Tech and Consumer Freedom

This category measures how freely consumers and entrepreneurs can use and offer new and beneficial technology under state law. It favors states and governors that open legal routes for new technology and leave developers and their adult customers free to build and use it.

This category focuses on adults, but as a practical reality, the laws intended to restrict the use of social media or artificial intelligence (AI) by minors can often also restrict the lawful and effective use of these technologies by adults. Laws that are not narrowly tailored to minors will affect the state grade.

Many social media and AI issues could have been included in the free speech category. In fact, much of the litigation and emerging case law surrounding these areas of policy hinges on First Amendment arguments. However, because state regulations will mostly manifest as denying the freedom to use a product or service to its fullest (if at all), we have placed these cross-cutting issues in this category instead.

Five states receive an A (in rank order; ties listed alphabetically): Texas, Pennsylvania, Arizona (tie), Kentucky (tie), and Ohio (tie). Texas has the highest score because it has some of the most permissive laws on driverless vehicles, the most robust residential electricity choice in the nation, and a regulatory sandbox for some industries, including AI.

Six states receive an F for the opposite reason (in rank order; ties listed alphabetically): Minnesota, Vermont, Oregon, Indiana, Idaho (tie), and South Carolina (tie). None of the six has electricity choice or a regulatory sandbox, and all but Vermont have no identified legal allowance for driverless vehicles. Idaho and South Carolina have among the least permissive AI- and web-access laws.

Four governors receive an A (in rank order): Texas’s Greg Abbott (R), Pennsylvania’s Josh Shapiro (D), Montana’s Greg Gianforte (R), and Utah’s Spencer Cox (R). Abbott scores the highest due to his creation of state regulatory sandboxes and him signing bills that made Texas an early adopter of reforms that allow fully autonomous vehicle operation on the state’s roads.

Seven governors receive an F (in rank order): Vermont’s Phil Scott (R), Oregon’s Tina Kotek (D), Arkansas’s Sarah Huckabee Sanders (R), Minnesota’s Tim Walz (D), Indiana’s Mike Braun (R), Idaho’s Brad Little (R), and South Carolina’s Henry McMaster (R), with the last two tied for last, just like their respective states. Little and McMaster earn their low grades for signing into law key restrictions on AI and social media use, which pulled down their states’ grades.

By our count, 30 governors signed bills that restrict AI and social media use. For instance, Illinois’s JB Pritzker signed a ban on consumer-facing therapy chatbots, and Nevada’s Joe Lombardo signed a ban on consumer use of AI tools for mental health care guidance. Other technologies have been the subject of attempted restrictions too. Kansas’s Laura Kelly lost points for vetoing a sandbox law that the legislature enacted anyway (a benefit that is reflected in the state score), and Kentucky’s Andy Beshear vetoed driverless vehicle bills (but his veto was overturned by the legislature). On the other end of the spectrum, Gianforte signed Montana’s “right to compute” law, which could limit future restrictions on the growth of AI in the state.

This category consists of four scored variables:

• Social media and AI restrictions
• Retail electricity choice
• Regulatory sandboxes
• Autonomous vehicle regulations

The scores on social media and AI are based on the National Conference of State Legislatures’ databases of tech regulations. Retail electricity choice scores use data from the Retail Energy Supply Association. The regulatory sandbox data are based on the tracker from the Libertas Institute, a free-market policy institute based in Utah. The autonomous vehicle scores are based on both the Insurance Institute for Highway Safety’s 2026 survey of state laws and the National Conference of State Legislatures’ database. In cases where the data and surveys needed to be updated, we supplemented these sources with our own analysis of state statutes and bill enactments.

This variable tracks five restrictions in state laws pertaining to the adult use of social media, apps, AI, and websites. The common feature of these rules is that they restrict how users can use these services and tools, diminishing their value, increasing the possibility of privacy violations or identity theft, or both. Some of these regulations are direct burdens on the user, but some apply to social media or AI companies themselves through state-added liability rules. Those legal burdens could discourage a company from offering services that might increase its legal exposure to any of the users in that state. This burden trickles down to users as a decrease in functionality, or it could be as extreme as blocking users in a state from using the service at all.

Nothing in this section pertains to a private company’s independent decision to build parental controls into its product. Many companies have already developed tools within their software that give parents direct control over their child’s use of a device. Yet when it comes to parents’ decisions about the appropriate use of technology, some states have placed themselves between the parent and child, passing laws that ban certain tools, social media apps, and web services for minors, even if the parents would otherwise have authorized them. Those types of restrictions are also measured here.

In this variable, each state starts with 10 points and loses points for each of the restrictions it has enacted. If it has passed a version of all five restrictions, it receives 0 points.

States aren’t penalized for laws that have been enjoined by a court prior to September 1, 2026—from the user’s perspective, a state that can no longer enforce a rule is effectively the same as one with no such rule at all. However, governors do receive deductions from their scores for having signed these restrictions into law in the first place. In addition, many of these restrictions were passed as part of large, multipart omnibus regulatory bills. The restrictions themselves are what is being scored, and care has been taken to avoid double-counting statutory provisions.

States lose 2 points (unless otherwise specified) for enacting each of the following restrictions:

Age-verification mandates for apps and social media are sold as a way to protect kids, but they burden everyone: The only way to prove someone is not under 18 is to prove they are 18 or older. So, as a practical matter, every user, adult or teen, must provide a government identification number, a face scan, or other personal data simply to get online. That creates new privacy and security risks since sensitive data collected and stored by platforms or third-party verifiers become a target for hackers. It also chills free expression by ending anonymous speech. It is true that not every form of age verification is equally intrusive, so states that require the provision of sensitive information, particularly a government identification number, receive the full 2‑point deduction. Simply requiring users to type their birthdate into an on-screen prompt results in only a 1‑point deduction.

Courts have begun to rule that age verification for sites on which a specified share of the content is “harmful to minors” is constitutional. Although the court decisions to date might allow age verification, they do not compel states to adopt age-related restrictions or prohibit adults from using the websites at issue.

In addition, what “harmful to minors” means varies by state. Pornography is always included in the definition, but in some places, the definition could also include a photograph of a same-sex couple getting married. The thresholds vary by state as well: Some require age verification if more than a third of the content is deemed to fit the definition, and in some states, it is a quarter or more. These broad definitions could loop into the mix sites like Reddit or Discord, which wouldn’t typically be considered adult-only sites.

Of course, the same problems noted above about age verification persist here. Just as before, the full 2‑point deduction applies to the requirement to use a government-issued identification or bank card as proof of age, but only 1 point is deducted if an adult simply has to enter their birthdate.

Some states have banned AI services for specific uses, such as chatbots intended to provide medical advice. These services—which have been helpful to many users—are likely still being used by residents of these states via location-masking technology, such as a virtual private network. But having to rely on such workarounds means residents of those states are less free than people in states that allow the services outright. Those states, therefore, receive a full 2‑point deduction.

Although the case law is still evolving, nothing currently keeps plaintiffs from suing technology companies for damages under existing laws. Yet some states have gone further and created new litigation avenues for private plaintiffs to sue AI and social media companies for “harmful design”—a term that can be vague and differ from state to state—as well as new opportunities for cases to be brought by a state’s attorney general. Increased legal liability likely discourages companies from offering covered products to anyone in that state, adults included. States that have created these causes of action receive a 2‑point deduction.

Similar to the “harmful design” laws, these laws place additional legal responsibility on companies that offer chatbots to monitor what answers they generate and whether the answers run afoul of the government’s vague definition of harm. As stated above in relation to the other restrictions, a possible, maybe even likely, outcome is that a company subject to this law will simply not allow anyone in that state, adult or minor, to access the tool at issue. A state receives a full 2‑point deduction for enacting such a law.

Customers fare better when electricity sellers compete for their business. In most states, consumers are forced to buy electricity from one monopoly provider. In states with retail electricity choice, by contrast, households can buy power from two or more competing retailers with different prices and plans, even when the local utility maintains the distribution infrastructure. This variable consists of three possible scores: States that have a robust market for electricity providers receive the full 10 points, those that have laws on the books to allow choice but lack a robust market (perhaps due to the unintended consequences of other regulations) receive 5 points, and those without any form of household choice—or where the choice of providers is only available to commercial users—receive 0 points.

A state regulatory sandbox allows businesses to develop and test new products, services, or business models under state-approved exemptions from specific regulations. States offer sandboxes because rules written for established industries can unintentionally stifle innovation or deter certain technology businesses from locating in a state or from deploying or offering their services there.

Where allowed, businesses in the sandbox operate under agreed-upon conditions, typically including a limited testing period, regulatory oversight, and consumer protections. This gives entrepreneurs an opportunity to demonstrate their ideas, and they often offer those services or technologies to consumers during that exploration period. Sandboxes can cover a specific industry (such as insurance or financial services), or they can be applied to all industries.

This variable consists of three possible scores: a full 10 points for states with universal sandboxes, 5 points for those with sandboxes for only one or two specified industries, and 0 points for states with none at all.

Driverless vehicles cannot operate on the roadways of a state unless state law expressly permits the activity. This variable measures the extent to which a state allows autonomous vehicles with no human driver on board to operate on public roads. The scoring is as follows: a full 10 points for broad driverless deployment, even if a permit or certification process is required by the state; 7.5 points for deployment consisting of limits on vehicle types and requiring an initial trial period; 5 points for driverless testing only while general deployment is not yet allowed; 2.5 points for “supervised testing,” which means the program requires an onboard human driver able to take control of the vehicle; and 0 points where there is no affirmative driverless testing or deployment framework in state law.