026-03-24. Not enjoined.
  • Utah: added SB 226 (2025), age-neutral generative-AI disclosure in consumer transactions and regulated occupations, in force since 2025-05-07 (ai_companion).
  • Utah: UT out-of-scope list: added SB 73 (2026), adult-content age-verification amendments with a 2% excise tax on covered transactions.
  • Vermont: VT AADC (Act 63): requires no longer says the Act restricts profiling (it defines profiling but has no profiling duty); now states the 2449c minimum duty of care, the 2449f(a)(1)-(2) data-minimization wording and the 2449f(a)(4) media-recommendation limit, scoped to covered minors.
  • Vermont: VT AADC (Act 63): added effectiveNote for the staged dates (duties 2027-01-01; AG rulemaking mandates in force since 2025-07-01) and the AG's pending proposed rules; effectiveDate unchanged.
  • Vermont: VT Act 145: teen sale/targeted-ad trigger corrected from 'knows or willfully disregards' to the enacted 'has actual knowledge, and willfully disregards' (9 V.S.A. 2415e(a)(7)); ages label aligned; profiling sentence narrowed to the consumer opt-out right.
  • Vermont: VT Act 145: sourceUrl repointed from the S.71 status page to the enacted Act PDF, which carries the 2028-01-01 effective date.
  • Virginia: dropped SB 237 / HB 757 (App Store Accountability Act); continued to 2027 in committee, never passed a chamber.
  • Virginia: dropped SB 232 (CDPA prohibitions and duties relating to minors); recommitted 2026-02-02, continued to 2027 on 2026-02-04, never passed the Senate.
  • Virginia: added SB 796 (AI Chatbots and Minors Act) as pending ai_companion; passed Senate 39-1 2026-02-17, continued to 2027 in House CTI 2026-03-02; Senate text is age neutral (introduced 18+ age verification dropped).
  • Virginia: VA SB 854: requires now includes the 59.1-577.1(C) device-signal duty; parental consent increases or decreases the one-hour limit (was 'raise or remove').
  • Virginia: VA CDPA minors' provisions: billNumber names both 2024 chapters (SB 361 c. 844, HB 707 c. 840).
  • Washington: WA ESHB 2225: requires drops the 'strictest cadence of the 2026 companion statutes' claim (GA SB 540, CT PA 26-15 and HI Act 248 also require hourly notices for minors); the sexual-content and engagement-technique duties are now stated as reasonable-measures duties scoped to known minors or minor-directed bots.
  • Washington: WA ESHB 2225: ages now names the all-user disclosure and crisis-protocol duties alongside the under-18 duties.
  • Washington: WA ESHB 2225 re-verified: Ch. 168, Laws of 2026, signed 2026-03-24, effective 2027-01-01, no challenge found; status unchanged (enacted_future).
  • Wisconsin: no in-scope law enacted in the 2025-26 session (all 247 2025 Wisconsin Acts screened); the out-of-scope list gains the dead app-store, social-media, design-code and warning-label bills AB 962/SB 937, AB 963/SB 936, AB 1161/SB 978, SB 758 and AB 960/SB 933 (all disposed of under SJR 1 on 2026-03-23); AB 105/SB 130 adult-content AV note re-read and unchanged.
  • Wyoming: out-of-scope note for HB 19 (2025) now records its fate (House did not consider it for introduction, Feb. 3, 2025; died). No tracked WY laws; no in-scope enactments in the 2025 or 2026 sessions.
  • Federal watch re-verified. Correction to the 2026-09-01 note: Senate Commerce advanced four of the five kids’ online-safety bills at Executive Session 24 on 2026-08-05, not the whole package. S. 737 (SCREEN Act) carried 15-13 on a party-line roll call, but the committee’s release says a revote is needed under Senate rules on in-person attendance, and the bill’s official record shows no committee action. Executive Session 25 on 2026-09-16 took up no kids’ online-safety bill. S. 4199, S. 4407 and S. 5171 are now noted as advanced with substitutes. The KIDS Act (H.R. 7757) description now names its SCREEN Act and AI-chatbot titles and its modified COPPA 2.0 subtitle. The GUARD Act (S. 3062) is added: it would require age verification for AI companions and bar minors from them, and it has been on the Senate calendar as No. 406 since 2026-05-11. KOSA, S. 278, H.R. 7757 and S. 836 have not moved. The COPPA Rule is still unamended since 2025-06-23, and the FTC’s 2026-02-25 age-verification enforcement policy statement remains in force.

Correction sequence from the state-refresh discovery (.planning/state-refresh-discovery-2026-09-12.md), merged the same day in three pull requests and recorded here as one entry.

First, three litigation fields (Colorado, Nebraska, Minnesota) re-read against the court dockets themselves rather than docket metadata. Second, two categorical corrections: Oklahoma, published as having no in-scope law, has had an enacted omnibus privacy act with minors’ provisions since 2026-03-20, and Louisiana’s Kids Online Protection and Anti-Grooming Act flips in_force to enacted_future because a 2026 act repealed its June 2026 effective-date section before that date arrived and set the whole act to 2027-01-01. Third, California, which moved nine days after the September sweep: on 2026-09-10 the Governor signed AB 1856, AB 1709, AB 2246, SB 867 and SB 1119, which the tracker did not know, so every California entry those bills touch is re-read from the chaptered instruments: the pending AB 1856 becomes law and is folded into the AB 1043 entry it amends, SB 243 is rewritten with SB 1119 (Adam’s Law), the CAADCA entry records AB 2246’s repeal and re-add and re-states the injunction from the Ninth Circuit’s own judgment, AB 56’s inverted duty is corrected, and AB 1709 and SB 867 are added. The tracked total moves from 107 to 109 (Oklahoma and two California laws added, the separate AB 1856 entry folded); asOfDate does not move because none of this is a 51-jurisdiction sweep. Fourth, three comprehensive entries re-read against 2026 amendments the September sweep did not know: Delaware’s HB 380 (signed 2026-09-02, effective 2027-01-01) rewrites the DPDPA minors’ rules, New Jersey’s P.L.2026, c.25 renumbered the NJDPA minors clause and added a flat ban on selling sensitive data (which includes a known child’s data), and Virginia’s c. 820 is confirmed as the geolocation sale ban the entry already carried; no status changes and the total stays 109. Fifth, four laws the tracker had missed, all enacted before the sweep and none of them new: Florida’s Fla. Stat. 501.1735, the design-code section of SB 262 that the tracked Digital Bill of Rights entry’s citation range never reached; Louisiana’s R.S. 9:2717.2 (legal representative consent for contracts with minors, in force since 2024-05-08) and R.S. 9:2717.2.1 (Act 618 of 2026, effective 2027-01-01); and New York’s GBL Article 45-A (warning labels for addictive feature platforms, effective 2027-01-01), which sits between two tracked articles. New York’s SAFE for Kids effective-date hedge is retired because the codified article now records January 25, 2027, and the Florida Attorney General’s Roblox enforcement action under 501.1735 is described from the federal docket. The tracked total ends at 113.

Dataset held 113 tracked laws & bills after this change.

  • Colorado: HB24-1136 (NetChoice v. Weiser, 10th Cir. No. 25-1456): the entry said no argument date had been set. The Tenth Circuit’s argument notice, docket entry 90 filed 2026-09-10, sets in-person argument for 2026-11-16 at 9:00 a.m. Mountain Time in Denver. The entry now says so and names Attorney General Philip J. Weiser as the appellant (entry 87, his reply brief) and NetChoice as the appellee. Status stays enacted_enjoined.
  • Nebraska: LB 383 (NetChoice v. Hilgers, D. Neb. 4:26-cv-03149): the entry stopped at the 2026-07-09 stay of deadlines and described the Eighth Circuit appeal as contemplated. Both sides have since filed notices of interlocutory appeal from the 2026-06-27 preliminary-injunction order: the Attorney General on 2026-07-23 (docket entry 39, Eighth Circuit No. 26-2478) and NetChoice on 2026-07-24 (entry 44, No. 26-2486); the designated record went up in No. 26-2486 on 2026-09-04 (entry 48). On the district-court record the injunction remains in effect (the 2026-07-09 order stays deadlines only); the Eighth Circuit’s public case search shows no opinion in either appeal, and whether an appellate stay order has issued is not visible from public sources. Status stays enacted_enjoined.
  • Minnesota: HF 4138: the entry called the 2026 warning-label suit “the active” NetChoice v. Ellison case. There are two. No. 0:25-cv-02741 (filed 2025-06-30) challenges Minn. Stat. 325M.33(1)-(5) of the Prohibiting Social Media Manipulation Act, a section HF 4138 later amends by adding a clause (6) effective 2027-07-01; the complaint predates HF 4138 and does not name it, and no amended complaint is on the docket. Preliminary-injunction briefing in that case was scheduled by the court’s 2026-07-31 order to run from 2026-09-15 to 2026-11-05. No. 0:26-cv-02405 (filed 2026-04-29) challenges the warning-label section, 325M.335, and stays recorded on that entry. No litigation field is added to the MCDPA entry: the 2025 complaint does not challenge 325M.16. Status unchanged.
  • Oklahoma: SB 546 (2026, Ch. 8; omnibus consumer data privacy, to be codified at 75A O.S. Sections 300 to 320) added as a comprehensive entry, enacted_future with effect 2027-01-01. This is a false negative that predates the 2026-09-01 sweep, not a new enactment: the Governor approved the bill on 2026-03-20 and the sweep that re-verified all 51 jurisdictions still left Oklahoma’s laws list empty. The minors’ content is COPPA-shaped, read from the enrolled act: “Child” is under 13, “personal data collected from a known child” is sensitive data, a known child’s sensitive data must be processed in accordance with COPPA, a parent or guardian may exercise the child’s rights, and COPPA verifiable parental consent for data collected online satisfies any parental consent duty; there is no teen band and no minor-specific targeted-advertising or sale ban. Enrolled Section 22 states the effective date outright (“This act shall become effective January 1, 2027”). The act has no short title, so the entry name is descriptive. Oklahoma’s rollup stays none because comprehensive laws are excluded from it; the state page leaves noindex.
  • Louisiana: Kids Online Protection and Anti-Grooming Act (HB 37, Act 236 of 2025) reclassified in_force to enacted_future with effect 2027-01-01. The entry carried the 2026-06-01 date from enrolled Act 236 Section 2 and described HB 427 (Act 552 of 2026, signed 2026-05-29) as a later amendment to a law already in force. Act 552 Section 2 repeals Act 236 Section 2 “in its entirety” and Section 3 provides that “Section 1 of Act No. 236 of the 2025 Regular Session and the provisions of this Act shall become effective on January 1, 2027”; the source credit on the codified R.S. 9:2717.4 reads “Acts 2025, No. 236, §1, eff. Jan. 1, 2027; Acts 2026, No. 552, §§1,2, and 3, eff. Jan. 1, 2027”. The requires prose now describes the amended text only: minor means under 18 and not emancipated by cross-reference to R.S. 9:2717.2, the adult-connection rule is an either/or with parental visibility into connections and direct-message contacts, the connected-accounts-only visibility rule is reworded as private mode (connected users may view or respond to the minor’s posts), and the notice trigger is material harmful to minors. The entry follows the legislature’s codification, which assigns 2027-01-01 to the whole section; the enrolled texts also admit a reading under which the 2025 text was in force from 2026-06-01, and no court has construed the sequence. sourceUrl repointed from enrolled Act 236 to the codified section. Louisiana’s rollup stays in_force on Act 656.
12 more changes · 7 states
  • California: AB 1043 (Digital Age Assurance Act): AB 1856 (Ch. 184, Stats. 2026) was approved and chaptered 2026-09-10. It is a non-urgency statute with no operative clause of its own, so under Cal. Const. art. IV, sec. 8(c)(1) it takes effect 2027-01-01, the day Civ. Code 1798.505 (which it does not amend) makes the title operative; the act never operates in its 2025 form. The separate “AB 1856: amendments” entry, which existed to track the bill while pending, is folded into the AB 1043 entry (the Louisiana Act 236 / Act 552 and Nebraska LB 504 / LB 838 pattern), which now describes the amended sections: the signal goes to covered application stores as well as developers, app stores must request it and relay it on request, “developer” means a person that owns an app or maintains or controls its hosting in a covered app store, a developer’s deemed actual knowledge holds even if it willfully disregards the signal and reaches developer-controlled account and log-in pages, no covered entity may prompt a user to change age information, no one may request a signal unless a law requires it, developers get the good-faith safe harbor, and pre-2027 devices and apps updated on or after 2026-01-01 get until 2027-07-01 under 1798.502. The old entry said the developer-website reach “was dropped”; only the browser-provider and website-operator duties were removed, by the 2026-08-21 Senate amendment. Penalties are stated as the statute’s caps, per affected child at both tiers. sourceUrl moves to the chaptered AB 1856 text, the instrument that carries the amended sections the entry describes; the codified title flips on 2027-01-01 and the January refresh should re-read it.
  • California: SB 243 (companion chatbots): SB 1119 (Ch. 190, Stats. 2026, approved and filed 2026-09-10) amends Bus. & Prof. Code 22602 in place to delete subdivision (c), the known-minor AI disclosure, three-hour break reminder and sexually-explicit-content duties, and adds Adam’s Law, a new Chapter 11.6 (Secs. 21810-21818) with a far broader under-18 tier: age determination for every operator (21811, from 2027-01-01), then from 2027-07-01 pre-release child-safety risk assessments, a crisis protocol, parent-only default settings, fourteen prohibited behaviors toward children (21812), advertising and data limits (21813), independent child safety audits from 2029-01-01 or first public release (21814), and public-prosecutor penalties plus a private right of action limited to violations of 21812(d)(1)-(5) (21816). Sec. 21814 is printed in two alternative versions; the one conditioned on AB 1405 being chaptered and taking effect on or before 2027-01-01 controls, because AB 1405 is Ch. 178, Stats. 2026, approved 2026-09-09 and non-urgency. SB 243’s own chapter stays at 22601-22606 (the entry had cited 22601-22605) and its Sec. 22605 private right of action is untouched. Status stays in_force: the 2025 duties bind today and the amendment operates 2027-01-01. sourceUrl moves to the codified 22602, the section SB 1119 amends.
  • California: CAADCA (AB 2273): AB 2246 (Ch. 187, Stats. 2026, approved and chaptered 2026-09-10) repeals Civ. Code Title 1.81.47 (Secs. 1798.99.28 through 1798.99.40) and re-adds it as seven sections, 1798.99.28 through 1798.99.34, with a severability clause, no short title and no operative clause; as a non-urgency statute it takes effect 2027-01-01 under Cal. Const. art. IV, sec. 8(c)(1), and the live code still carries the 2022 text. The litigation field is re-stated from the Ninth Circuit’s own judgment in No. 25-2366 rather than the entry’s earlier four-category summary: the 2024 appeal left the impact-assessment injunction in place on First Amendment grounds, and the 2026-03-12 judgment affirmed the second injunction only as to 1798.99.31(b)(1)-(4) and (b)(7), on a likelihood of success on the vagueness challenge, vacating the rest (the entry had described the impact-assessment duty as enjoined for vagueness); the mandate issued 2026-04-03 and the district case continues. Of the enjoined provisions, the impact-assessment duty, the “materially detrimental” use ban and the cure clause have no counterpart in the new text, while the re-added text retains revised profiling, collection, purpose-use and dark-pattern restrictions without the “materially detrimental” and “best interests” language, and no court has considered whether that cures the asserted defects; the new 1798.99.29(a)(1) cross-references “subdivision (b) of Section 1798.501”, which AB 1856 re-letters the same day. No court has addressed AB 2246 and nothing about it is on the public docket, so status stays enacted_enjoined pending a ruling or an owner decision. sourceUrl moves to the codified title, which will flip on 2027-01-01.
  • California: AB 56 (social media warning labels): the requires field said the black-box warning duty ran “to minor users”. Health and Safety Code 28002(a)(1)(A) and (a)(2)(A) impose it for every user; the only age line is a safe harbor, a platform “shall not be required” to warn a user it “has reasonably determined” is “over 17 years of age” (28002(a)(1)(C), (a)(2)(C)), so a platform that makes no age determination must warn adults too. Rewritten from the chaptered text; appliesToUnder stays 18 because every minor is inside the duty. The unsourced sentence that industry anticipates a challenge is replaced with the docket search result.
  • California: AB 1709 (Ch. 183, Stats. 2026) added as a social_media entry with age_verification as a second category: from 2027-01-01 a covered platform may not provide an addictive feed, autoplay or any Attorney General-designated addictive feature to a California-resident user under 16, must verify age through the Digital Age Assurance Act signal (falling back to SB 976’s age determination), must delete an under-16 user’s account and data unless it offers a feature-free account, and faces civil penalties of up to $50,000 per affected minor for a knowing violation and $25,000 for a negligent one, enforced by the Attorney General or a local prosecutor with no private right of action. SB 867 (Ch. 189, Stats. 2026) added as an ai_companion entry: from 2027-01-01 no person may manufacture, sell, or offer to a retailer a toy for children under 16 that includes a companion chatbot (new Bus. & Prof. Code 22604.5, inside SB 243’s chapter so its Sec. 22605 private right of action reaches it), sunsetting 2031-01-01. Both effective dates are derived under art. IV, sec. 8(c)(1) because the sections are not yet codified; the October refresh should re-read the codified pages for the stated annotation.
  • California: Evaluated and not added. SB 903 (at the Governor: enrolled 2026-09-04, presented 2026-09-09, art. IV, sec. 10(b)(2) deadline 2026-09-30) is a scope-of-practice law for AI in psychotherapy with licensing-board enforcement and no minor provision, the same class as NV AB 406 (ruled out of scope after owner review) and the AI-therapy statutes held out by default pending an owner ruling; it will be re-checked at the October refresh. AB 1609 (enrolled 2026-09-04, not yet presented) binds businesses with more than $500 million in gross annual revenue not to represent a customer service chatbot as human and to make a good-faith effort to reach a human agent within 15 minutes or set an appointment within one business day, with no minor provision. AB 1159 (Ch. 182, Stats. 2026, student personal information) is out under the owner’s 2026-09-12 education-sector ruling and AB 1946 (Ch. 185, Stats. 2026, CSAM reporting mechanism) under the conduct-statute ruling. The Governor’s 2026-09-10 release lists thirteen bills; AB 2071, AB 302, SB 1128 and AB 2298 are pupil-instruction and school-device laws (out, education sector) and SB 1276 is a crimes statute (out). AB 2 (Ch. 180, Stats. 2026) adds Civ. Code 1714.02, statutory damages of the larger of $5,000 per violation (capped at $1 million per child) or treble actual damages against a social media platform with over $100 million in revenue that injures a child, until 2035; it creates a child-specific civil-liability and damages rule but does not impose a standalone design, consent or age-assurance requirement, and the owner ruled it out of scope on 2026-09-12 as a child-injury damages statute unrelated to app privacy, COPPA consent or data handling, so it is recorded as evaluated and not added.
  • Delaware: Delaware Personal Data Privacy Act (minors’ provisions): HB 380, as amended by HA 2 (85 Del. Laws c. 463), signed 2026-09-02 and effective 2027-01-01 under its own Section 2 (“This Act is effective January 1, 2027.”), rewrites both minors’ rules the entry describes, read from the Final/Engrossed text’s struck and underlined spans. The child rule moves from sensitive data of a known child in 12D-106(a)(4) to a new (a)(5) covering all personal data of a consumer the controller has actual knowledge of, or wilfully disregards, is a child, still conditioned on parental consent and Sec. 1204C; the COPPA deemed-compliance clause, which the old entry placed in 12D-106(a)(4), is cited to its home in 12D-103(d) and reaches only the parental-consent element, not the Sec. 1204C element. The teen rule, renumbered (a)(7) to (a)(8), widens from targeted advertising and sale to every purpose on the 12D-104(a)(6) opt-out list, whose item c now reads automated rather than solely-automated decisions with legal or similarly significant effects; the 13-to-under-18 band is untouched. Applicability drops from 35,000 to 10,000 consumers (5,000 on the 20%-of-revenue prong) and the data protection assessment threshold from 100,000 to 50,000. The bill page’s synopsis, also printed at the foot of the introduced text, says 15,000, a figure in no version of the operative text (the introduced print already said 10,000 and HA 2 does not touch the thresholds), so the numbers come from the engrossment only. Status stays in_force: the 2023 act binds today and the amendment operates 2027-01-01, recorded in a new effectiveNote, and the requires text states both tiers with an explicit date boundary rather than a floating “today”. sourceUrl moves from the codified chapter, which still carries only the 2023 text (every section credited solely to 84 Del. Laws c. 197) and will not show the amendment until the Code publisher posts it, to the Final/Engrossed act text; the Laws of Delaware page for c. 463 redirects to an empty chapter shell today, the same target as a nonexistent chapter, and should replace it once it resolves to a real chapter. The signed date rests on the bill page’s status line (“Signed 9/2/26”); the engrossment carries no approval date or chapter number, so the January refresh should re-confirm both the date and the 85 Del. Laws c. 463 citation from the chaptered act. The base act’s 2023-09-11 approval and 2025-01-01 effective date were re-read from 84 Del. Laws c. 197. Litigation added from the docket screen.
  • New Jersey: NJDPA minors’ provisions: P.L.2026, c.25 (A5328), approved 2026-06-30 and effective immediately on approval (its Section 8 reads “This act shall take effect immediately”, deferring only the data-broker registry subsection for 270 days), amended Section 9 of the Act (N.J.S.A. 56:8-166.12) to add at (a)(6) a ban on selling sensitive data (“not sell sensitive data, which shall apply to all individuals or legal entities regardless of the number of consumers whose data the individual or entity controls or processes”), which renumbered the 13-to-under-17 consent clause from (a)(7) to (a)(8) with its wording unchanged. Because the Act’s own definition of sensitive data includes personal data collected from a known child, the new (a)(6) bars selling a known child’s data outright, and c.25 section 5 attaches a civil penalty (“shall be liable to a civil penalty of $50,000 for each record sold, offered for sale, or licensed”); the entry’s under-13 sentence and ages string, which said only that COPPA governs, now say so. The entry did not know the section had been amended and its sourceUrl pointed at the 2023 chapter law, whose Section 9 text is superseded; sourceUrl moves to the Legislature’s advance-law text of c.25, the instrument that carries the amended section, because the compiled chapter-law file does not exist yet and the codified compilation, updated through P.L.2025, c.405, carries no 2026 chapter. The 2023 chapter law’s sections 1 and 10 had already been re-enacted by P.L.2025, c.367 (A5017), approved 2026-01-20 and effective immediately; that amendment changed only the de-identified data definition and the section 10 exemptions and does not touch the minors clause or the consent and sensitive-data definitions the entry relies on, which remain in N.J.S.A. 56:8-166.4. Status, dates and the age band are unchanged. Litigation added from the docket screen.
  • Virginia: VCDPA minors’ provisions: the September discovery flagged SB 338 (2026 Acts c. 820) as an amendment to check against the entry, and the check confirms what the entry has said since 2026-07-24, so the outcome is a verification record rather than a change: read from the chaptered act, c. 820 amends and reenacts 59.1-578 alone, its only substantive change is the new subdivision A.6 ban on selling or offering for sale precise geolocation data (the only other edits strike “ and” after A.4 and insert “; and” after A.5), and subsection F, the 59.1-575 definitions and 59.1-577.1 are untouched. The requires text is left alone; lastVerified moves to 2026-09-12, the ages string now names both tiers (the under-13 subsection F duties and the all-consumers A.6 sale ban, with appliesToUnder staying 13), and the litigation field is re-stated from the docket screen, naming the time-limit case under its current caption, NetChoice v. Jones (formerly NetChoice v. Miyares), and saying what was searched. The LIS bill history is the effective-date authority (“Approved by Governor-Chapter 820 (effective 7/1/2026)”, 2026-04-13); the codified page prints the day it was fetched directly above the section heading and carries no effective date.
  • Florida: Fla. Stat. 501.1735 (Protection of children in online spaces) added as an aadc entry, in_force since 2024-07-01. It was created by section 2 of SB 262 (ch. 2023-201), the same act as the tracked Florida Digital Bill of Rights entry, whose cited range (501.702/501.71x) never reached it; the discovery pass found it by reading the codified section rather than the bill title. It binds a social media platform (s. 112.23(1)), online game or online gaming platform offering a service, product, game or feature “likely to be predominantly accessed by children” (under 18): no processing that the platform has actual knowledge of, or willfully disregards, may cause substantial harm or privacy risk to children (an open standard with an illustrative list, not a closed one), no profiling without safeguards and either necessity or a compelling reason, data minimisation and purpose limitation, precise geolocation only when strictly necessary and with an obvious sign, no dark patterns, no reuse of age-estimation data and a proportionality standard for any age estimate; Department of Legal Affairs enforcement as an unfair and deceptive trade practice with a discretionary 45-day cure period and penalties of up to $50,000 per violation, which “may be tripled” on actual knowledge the child is under 18, no private right of action. The history line shows s. 10, ch. 2026-52 (SB 7026, approved 2026-04-23, effective on becoming law), which the 2025-to-2026 codified diff confirms only deleted the “Trade secrets as defined in s. 688.002” prong from the public-records definition of “proprietary information”; no duty changed. The October 2, 2028 sunset sits in public-records subsection (6)(e), written by ch. 2023-262, whose title speaks of “review and repeal of the exemptions”, under the Open Government Sunset Review Act (s. 119.15(3) repeals “the exemption” in the fifth year), so the entry says that context supports confining the repeal to the records exemption while the enacted words “this section” are broad enough to reach the duties, and that no court or codifier has construed them. Litigation: no challenge identified in the NetChoice Litigation Center, Orrick’s Florida page or the Attorney General’s releases; the Attorney General’s 2025-12-11 Roblox complaint (Eighth Judicial Circuit, Baker County) pleads the section in Count V, and the CourtListener docket for the removed case, M.D. Fla. No. 3:26-cv-00057 (removed 2026-01-12, Judge Pratt), shows Roblox’s motion to dismiss fully briefed on 2026-05-15 and pending, a show-cause order briefed in May 2026 with no ruling, and notices of supplemental authority on 2026-07-31 and 2026-09-10. The SB 262 entry gains a sentence pointing to the new entry and is otherwise untouched, but a lead for the next refresh: the Attorney General’s 2026-09-09 Netflix suit (Seventh Judicial Circuit, St. Johns County, Filing # 256635678) pleads FDBR s. 501.715, the sale of sensitive data collected from known children, which is that entry’s subject, and the entry carries no litigation field. sourceUrl is the year-pinned flsenate.gov codified page.
  • Louisiana: Two sections added as social_media entries (the closest of the tracker’s six buckets: both bind every interactive computer service, a class wider than social media, and no general online-service category exists), both false negatives older than the 2026-09-01 sweep. R.S. 9:2717.2 (legal representative consent for contracts with minors; HB 61, Act 440 of 2023, amended and reenacted by HB 123, Act 16 of 2024), in_force since 2024-05-08: the section has been operative for more than two years and the tracker cited it only as the source of Act 236’s minor definition. Read from the codified section: “No interactive computer service shall enter into a contract, including the creation of an online account, with a minor without obtaining the consent of the legal representative of the minor”; a contract made without that express consent “shall be a relative nullity” and its confirmation “shall be express and in writing”; “Minor” means “any person under the age of eighteen who is not emancipated”. The section has no regulator, penalty, fine, cure process or Attorney General role, so the entry states the nullity mechanism (Civil Code art. 2031: invocable only by those the rule protects, never raised by a court on its own, confirmable, with the writing requirement the section’s own) and invents no enforcement; the 2023 text’s clause limiting the section to minors domiciled in Louisiana was struck in 2024, so the entry says the section itself states no territorial limit and leaves its reach to ordinary jurisdiction and choice-of-law rules. Effective date from the codified credit “Acts 2023, No. 440, §1, eff. Aug. 1, 2024; Acts 2024, No. 16, §§1, 2, eff. May 8, 2024”: Act 16 amended and reenacted the section, repealed Act 440 Sections 2 and 3 “in their entirety” (the 2024-08-01 start date among them) and took effect on the Governor’s signature, which BillInfo records on 05/08 as “Signed by the Governor. Becomes Act No. 16.” and “Effective date: 05/08/2024.”, so the section has operated only in its 2024 form, signedDate is 2024-05-08 and the entry name leads with Act 16. It supplies every definition that R.S. 9:2717.2.1 uses and the minor definition that R.S. 9:2717.4 uses; 9:2717.4 otherwise defines its own narrower covered platform class. R.S. 9:2717.2.1 (HB 134, Act 618 of 2026), enacted_future with effect 2027-01-01: read from the enrolled act and the codified section, which match word for word, an interactive computer service that contracts with a minor, including by opening an online account, “shall not deliver or display to a minor account material harmful to minors that was created or developed, in whole or in part, by the interactive computer service”; account, interactive computer service and minor “have the same meanings as provided in R.S. 9:2717.2” and material harmful to minors “has the same meaning as provided in R.S. 51:2121” (the three-prong sexual-content test, all prongs required); AG-enforced with a “civil fine of up to ten thousand dollars per violation” after written notice and a cure “within forty-five days of receipt of the notice”, no private right of action. Section 2 reads “The provisions of this Act shall become effective on January 1, 2027.”, the codified credit reads “Acts 2026, No. 618, §1, eff. Jan. 1, 2027.” and BillInfo records “Signed by the Governor. Becomes Act No. 618.” on 06/02. Drafting history, kept out of the entry: the original bill’s second prohibition, “Use an algorithmic system to select, recommend, prioritize, or amplify material harmful to minors for delivery or display to a minor account”, was struck by House Committee Amendment #2782 (Civil Law and Procedure, Amendment No. 4, reported 03/30) and the title was not conformed, and the conference committee rejected Senate Floor Amendment #3208, which would have confined the duty to a service “that contains a substantial portion of material harmful to minors”. Category is social_media as a structural sibling of Act 236: it shares the minor and material-harmful-to-minors definitions, the contract-with-a-minor trigger and the AG notice, 45-day cure and $10,000 fine pattern, although it binds the broader interactive computer service class of R.S. 9:2717.2 (which expressly includes internet access providers, libraries and educational institutions) rather than Act 236’s covered platforms, which exclude broadband providers, schools and public libraries; it imposes no age verification and is not an adult-site gate. No challenge to either section identified in RECAP searches of the Louisiana federal courts and the Fifth Circuit or on NetChoice’s and CCIA’s litigation pages. Louisiana’s rollup stays in_force on Act 656.
  • New York: GBL Article 45-A (Warning Labels for Addictive Feature Platforms; S4505/A5346, Ch. 689 of 2025, signed 2025-12-19, rewritten by the chapter amendment S8827/A9446, Ch. 85 of 2026, signed 2026-02-13) added as a social_media entry, enacted_future with effect 2027-01-01. A false negative predating the 2026-09-01 sweep: the codified article sits between Article 45 (SAFE for Kids) and Article 45-B (Safe by Design), both already tracked, and each of those pages names it in its navigation strip. Read from the codified Secs. 1520 to 1526: a covered operator may not provide an addictive feed, autoplay or infinite scroll to a user in New York without the statute’s fixed Surgeon General label, shown each day at first access (25 percent of the screen, 10 seconds) and again after three hours of cumulative use and hourly after that (75 percent, 30 seconds), never skippable; a label buried in the terms of service, obscured, or paired with a design feature that “intentionally serves to inhibit or subvert the purpose of this article” is prohibited. The duty is on for every user and lifts only for a user the operator has reasonably determined is over 17 (Sec. 1525(5)), the same over-17 safe-harbor shape as CA AB 56, so the entry carries appliesToUnder 18 on that precedent as the tracker’s indexing convention (the duty is on by default for every user not reasonably determined to be over 17, which is meant to include every minor, though a minor the operator reasonably misjudged falls within the textual safe harbor); Minn. Stat. 325M.335 stays age-neutral because its statute draws no age line at all. Ch. 689’s Sec. 5 would have started the article 180 days after Attorney General rules and never ran; Ch. 85 of 2026, Sec. 5, substituted a fixed January 1, 2027, and the codified page carries “NB Effective January 1, 2027”; that amendment also added the over-17 exemption, the SAFE for Kids coordination clause and the no-defense clause, and repealed Mental Hygiene Law 7.48. Sec. 1526 gives enforcement to the Attorney General alone, with civil penalties of up to $5,000 per violation; the article creates no private right of action. Neither print carries a short title, so the entry uses the codified heading. SAFE for Kids Act: the effective-date hedge (“a conservative compliance plan should assume 2027-01-10”) is retired; effectiveDate stays 2027-01-25. The entry’s own source, the codified GBL Article 45 page, was revised 2026-07-31 and now carries “NB Effective January 25, 2027” where the 2024-06-28 revision read “NB Effective on the 180th day after the office of the attorney general promulgates rules and regulations necessary (see chapter 120 of 2024 § 5)”. Chapter 120 of 2024, Sec. 5, directs the Attorney General to notify the Legislative Bill Drafting Commission when the rules are enacted so the commission can keep its effective-date database current, and the codified note is that commission’s record of the date; it agrees with 13 NYCRR 700.11 (“the 180th day after publication in the State Register”, published 2026-07-29) and the Attorney General’s 2026-07-28 release. The Register’s Notice of Adoption (LAW-39-25-00001-A, Filing No. 688) still reads “Filing Date: 2026-07-14 / Effective Date: 180 days after filing”; that line dates the rules, and no official instrument gives 2027-01-10 for the Act. No challenge to either article identified in RECAP searches of the New York federal courts and the Second Circuit or on NetChoice’s and CCIA’s litigation pages. The watchdog comments that used the SAFE for Kids gap as their worked example now describe it as history; LEAD_DAYS is unchanged.

Hotfix from the review of the September refresh: three entries were re-stamped 2026-09-01 while carrying prose that had gone stale, and each is now re-read from the legislature’s own record.

An adversarial pass on this fix also caught a wrong constitutional citation and a mislabelled adjournment in the California prose, both inherited from the refresh, which are corrected here. No status changes and no change to the tracked total; asOfDate does not move because this is not a 51-jurisdiction sweep.

Dataset held 107 tracked laws & bills after this change.

  • Massachusetts: S.3175 (addictive social media feeds): the entry said the bill had to clear the House and reach conference before 2026-07-31 to stay live in formal session. It did not. The official history still lists the 2026-07-15 referral to House Ways and Means as its latest action, so when formal business ended on 2026-07-31 under Joint Rule 12A the bill fell outside the rule’s exceptions for conference reports, appropriation bills and gubernatorial returns. Absent a rules change or suspension, its remaining path is the informal session, where any member present can object and stop a matter for that sitting. Status stays pending until the General Court dissolves on 2027-01-05.
  • New York: S 9051-B (unsafe AI companion features): the “not yet delivered to the Governor” claim carried no date anchor. Re-read from the Assembly’s action list: the latest action is the 2026-06-05 return to the Senate, and the list records no delivery to the Governor. Prose now says so, explains the Senate’s sponsor-hold practice that produces late-year deliveries, and states the Governor’s clock from N.Y. Const. art. IV, sec. 7 (ten days after delivery, or thirty days after final adjournment with inaction a pocket veto), so a decision can land as late as January 2027.
  • California: AB 1856 was enrolled and presented to the Governor on 2026-09-04. Two inherited errors corrected: the entry cited Cal. Const. art. IV, sec. 10(b)(1), the first-year joint-recess rule, when a bill passed before September 1 of the second year and in the Governor’s possession on or after September 1 falls under sec. 10(b)(2), whose fixed deadline is 2026-09-30 regardless of presentation date; and it called 2026-08-31 an adjournment sine die when it was the start of the final recess (sine die is 2026-11-30). The four untracked bills flagged in the September refresh (SB 1119, AB 2246, AB 1709, SB 867) cleared both houses on 2026-08-30 or 2026-08-31 and were ordered to engrossing and enrolling; AB 2246, AB 1709 and SB 867 carry enrolled dates of 2026-09-03 or 2026-09-04, SB 1119 does not yet, and none of the four histories records presentation to the Governor. The same sec. 10(b)(2) deadline will govern each once presented. A targeted check is scheduled for the day after the deadline.

Monthly refresh.

All 51 jurisdictions and all 107 laws were re-verified against primary sources, so asOfDate moves for the first time since 2026-07-18; no August refresh ran, and this pass closes that 45 day gap. Three status flips: Colorado’s conversational AI act reached its effective date, New Jersey’s Kids Code Act and Illinois’ social media safety act were both signed, and Ohio is reclassified as enjoined because the Sixth Circuit reversal that would end its injunction has no mandate. No law was added or dropped, so the tracked total is unchanged.

Dataset held 107 tracked laws & bills after this change.

  • Ohio: Social Media Parental Notification Act (R.C. 1349.09) reclassified in_force to enacted_enjoined. This corrects a standing classification, not a new event. The district court’s 2025-04-16 permanent injunction has never been dissolved or stayed: the Sixth Circuit reversed on 2026-06-18 and remanded with instructions to enter judgment for the Attorney General, but rehearing en banc was denied 2026-08-05 and the court then granted NetChoice’s motion to stay the mandate on 2026-08-17. With no mandate, the district court has entered no judgment and the injunction still binds, so the Act cannot be enforced today. The taxonomy ends an injunction only on a reversal whose mandate has issued. Both August orders are docket entries rather than published opinions, but each is reproduced free in CourtListener’s RECAP archive for the appeal.
  • Colorado: HB26-1263 (Conversational AI Service Operator Requirements, Chapter 208) flips enacted_future to in_force. Session Laws section 3 sets the effective date at 12:01 a.m. on the day after the ninety day post-adjournment period, and names the date itself: "August 12, 2026, if adjournment sine die is on May 13, 2026". Sine die was 2026-05-13, and no referendum petition stands approved for circulation on the Secretary of State’s page; the ninety day window closed 2026-08-11. The staged duties in the effectiveNote (minor-specific obligations 2027-01-01, annual AG reporting 2027-07-01) are unchanged, and the age-estimation duty is not date-gated. Colorado’s rollup is unchanged because ai_companion is excluded from it.
  • New Jersey: Kids Code Act signed 2026-08-11 as P.L.2026 c.73, so pending flips to enacted_future with effect 2027-09-01 (enacted section 17: the first day of the 13th month after enactment). Entry renamed to A4015, as enacted after substitution for S3413, and its sourceUrl repointed from the introduced S3413 print, which contradicted the enacted text on both the deletion window and the effective date, to the operative A4015 R3 reprint. Two facts changed on enactment: the age-verification data deletion window is 15 days, not the 60 the introduced bill carried, and section 14 gives the injured child a private right of action, brought by a parent or the Attorney General on their behalf, worth the greater of $5,000 per violation or treble damages. The private right of action was not previously recorded.
  • Illinois: HB 5511 (Children’s Online Social Media Safety Act) signed 2026-07-31 as Public Act 104-0664, so pending flips to enacted_future; the 2028-01-01 effective date was already correct. The litigation field, which still said the bill was not yet law and that the Governor had said he would sign it, is rewritten. Separately, the penalty sentence was wrong and had been since the entry was written: it described $2,500 per child for negligent and $7,500 per child for intentional violations, which is SB51’s language (and SB51 caps them at "not more than" those figures), not this Act’s. SB51 is a different Illinois bill, the Age-Appropriate Design Code Act, which died in committee. Enacted section 25(g) sets a flat $50,000 for each violation with AG-exclusive enforcement, and section 25(k) bars a private right of action.
  • Tennessee: The Sixth Circuit decided NetChoice v. Skrmetti on 2026-08-28 (No. 25-5660, published). The panel vacated the denial of NetChoice’s preliminary-injunction motion and remanded for reconsideration, holding the district court abused its discretion on irreparable harm; it took no position on the First Amendment merits. No injunction issued, so the Act stays in_force. The entry previously said the appeal was argued with no decision. Both signedDate values were re-checked this pass and both are correct as they stood: the Tennessee history table is action-then-date, and it records HB 1891 signed 2024-05-02 (Pub. Ch. 899 assigned 05-13) and HB 1181 signed 2023-05-11 (Pub. Ch. 408 assigned 05-24).
15 more changes · 12 states
  • Connecticut: CTDPA minors’ provisions: the entry still described a regime that was superseded on 2026-07-01. Public Act 25-113 section 9 repealed and replaced Conn. Gen. Stat. 42-520, widening the band from 13-15 to 13-17 and striking the consent exception, which turns an opt-in consent model into a flat prohibition on targeted advertising and sale for known minors. appliesToUnder corrected 16 to 18 and the requires text rewritten.
  • Arkansas: Three signedDate corrections read off each act’s own endorsement page: Act 689 of 2023 from 2023-04-12 to 2023-04-11, and Acts 900 and 901 of 2025 from 2025-04-22 to 2025-04-21. The Act 900 correction also makes that entry internally consistent, since section 8 ties its operative date to one year after enactment and the entry already carried 2026-04-21. Litigation for all three updated: the consolidated opening brief in the Eighth Circuit appeals was filed 2026-08-06, the extended date the appellants had requested. No argument date is set and the injunctions remain in effect.
  • Rhode Island: AI Companion Models act: codified citation corrected from R.I. Gen. Laws ch. 6-63 to ch. 6-64. Both enacted chapter documents carry tracked-changes formatting showing the chapter renumbered by floor amendment before enactment; every final section reads 6-64-1 through 6-64-5 and no un-struck reference to 6-63 survives in either. The general-laws index for 6-64 still returns 404 because the Law Revision Commission has not recodified it, the law not being effective until 2027-01-01; the enacted Public Law text controls.
  • Louisiana: App Store Accountability Act renamed from "as amended by" to "superseded before taking effect by". Act 185 section 1 provides verbatim that "Act No. 481 of the 2025 Regular Session shall not become effective", so Act 481 never operated and there was nothing to amend; the framework is carried instead by the new Part II at R.S. 51:1771-1775. Dates and substance are unchanged.
  • Virginia: SB 854: the Fourth Circuit ruled on the motions the entry had recorded as undecided and set a firm argument date. It granted the motion to expedite argument 2026-07-16, denied the Commonwealth’s renewed motion to stay the injunction pending appeal 2026-08-24, and calendared argument for 2026-10-28 at 2:00 p.m. on 2026-08-27. The preliminary injunction remains in effect.
  • Colorado: HB24-1136: Colorado filed its reply brief 2026-08-14, the clerk’s extended deadline, so Tenth Circuit merits briefing is now complete. The 2026-08-07 entry had corrected the opposite claim; it is now true. Amici recorded. No argument date set; the preliminary injunction stands.
  • Minnesota: Social Media Mental Health Warning Label Law: the renewed motion to dismiss is now fully briefed, NetChoice having filed its opposition 2026-07-29, with the hearing set for 2026-10-19 before Judge Brasel. Still no preliminary injunction sought or entered.
  • Texas: SCOPE Act: the Fifth Circuit opinion set the mandate to issue 2026-08-14, but no later docket entry confirming issuance is publicly available, so the entry now records that date as scheduled rather than verified, and the requires field no longer asserts that the targeted-advertising and age-verification provisions are currently enjoined: their injunction was vacated on 2026-07-24 and they should be treated as live duties unless a docket check shows the mandate still withheld. Status is unaffected either way. App Store Accountability Act: the Fifth Circuit heard expedited merits argument on 2026-08-04 (No. 25-51073); the entry had said argument was expected in early August. No decision yet.
  • California: AB 1856 stays pending, which the taxonomy defines to include passed-but-unsigned, but the prose was stale. It passed the Senate 39-0 on 2026-08-26 and the Assembly concurred 69-0 on 2026-08-27; the Legislature began its final recess on 2026-08-31 without the bill being signed or vetoed, so the Governor has until 2026-09-30 to act. (Wording corrected in the 2026-09-08 entry: this originally said the Legislature adjourned sine die on 2026-08-31.)
  • North Carolina: HB 301: the official history now carries dates worth recording. It passed the House 2025-05-06, the Senate substituted and passed it 2026-06-10, the House failed to concur 111-0 on 2026-06-23, and conference committees were appointed 2026-06-23 and 2026-06-24, where it has sat since. It has never been presented to the Governor.
  • Nevada: Still no tracked law, but the discovery sweep found one enacted, in-force statute that had never been evaluated: AB 406 (2025), an AI scope-of-practice and mental-health law that bars AI systems from practicing or claiming to practice mental or behavioral health care and bars public schools from replacing counselors with AI. Ruled out-of-scope after owner review: it regulates the practice of care, not companion-chatbot design or minors’ data, and its operative section is age-neutral. Recorded in the Nevada entry’s out-of-scope note so the next sweep does not re-litigate it.
  • Indiana: The CDPA minors entry cited an Indiana Code URL that returned a 691 byte shell. The URL was not dead: iga.in.gov serves that shell to a default User-Agent and the real 522 KB PDF to a browser one, so the article had been unreadable for reasons nobody had diagnosed. Repointed from the 2024 to the current 2026 print and re-read: IC 24-15-2-28(3) still makes "personal data collected from a known child" sensitive data, and IC 24-15-3-1(b)(5) still requires COPPA-compliant processing of it. No substantive change.
  • Four entries that an earlier draft of this refresh could only corroborate from secondary sources were closed against primary text before asOfDate moved, since asOfDate asserts a primary-source sweep. Hawaii Act 248: enrolled SB 3001 CD1 section 7 reads "This Act shall take effect upon its approval", which grounds the 2026-07-14 date. Georgia Act 463: the enacted act adds O.C.G.A. 39-6-1 through 39-6-5 and takes effect 2025-07-01, read from the act rather than a law-firm summary. Arkansas Act 901: the 2025 Senate Journal records sine die on 2025-05-05, and the constitutional default counts 91 days from there to 2025-08-03, matching the recorded date. Indiana: see above.
  • Watch item for the next pass, recorded here because two of these would change tracked entries. Four California bills passed both houses before the final recess began on 2026-08-31 and await the Governor, whose deadline once each is presented is 2026-09-30: SB 1119 would amend the tracked SB 243 companion-chatbot law, AB 2246 would replace the tracked CAADCA framework, AB 1709 would bar addictive features for under-16 users, and SB 867 would ban toys containing companion chatbots. None is enacted, so none is tracked yet.
  • Federal watch re-verified. Senate Commerce advanced its whole kids’ online-safety package at Executive Session 24 on 2026-08-05: KOSA (S. 1748) was ordered to be reported favorably by voice vote as amended by the Blackburn substitute, alongside S. 4199, S. 4407 and S. 5171 by voice vote and S. 737 by a 15-13 roll call. KOSA is not yet formally reported and is not on the Senate calendar. H.R. 7757, S. 836 and S. 278 are unchanged from the previous record. The COPPA Rule is still unamended since 2025-06-23; the eCFR versioner shows only a re-issue of section 312.11 dated 2026-08-17 carrying the same amendment date, which is a rendering refresh and not a substantive change. The FTC’s 2026-02-25 age-verification enforcement policy statement remains in force.

Event-driven fix from issue #253, not a refresh.

The South Carolina H.3431 entry described a parental-consent scheme that was amended out of the bill before enactment; the sentence is removed, the entry is renamed after the enacted Chapter 80 heading ("Age-Appropriate Code Design"; the act has no short-title clause), and its category flips social_media to aadc to match the enacted scope. asOfDate stays 2026-07-18; only SC H.3431 was re-verified.

Dataset held 107 tracked laws & bills after this change.

  • South Carolina: H.3431: the requires field claimed social media companies may not permit a SC-resident minor to be an account holder without parental consent (eff. Mar 1, 2026). The enacted Act 96 contains no such provision: the original House bill’s account-holder/consent scheme was gone by the 2025-05-01 Senate version, ~9 months before enactment, and the ratified text has zero occurrences of "consent" or "March" (checked on the raw HTML). Sentence removed. The entry is renamed from the pre-amendment "Social Media Regulation Act" after the enacted Chapter 80 heading, "Age-Appropriate Code Design" (the act has no short-title clause, so the entry name appends "Act" to the heading; the old title survives only in the bill caption, which was never conformed to the substituted body), and its category flips social_media → aadc to match: all five "social media" mentions in the ratified text sit in that caption, while the operative §§ 39-80-10 through 39-80-80 regulate "covered online services" throughout. The SHASM entry’s cross-reference (which had the words in the other order, "Design Code") is conformed to the same heading. Ages (minors under 18), treble damages and personal liability for wilful/wanton violations re-verified in the ratified text. Closes issue #253.

Event-driven fix from a CourtListener alert triage, not a refresh.

Litigation strings for the Colorado, Virginia and South Carolina suits re-verified against the appellate dockets and each statute re-verified against its legislature page; the Nebraska Design Code source link now points at text that actually contains the LB 838 amendments. asOfDate stays 2026-07-18; only the entries below were re-verified.

Dataset held 107 tracked laws & bills after this change.

  • Colorado: HB24-1136: the litigation string said merits briefing was complete; it is not. Colorado’s optional reply brief is due 2026-08-14 under a 10th Cir. clerk’s order (docket entry of 2026-07-22) stating no further extensions will be granted on the clerk’s authority. The 2025-11-06 preliminary injunction was re-verified against the order itself (D. Colo. ECF 31: Colorado "PRELIMINARILY ENJOINED from enforcing Section 4"). NetChoice requested oral argument; none is set.
  • Colorado: HB26-1263: signedDate corrected from 2026-05-28 to 2026-05-29. The legislature’s page shows the Governor signed 05/29/2026; 05/28 was the Speaker/President signing and transmittal. Effective date 2026-08-12 (Chapter 208, no-safety-clause default) re-verified with no referendum petition on file; status stays enacted_future until the date arrives.
  • Virginia: SB 854: the 4th Cir. tentatively calendared NetChoice v. Jones for the Oct 27-30, 2026 argument session (clerk entry of 2026-07-27, its word "tentatively" preserved). Merits briefing closed with the Commonwealth’s 2026-06-12 reply. The renewed stay motion and both expedite motions were briefed through a 2026-07-09 reply with no ruling visible on the docket; two docket entries (44, 55) were not retrievable, so the string claims no ruling is shown rather than that the motions are pending. Statute re-verified via the LIS API: approved 2025-05-02, Chapter 703, effective 2026-01-01.
  • South Carolina: H.3431: replaced the stale future-tense audit-report clause with neutral phrasing. Section 39-80-70(A) sets a recurring annual deadline of July first; the statute set 2026-07-01 as the first one. Dropped the "operational requirements applied from Mar. 1, 2026" clause: the enacted text of Act 96 contains no March 2026 applicability date (the parental-consent scheme carrying it was amended out before enactment; a follow-up will fix the same error in the requires field, so lastVerified deliberately stays 2026-07-18 here). PI motion in NetChoice v. Wilson remains undecided; recent docket activity is administrative only.
  • Nebraska: Design Code Act: sourceUrl repointed from the LB 504 slip-law PDF, which predates the LB 838 amendments the entry describes, to the codified Neb. Rev. Stat. § 87-1301 (Laws 2025, LB504; Laws 2026, LB838), whose sections carry the merged current text. The Revisor’s operative date for the LB 838 amendments is 2026-07-18, correcting the entry’s derived 2026-07-17. Closes the dead-source finding in issue #224.

Event-driven fix, not a refresh, plus a change to how freshness is recorded.

Three corrections verified against primary sources: the New York rulemaking that gated the SAFE for Kids Act is finished and the Act now has a date, the Texas SCOPE Act appeal was decided, and a Missouri note asserted a statute section that does not exist. The federal watch is re-verified. Separately, every law now carries its own checked-on date, so a claim like "no suit filed" is dated per law instead of resting on one site-wide date. asOfDate deliberately stays 2026-07-18 because this pass re-verified only the entries below, not all 51 jurisdictions.

Dataset held 107 tracked laws & bills after this change.

  • New York: The SAFE for Kids Act has an effective date for the first time. The Attorney General adopted the implementing rules, adding Part 700 to Title 13 NYCRR, by Notice of Adoption LAW-39-25-00001-A (Filing No. 688) published in the State Register of 2026-07-29. That closes the 2026-10-01 lapse risk this entry previously carried. Recorded as effective 2027-01-25, the date both 13 NYCRR 700.11 and the Attorney General give, with a note that the Register’s own notice says 180 days after its 2026-07-14 filing date, which computes to 2027-01-10. The 15 day gap is real and unresolved, so the entry publishes the later date and tells a compliance reader to plan for the earlier one.
  • Texas: The SCOPE Act (HB 18) appeal was decided 2026-07-24. The Fifth Circuit affirmed the injunction against the monitoring-and-filtering requirement as preempted by Section 230(c)(1), and vacated the separate injunction covering targeted advertising, unlawful ads and age verification for lack of standing (the age-verification challenge is additionally foreclosed by Free Speech Coalition v. Paxton). Status stays in_force: the ruling narrows the injunction, so more of the Act is enforceable after it than before. The mandate is set for 2026-08-14, so the newly unenjoined provisions are not yet operative.
  • Missouri: Corrected a false out-of-scope note. It said HB 3393’s text was enacted as Sec. 407.3475 and pointed the reader to an entry "listed above" that does not exist. The bill died in Senate General Laws: its last action was a cancelled hearing on 2026-04-27 and it never reached Truly Agreed and Finally Passed. Sec. 407.3475 is not in the Revised Statutes. Missouri correctly remains a no-in-scope-law state; only the explanation was wrong.
  • Federal watch re-verified. Senate Commerce has now noticed Executive Session 24 for 2026-08-05 with KOSA (S. 1748) on the agenda, which the previous note said was unscheduled. S. 278 was miscategorized as awaiting markup; it has been on the Senate Legislative Calendar since 2025-06-30. S. 836 is held at the desk in the House, never referred to committee. The COPPA Rule compliance deadline of 2026-04-22 has passed and is now written in the past tense; the eCFR versioner shows 16 CFR Part 312 unamended since 2025-06-23.
  • Every law now records its own checked-on date, shown under its primary-source link. Previously 48 laws carried hand-written "as of <date>" stamps inside their litigation prose, spread across four different dates, while roughly 25 more made undated negative claims ("None found.") that the single site-wide date silently re-asserted for laws nobody had re-checked. A negative claim is honest when it is dated and misleading when it floats. The dates moved out of the prose and into a field, so a future pass can record exactly which laws it verified rather than restamping all of them. The page now publishes the OLDEST of those dates, a claim that stays true when a pass covers only part of the map. Nothing about the underlying facts changed here, and the published date is the same 2026-07-18 it was before.

Completes the AI companion statute review.

Five laws added, all read from enacted or officially transmitted instruments: Washington, Nebraska and Rhode Island enacted, one New York bill awaiting the Governor, and the tracker’s first vetoed entry in Arizona. Two existing entries corrected to age neutral. AI companion laws are context only and never color a state on the map.

Dataset held 107 tracked laws & bills after this change.

  • Washington: Added the AI Companion Chatbots law (ESHB 2225, Chapter 168), signed 2026-03-24 and effective 2027-01-01. Its disclosure cadence for known minors is at least every hour of continuous interaction, the strictest of the 2026 companion statutes; Idaho, Iowa and Oregon all use three hours. Violations are per se unfair or deceptive acts under the state Consumer Protection Act.
  • Nebraska: Added the Conversational Artificial Intelligence Safety Act, sections 12 to 18 of LB 525, signed 2026-04-14 and operative 2027-07-01. The minor disclosure can be satisfied by a persistent visible disclaimer instead of the three-hour cadence, a compliance path the sibling statutes lack.
  • Rhode Island: Added the Artificial Intelligence Companion Models act (Public Laws 2026 ch. 376), enacted 2026-06-22 and effective 2027-01-01. The enacted text is entirely age neutral: the emotion notice and the private right of action that commercial trackers still describe were both stripped before enactment, and the entry says so.
  • New York: Added the unsafe AI companion features prohibition (S 9051-B), which passed both houses in early June and had not been delivered to the Governor as of 2026-07-25. Listed as pending until she acts. Also corrected the Artificial Intelligence Companion Models law (GBL Article 47) to age neutral: its own entry says it has no minor-specific tier, so it no longer counts in the age lens.
  • Arizona: Added HB 2311, the tracker’s first vetoed entry. It passed both chambers and Governor Hobbs vetoed it 2026-06-19, writing that the bill limits damages to families, prohibits families from bringing their own lawsuits, and ties the state’s hands in bringing actions.
  • Minnesota: Corrected the social media warning label law to age neutral: the statute itself has no age restriction, so it no longer counts in the age lens.
  • Schema note: laws with no age line are now recorded as age neutral rather than being given an under-18 ceiling they do not contain. Age neutral laws are excluded from age lens counting, and their cards read “age neutral” instead of “not at N” when an age lens is active.

Event-driven data fix, plus four new AI companion laws and two corrections.

Fixes four entries that were wrong or misleading on the live page, reconciles the July 18 law count, adds the Colorado, Idaho, Iowa and Oregon conversational AI acts, and gives New York’s SAFE for Kids entry a real deadline. No status flips and no map changes: AI companion laws are shown for context and do not color a state. asOfDate stays 2026-07-18 because this pass re-verified only the entries listed below, not all 51 jurisdictions.

Dataset held 102 tracked laws & bills after this change.

  • Four AI companion-chatbot laws added, in Colorado, Idaho, Iowa and Oregon. All four were read from the enacted instrument rather than a tracker table, which caught three errors: Idaho’s bill was amended on the floor, so the introduced text is not the law; Oregon’s minor break reminder is every three hours, not hourly; and Iowa’s act takes effect 2026-07-01 but does not apply until 2027-07-01, so nothing binds an operator yet. Oregon is the outlier of the group in giving individuals their own right to sue.
  • Idaho: Added the Conversational AI Safety Act (S 1297, Chapter 249), effective 2027-07-01. Note the code citation is contested: Title 48 chapter 21 was already taken by the social media act in the same session, so the sections are published double-numbered as 48-2101 [48-2201].
  • Iowa: Added the conversational AI service requirements (SF 2417, Iowa Acts ch. 1068). The act has no short title. It took effect 2026-07-01 but applies 2027-07-01, so it is listed as not yet effective.
  • Oregon: Added the AI companions act (SB 1546, Oregon Laws 2026 ch. 85), effective 2027-01-01. It carries an express private right of action, the greater of actual damages or $1,000 per violation, which none of the other three do.
  • Colorado: Added HB26-1263, the conversational AI operator act (Chapter 208), signed 2026-05-28. The act takes effect 2026-08-12, but only the age-estimation duty attaches then: the minor-specific duties, the AI disclosure, the suicide and self-harm protocol and the false-representation ban all start 2027-01-01, and reporting to the Attorney General starts 2027-07-01. For a kids’ product the date that matters is 2027-01-01.
8 more changes · 6 states
  • New York: The SAFE for Kids Act now carries a deadline instead of an open-ended “no final rule yet”. The New York State Register of 2026-07-22 still lists the rulemaking as proposed, with an expiration of 2026-10-01, so the Attorney General must adopt final rules by then or the proposal lapses and the 180-day clock never starts. The source link now points at the codified statute rather than the 2023 bill page.
  • Virginia: Recorded the precise-geolocation sale ban added by SB 338 (2026 Acts c. 820), effective 2026-07-01. It is not limited to minors, so a kids’ wearable or family-location app cannot monetize Virginia location data at all. The known-child duties in subsection F are untouched.
  • Nebraska: The Age-Appropriate Online Design Code Act was being described as the 2025 statute, without the LB 838 (2026) amendments that became operative 2026-07-17, one day before the last refresh. LB 838 removed the old "50 percent of revenue from selling or sharing data" threshold, so ordinary subscription and ad-supported apps are now covered, grew the covered design feature list from 5 items to 11, added a notification curfew, and added rules against weakening a minor account's defaults.
  • New Jersey: Repaired a garbled passage in the Kids Code Act summary that had a duplicated vote tally and a broken sentence. The bill passed both chambers 2026-06-30 and is still unsigned.
  • Massachusetts: Removed a 2026-10-01 effective date from a bill that is not law; that date comes from the engrossed House text, not from an enacted statute. Also updated the addictive-feeds bill, which was reprinted as amended and engrossed as S.3175 and referred to House Ways and Means on 2026-07-15.
  • Louisiana: The Louisiana Data Privacy Act note read backwards, implying the Attorney General cannot act until 2027-08-01. That date is when the mandatory cure period ends, not when enforcement begins.
  • Federal: the Senate Commerce markup of KOSA and the Kids Off Social Media Act has slipped off its July 29, 2026 target, and no replacement date is noticed on the committee calendar. Also records the KIDS Act being received in the Senate and referred to Commerce on 2026-07-13.
  • Corrected the law count in the 2026-07-18 entry below, which said 93. The dataset held 98 on that date: the AI companion category and its five laws landed the same day, in a change that predates this changelog and never got an entry of its own.

Owner-reviewed corrections from a New Hampshire and Indiana label audit.

No status, date, or rollup changes; both states stay enacted, not yet effective.

Dataset held 98 tracked laws & bills after this change.

  • New Hampshire: HB 1460's primary source now points at the chaptered final version (Chapter 168); the RSA 507-H merged page does not yet incorporate it.
  • Indiana: HEA 1408 now spells out the effective-date split: the education provisions took effect 2026-07-01, the social-media article takes effect 2027-01-01.

Monthly data refresh for 2026-07.

Tracked laws went from 110 to 98: 25 dead bills dropped after their sessions adjourned, 8 laws added here, and 5 more added the same day with the new AI companion category. asOfDate moved to 2026-07-18. This was also the tracker’s full-review baseline month, when all 51 jurisdictions were re-verified against primary sources and the dataset-invariant spec was written, so the changelog starts here and does not reconstruct earlier history.

Dataset held 98 tracked laws & bills after this change.

  • Connecticut: SB 1295 minors framework flipped to in force (took effect 2026-07-01).
  • Idaho: HB 542 flipped to in force; the enrolled text keeps the July 1, 2026 emergency effective date.
  • Mississippi: HB 1224, the Keeping Kids Safe Online Act, flipped to in force (effective 2026-07-01).
  • Nebraska: LB 383 flipped to enacted, enjoined after a split preliminary injunction (NetChoice v. Hilgers), later stayed pending the 8th Circuit appeal.
  • Texas: SB 2420 effective date corrected to 2026-01-01; the field had held the Fifth Circuit stay date.
  • Louisiana: HB 37 signed date corrected to 2025-06-11 per the official action history.
  • 8 laws added: Minnesota's social-media warning-label law, New York's Safe by Design Act, South Carolina's SHASM Act, the minors provisions of Louisiana's and Alabama's new privacy statutes, Arkansas's Children and Teens' Online Privacy Protection Act, plus pending bills in California (AB 1856) and Massachusetts (S.3164).
  • 25 dead bills dropped across Alaska, Arizona, Colorado, Georgia, Kansas, Kentucky, Maryland, Minnesota, Missouri, Oklahoma, Rhode Island, South Carolina, Washington, and Wisconsin after their sessions adjourned without passage.
  • Every litigation string re-verified against the dockets (SCOTUS declining to vacate the Texas stay, the Ohio panel reversal that is not yet final, the consolidated 8th Circuit Arkansas appeals, and the rest).