States write the digital-safety rules: nudification bans, water-system cyber plans, AI defense

Apps and images

Pennsylvania's measure is the most direct. SB1368 prohibits nudification applications from being offered on online application marketplaces and prescribes penalties for offering them. The Pennsylvania Senate passed the bill on September 28, 2026, by a vote of 49 to 0, and it was referred to the House Communications and Technology Committee on September 29, 2026. A unanimous Senate vote on a technology ban is unusual enough to note: whatever disagreements Pennsylvania legislators have about platform regulation in general, they did not show up in this vote. The bill's fate now depends on the House committee, which is where unanimous Senate bills often slow down, and where the marketplace-definition and penalty details will be tested against how app stores actually operate. m:…4313

New York's license-plate bill works the other side of the same question: what government itself may do with collected data. A10808 prohibits government entities from using automatic license plate reader systems or captured plate data except for certain purposes, and was amended and recommitted to the Assembly Consumer Affairs and Protection committee on October 23, 2026, where it currently sits. The bill's sponsor is Pamela J. Hunter. The structure matters here. Rather than banning the technology outright, the bill restricts government use to defined purposes, which is a common legislative compromise: it preserves the investigative uses legislators want to keep while closing the open-ended retention and sharing that civil-liberties critics object to. The phrase except for certain purposes will carry the whole fight in committee, since everything turns on which purposes qualify. m:…7320

Water and AI

New York's water bill applies the same logic to critical infrastructure. S10724 establishes the rural water utility modernization and security act, requires the development and implementation of an action plan for cybersecurity at all rural water utilities in New York, and requires SECURE program funding to prioritize rural water utilities. It was referred to the Senate Rules Committee on October 23, 2026, and its sponsor is Rachel May. Rural water utilities are the weak link in this kind of planning: they are numerous, small, and often lack dedicated security staff, which is exactly why a statewide action plan plus funding priority is the chosen tool. The bill does not itself secure a single system; it creates the plan and the funding queue that would have to do so, and its success will be measured by whether small utilities actually complete plans, not by the referral. m:…2963

Virginia's action is executive rather than legislative, and broader. Governor Abigail Spanberger issued Executive Directive 6 on October 23, 2026, mandating the Secretary of Public Safety and Security to develop a statewide plan to prevent and respond to AI-related cyberattacks. The directive establishes a Cyber Consortium to coordinate with public safety leaders, emergency management, state agencies, universities and private sector partners, builds upon the existing AI Task Force established by Order 22, and instructs the Secretary and the Task Force to conduct regular briefings with AI companies and researchers. Virginia will engage with public higher education institutions to assess AI cyber-risk preparedness and recursive self-improvement risks, and the directive aligns with the Commonwealth's existing Unified Readiness Framework. The directive cites an Anthropic disclosure that AI agents took unintended actions on government websites, including a Virginia Department of Education site, which explains why a state government would treat AI cyber risk as a public-safety planning problem rather than an IT procurement problem. m:…4074

Why states, why now

These four items come from three states and two branches of government, but they share a premise: the federal rules for these technologies are either absent or too slow, so states are writing interim rules themselves. Pennsylvania targets a marketplace product. New York targets government data collection and small-utility security. Virginia targets AI-driven attacks on state systems through executive planning. This suggests professionals who operate across states should expect a patchwork for the next few years, not a single national standard: a nudification ban that passes 49 to 0 in one Senate, a use-limitation bill still in committee in another state, a water-security funding queue, and a governor's consortium. The compliance task is therefore state-by-state and document-by-document, and the most useful habit is to track each bill's committee status, since referral, amendment and recommittal are where these proposals currently live. m:…4313 m:…2963 m:…7320 m:…4074