---
title: States write the digital-safety rules: nudification bans, water-system cyber plans, AI defense
description: Pennsylvania's Senate passed a 49-0 ban on nudification apps in marketplaces, New York advanced cybersecurity plans for rural water utilities, Virginia ordered a statewide AI-cyber plan, and New York moved to restrict government license-plate readers.
canonical: https://hangingcontext.com/stories/2026-10-24/states-write-digital-safety-rules/
last-updated: 2026-10-24
url: https://hangingcontext.com/stories/2026-10-24/states-write-digital-safety-rules/
published: 2026-10-24T12:32:30Z
edition: 2026-10-24T12
newsroom: state-government
beat: None
trust: confirmed
source_count: 4
cited_manifest_ids: ['1792792218917464313', '1792783601281342963', '1792787804310374074', '1792783601281687320']
---

# States write the digital-safety rules: nudification bans, water-system cyber plans, AI defense

*Pennsylvania's Senate passed a 49-0 ban on nudification apps in marketplaces, New York advanced cybersecurity plans for rural water utilities, Virginia ordered a statewide AI-cyber plan, and New York moved to restrict government license-plate readers.*

Confirmed · 4 sources · State Legislatures & Executives · Published 2026-10-24 12:32 UTC

## Key facts

- Pennsylvania SB1368 prohibits nudification applications from being offered on online application marketplaces, passing the Senate 49-0 on September 28, 2026. [cites: 1792792218917464313]
- New York S10724 requires a cybersecurity action plan for all rural water utilities in New York and prioritizes them for SECURE program funding. [cites: 1792783601281342963]
- Virginia Governor Spanberger issued Executive Directive 6 on October 23, 2026, ordering a statewide plan to prevent and respond to AI-related cyberattacks. [cites: 1792787804310374074]
- New York A10808 prohibits government entities from using automatic license plate reader systems or captured plate data except for certain purposes. [cites: 1792783601281687320]

## Apps and images

Pennsylvania's measure is the most direct. SB1368 prohibits nudification applications from being offered on online application marketplaces and prescribes penalties for offering them. The Pennsylvania Senate passed the bill on September 28, 2026, by a vote of 49 to 0, and it was referred to the House Communications and Technology Committee on September 29, 2026. A unanimous Senate vote on a technology ban is unusual enough to note: whatever disagreements Pennsylvania legislators have about platform regulation in general, they did not show up in this vote. The bill's fate now depends on the House committee, which is where unanimous Senate bills often slow down, and where the marketplace-definition and penalty details will be tested against how app stores actually operate. [cites: 1792792218917464313]

New York's license-plate bill works the other side of the same question: what government itself may do with collected data. A10808 prohibits government entities from using automatic license plate reader systems or captured plate data except for certain purposes, and was amended and recommitted to the Assembly Consumer Affairs and Protection committee on October 23, 2026, where it currently sits. The bill's sponsor is Pamela J. Hunter. The structure matters here. Rather than banning the technology outright, the bill restricts government use to defined purposes, which is a common legislative compromise: it preserves the investigative uses legislators want to keep while closing the open-ended retention and sharing that civil-liberties critics object to. The phrase except for certain purposes will carry the whole fight in committee, since everything turns on which purposes qualify. [cites: 1792783601281687320]

## Water and AI

New York's water bill applies the same logic to critical infrastructure. S10724 establishes the rural water utility modernization and security act, requires the development and implementation of an action plan for cybersecurity at all rural water utilities in New York, and requires SECURE program funding to prioritize rural water utilities. It was referred to the Senate Rules Committee on October 23, 2026, and its sponsor is Rachel May. Rural water utilities are the weak link in this kind of planning: they are numerous, small, and often lack dedicated security staff, which is exactly why a statewide action plan plus funding priority is the chosen tool. The bill does not itself secure a single system; it creates the plan and the funding queue that would have to do so, and its success will be measured by whether small utilities actually complete plans, not by the referral. [cites: 1792783601281342963]

> **From Synorb** — Ask what Synorb covers. The MCP tool synorb-stream-search answers questions like "do you have this publisher?" without using any Manifest allowance. [Connect and ask](https://synorb.com/connect/start)


Virginia's action is executive rather than legislative, and broader. Governor Abigail Spanberger issued Executive Directive 6 on October 23, 2026, mandating the Secretary of Public Safety and Security to develop a statewide plan to prevent and respond to AI-related cyberattacks. The directive establishes a Cyber Consortium to coordinate with public safety leaders, emergency management, state agencies, universities and private sector partners, builds upon the existing AI Task Force established by Order 22, and instructs the Secretary and the Task Force to conduct regular briefings with AI companies and researchers. Virginia will engage with public higher education institutions to assess AI cyber-risk preparedness and recursive self-improvement risks, and the directive aligns with the Commonwealth's existing Unified Readiness Framework. The directive cites an Anthropic disclosure that AI agents took unintended actions on government websites, including a Virginia Department of Education site, which explains why a state government would treat AI cyber risk as a public-safety planning problem rather than an IT procurement problem. [cites: 1792787804310374074]

## Why states, why now

These four items come from three states and two branches of government, but they share a premise: the federal rules for these technologies are either absent or too slow, so states are writing interim rules themselves. Pennsylvania targets a marketplace product. New York targets government data collection and small-utility security. Virginia targets AI-driven attacks on state systems through executive planning. This suggests professionals who operate across states should expect a patchwork for the next few years, not a single national standard: a nudification ban that passes 49 to 0 in one Senate, a use-limitation bill still in committee in another state, a water-security funding queue, and a governor's consortium. The compliance task is therefore state-by-state and document-by-document, and the most useful habit is to track each bill's committee status, since referral, amendment and recommittal are where these proposals currently live. [cites: 1792792218917464313, 1792783601281342963, 1792783601281687320, 1792787804310374074]

## What is still unresolved

- Whether Pennsylvania's House Communications and Technology Committee advances SB1368, and with what amendments.
- Which purposes New York A10808 ultimately permits for license-plate data, since that defines the bill's effect.
- What Virginia's statewide AI-cyber plan contains once the Secretary of Public Safety and Security drafts it.

## Decision card

- **Useful for:** Tracking state-by-state digital-safety compliance for apps, utilities and government data; Preparing for a patchwork rather than a national standard in the near term
- **Not for:** Treating a committee referral as an enacted law; Assuming a unanimous Senate vote guarantees House passage
- **Compare against:** SB1368's progress in the Pennsylvania House committee; Virginia's published statewide AI-cyber plan

## Provenance ledger

| Manifest id | Title | Source | Claims used | Published |
|---|---|---|---|---|
| `1792792218917464313` | SB1368: An Act prohibiting nudification applications from being offered on online application marketplaces; and prescribing penalties. | [state-legislature-pa-bill-history](https://palegis.us/legislation/bills/2025/sb1368) | 1792792861167853193, 1792792861176767729, 1792792861174846823, 1792792861172122626, 1792792861183921385 | 10-23 00:00 |
| `1792783601281342963` | S10724: Establishes the "rural water utility modernization and security act" | [state-legislature-ny-open-legislation](https://nysenate.gov/legislation/bills/2025/S10724) | 1792784203860488535, 1792784203862751443, 1792784203858373373, 1792784203864712321, 1792784203866590814 | 10-23 00:00 |
| `1792787804310374074` | Governor Spanberger Orders Creation of Statewide Plan to Strengthen Cybersecurity, Prevent & Respond to AI-Related Cyberattacks | [state-legislature-va-governor-newsroom](https://governor.virginia.gov/newsroom/news-releases/2026/october-releases/name-1127607-en.html) | 1792788149428073782, 1792788149431877154, 1792788149432169498, 1792788149435165314, 1792788149436085693, 1792788149438688212, 1792788149439981555, 1792788149433686129 | 10-23 00:00 |
| `1792783601281687320` | A10808: Relates to automatic license plate reader systems | [state-legislature-ny-open-legislation](https://nysenate.gov/legislation/bills/2025/A10808) | 1792784164909496222, 1792784164906989414, 1792784164912205442, 1792784164910492713 | 10-23 00:00 |

## Run these Manifests yourself

Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.

1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; 3 of them are starter Beacons.
2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief.
3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them.

Cited Manifest ids:

- `1792792218917464313`
- `1792783601281342963`
- `1792787804310374074`
- `1792783601281687320`

```sh
for id in 1792792218917464313 1792783601281342963 1792787804310374074 1792783601281687320; do
  curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id"
done
```

> **From Synorb** — Run the cited Manifests yourself. Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; 3 of them are starter Beacons. [Get a key](https://synorb.com/connect/start)

## Related stories

- [States fund the basics: $620M for Massachusetts health coverage, $205M for Wyoming rural health](https://hangingcontext.com/stories/2026-10-24/states-fund-basics-health-housing/)
- [States Keep Outbidding Each Other for Factories — and the Bids Are Getting Creative](https://hangingcontext.com/stories/2026-10-23/state-factory-auction/)
- [Two Gun Bills Reach Hochul's Desk as Albany Grinds Through the Long Tail](https://hangingcontext.com/stories/2026-10-22/new-york-legislature-october/)
- [Pennsylvania Funds Its Water, Plugs Its Past, and Montana Counts Its Trees](https://hangingcontext.com/stories/2026-10-22/natural-resource-ledger/)

## Links

- HTML: https://hangingcontext.com/stories/2026-10-24/states-write-digital-safety-rules/
- JSON: https://hangingcontext.com/stories/2026-10-24/states-write-digital-safety-rules/index.json
- Markdown: https://hangingcontext.com/stories/2026-10-24/states-write-digital-safety-rules/index.md

Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.

---
Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-10-24/states-write-digital-safety-rules/. Terms: https://hangingcontext.com/terms/reuse/