Tech Policy Across the State Governance Stack

Amid sporadic and scattershot federal technology regulation over the past few years, states have taken the lead in driving technology policy development in the US. In 2024, every state with an active legislative session passed a meaningful piece of technology regulation. In a recent report, we tracked 238 pieces of state technology legislation enacted across eight key areas.

Yet, 2024 made clear that technology policy below the federal level isn’t limited to those state regulators. Increasingly, city governments, school boards, public utility commissions, and other local government bodies play a role in technology regulation. School boards are banning cell phones in classrooms, cities are pushing back on data center development, public utility commissions are rewriting agreements with major technology companies, and state agencies are crafting new AI procurement policies that will force new safety and transparency measures. As state technology regulation matures, researchers and policy analysts must look beyond state legislatures, governors, and courts to consider the technology policy happening across the state governance stack, including what is happening in local communities.

Over the next year, the Center on Technology Policy at New York University will be working on expanding the aperture of our analysis of state technology policy to consider the broader patchwork of agencies and jurisdictions that contribute to state technology policy regulation. Here, I offer a few examples of how policymakers beyond just legislatures, governors, and state courts are making significant contributions in three key areas of technology policy: AI, data centers, and child online safety.

Artificial Intelligence

State government agencies increasingly use AI tools to direct social services, do predictive policing, and detect fraud. Rather than create their own AI systems, most agencies purchase products from commercial vendors. While this means that states are, to some degree, delegating critical decision-making to AI companies, it also means that state agencies can potentially compel those providers to improve their product policies, safety standards, or transparency measures. This gives agencies significant latitude to effectively set policy.

Increasingly, states, and even some municipalities, are rethinking and expanding their AI procurement policies to minimize potential risk. For example, both Colorado and California now require all procured generative AI tools to undergo a risk assessment using the National Institute and Standards and Technology (NIST) Risk Management Framework (RMF) on AI. California also developed a generative AI toolkit that walks state employees through required risk assessments and considerations when purchasing or using generative AI. The New York City Artificial Intelligence Action Plan, which the city adopted in late 2023, requires the city government to:

Develop AI-specific procurement standards or guidance to support agency-level contracting, ensuring procured products adhere to the city’s AI principles and goals and take steps to mitigate risks, including challenges with respect to transparency and explainability that can occur when procuring AI tools from third-party vendors.

Even states that have not yet developed extensive new procurement policies have signaled interest in doing so. Dozens of states have created new AI working groups or advisory councils to oversee or create recommendations on procurement policies. For example, in 2024, the Texas legislature created an AI advisory council specifically tasked with studying and monitoring procured AI systems and recommending “administrative actions that state agencies may take without further legislative authorization.”

Data Centers

For over a decade, many states have granted data center developers state sales and use tax relief and other tax incentives to attract data center investment. In the last several years, however, as AI and cryptocurrencies drive greater and greater energy demands, policymakers, analysts, and advocacy groups have started to question the actual costs and benefits that data centers offer communities. In particular, many are weighing job creation against added strain on energy grids, increased consumer energy costs, noise pollution, and environmental impact. While state legislatures and executives consider and debate the trade-offs, other state regulators are taking action to incentivize and limit data center development.

For instance, as the Mississippi legislature pushed through a series of laws last year granting Amazon significant tax incentives to build two new data centers, the government of Madison County, the site of one of the proposed data centers, offered a $215 million infrastructure investment to support the data center investment. Taking a slightly different approach, the Chicago City Council advanced an ordinance offering both a carrot and a stick to encourage data center development in the area. The ordinance would eventually require all city government data to be stored in local data centers but also would provide a credit to vendors for moving data centers locally. The same ordinance also would establish a working group to issue a detailed report on how to mitigate the environmental costs of new data center construction.

Rather than focus on macro questions of the economic value of data centers, cities and counties have tried to address the harms of living within a community with large data centers. For example, the Board of Supervisors in Fairfax County, Virginia, passed a new zoning ordinance to restrict data building to certain areas of town and create distance from residential areas. The ordinances also require equipment to be shielded to reduce noise. A series of municipalities have also passed ordinances in the last few years to restrict the noise data centers produce. After a series of cities in Arkansas passed ordinances requiring noise reduction, in 2023, the state legislature enacted a series of laws that prevented cities from establishing such noise ordinances for both data centers and cryptocurrency mines. Notably, in 2024, the legislature rolled back these laws with a pair of new statutes.

But perhaps most significantly, recently public utility commissions are flexing their muscles regulating data centers. Public Utility Commissions regulate energy company monopolies, overseeing energy rates, as well as a host of other building and operational requirements.

Last year, the Public Utility Commission of Ohio issued a moratorium on new data center construction after a prominent Ohio energy company, American Electric Power (AEP), filed a proposal that data centers increase their financial responsibility to the energy company. AEP proposed that data centers commit to paying 90 percent of their contract capacity each month (the previous rate was 60 percent) irrespective of how much they actually use, as well as paying an “exit fee” if the data center closes before 10 years. After months of negotiation, the parties settled on an agreement where data centers pay 85 percent of contract capacity each month.

As data center power consumption grows and more attention is given to the cost of electricity, the infrastructure needed to connect data centers, and the stress that data centers place on utility infrastructure, Public Utility Commissions are likely to play a key role in negotiating the terms of local agreements.

Child Online Safety

In the last several years, child online safety has been one of the most important technology-related priorities for state legislators. We recently counted that 23 states enacted 48 laws related to child online safety in 2024. Restricting cell phones in public schools has emerged as one of the central concerns for state regulators. While a handful of state legislatures restricted cell phones, other state regulators have also been moving to restrict cell phones in the classroom.

A series of school systems, districts, and individual schools have not waited for their state legislatures to act and have banned or restricted phones in classrooms. The New York City School System very nearly adopted a system-wide cell phone ban before reversing course last fall. A series of school districts in states from Texas to Maine and Massachusetts adopted restrictions on cell phones in classrooms. At the school level, individual schools in states including New York, Missouri, and Wisconsin have banned or restricted cell phones in schools.

Moreover, in several states, education departments have also issued non-binding guidance suggesting that schools ban or restrict cell phones. Education departments or other educational administrators in eleven states, including Oregon, Arkansas, and Washington, have all issued recommendations to state school districts restricting cell phones.

In technology policy circles, we often are biased toward the big and the flashy. The back and forth over federal proposals such as the Kids Online Safety Act or the American Data Privacy and Protect Act shows that just the possibility of federal regulation attracts an order of magnitude more attention than the policy that is actually made and enacted at the state or local level. Tracking, understanding, and contributing to the vast range of state, county, and municipal technology policies is a herculean task. But we must acknowledge that the project of regulating technology is spreading across the country. It is no longer limited to federal or even state regulators; instead, policymakers have taken up the project of regulating technology up and down the state governance stack.