Key Points

• State AGs are independently filling federal enforcement gaps in 2026, with bipartisan multistate coalitions targeting AI, consumer financial services, health care, privacy, and marketing and advertising.  
• The United States v. Heppner ruling (S.D.N.Y. 2026) held that exchanges with a publicly available generative AI platform are not protected by the attorney-client privilege or the work product doctrine.  
• State AGs are bringing independent Clayton Act challenges to block health care mergers, and federal clearance by DOJ and the FCC no longer guarantees deal certainty.  
• Twenty states now have comprehensive consumer privacy laws in effect, with California, Colorado, Connecticut, Maryland, and Minnesota tightening data minimization, profiling opt-out, and AI-training disclosure requirements in 2026.  
• AGs are enforcing AI governance through existing legal frameworks — including UDAP statutes, professional licensing laws, and consumer protection acts — without waiting for AI-specific legislation.

---

The 2026 attorney general (AG) primary season has largely come to a close, and while the November general elections will ultimately determine the partisan composition of several key offices, the enforcement agenda is already well underway. State AGs have been active across a broad range of industries and issue areas in the first half of 2026 – and the activity shows no signs of slowing. From artificial intelligence (AI) and consumer financial services to privacy, marketing, and advertising, state AGs are filling enforcement gaps left by reduced federal activity and staking out independent regulatory ground. The following is an overview of the key areas where companies should expect continued and intensified state AG scrutiny through the remainder of the year, beginning with an update on the races that will shape the enforcement landscape heading into 2027.

Election Update

2026 State AG Primaries: The Races That Will Define Enforcement

Of the 30 state AG primary races on the calendar this cycle, plus the District of Columbia, the vast majority have now been resolved, many through uncontested primaries, party conventions, or noncompetitive incumbent contests. Incumbents in Arkansas, California, Illinois, Iowa, Maryland, Nebraska, New Mexico, New York, and the District of Columbia have each secured their path to November without meaningful primary opposition.

Three states advanced to runoff elections, all of which have now concluded. In Alabama, Katherine Robertson secured the Republican nomination after a competitive and expensive intraparty contest, defeating former Alabama Supreme Court Justice Jay Mitchell in a race that burned through more than $8 million in combined spending, and will face Democrat Jeff McLaughlin in November in reliably Republican territory. In South Carolina, David Stumbo closed a competitive Republican runoff against state Sen. Stephen Goldfinch to position himself as the strong favorite in the general election, where he will face Democratic nominee Richard Hricik. In Texas, Republican Mayes Middleton defeated U.S. Rep. Chip Roy in a contested runoff for the open seat vacated by Ken Paxton; Middleton will face Democratic state Sen. Nathan Johnson in November in structurally safe Republican territory.

The primary map is now fully drawn, and the races that remain are among the most uncertain, with outcomes that will carry consequences well beyond their individual state borders.

Michigan is an open seat with Democrat Eli Savit facing Republican Doug Lloyd, both chosen through party endorsement conventions rather than contested primaries, in a contest that represents a potential inflection point for the progressive enforcement coalition that AG Dana Nessel helped anchor over the past two terms. A party flip in Michigan would change the state’s enforcement posture and meaningfully alter the composition and reach of coordinated multistate efforts.

Arizona’s primary uncertainty has now resolved. Incumbent Democrat Kris Mayes, who won her 2022 race by fewer than 280 votes after a statewide recount, will face Arizona Senate President Warren Petersen, who defeated Rodney Glassman 56% to 44% in a bruising Republican primary. Mayes ran unopposed on the Democratic side. Arizona’s AG office has emerged as a focal point for nationally significant litigation in election law, immigration enforcement, and federal-state legal conflict, and the general election matchup is rated a tossup.

Kansas Republican incumbent Kris Kobach faces Democrat Chris Mann, the party’s 2022 nominee, in a race that, while set in reliably Republican territory, has shown enough statewide competitiveness to remain in play.

Wisconsin merits inclusion alongside the top tier. Incumbent Democrat Josh Kaul, who won re-election in 2022 with just 50.6% of the vote, faces a rematch against Fond du Lac County District Attorney Eric Toney in another swing-state contest.

AG Races, Enforcement Implications, and the Road to 2027

With the primary map largely drawn, Michigan, Arizona, Kansas, and Wisconsin are the races to watch. Each presents a distinct enforcement profile that could meaningfully shift the partisan composition of state AG offices, the depth of the bench available for coordinated multistate enforcement actions, and the institutional appetite for investigations across sectors including financial services, health care, energy, and consumer-facing industries. The outcomes of these four contests will define the enforcement landscape heading into 2027.

Artificial Intelligence

State Legislatures Move First as Federal Action Stalls: The AI regulatory landscape and state AG scrutiny of AI development and deployment have continued to shift in 2026, particularly as state legislatures have enacted AI governance legislation in the wake of federal inaction. On January 1, California’s Transparency in Frontier AI Act took effect, requiring developers of the most powerful AI models to establish and publish AI frameworks addressing internal governance for risk mitigation, cybersecurity, and catastrophic risk thresholds, as well as transparency reports covering risk assessments and intended model use. Both New York and Illinois followed suit by passing frontier AI laws with similar requirements that will take effect January 1, 2027. While the New York law grants enforcement authority to the New York Department of Financial Services, enforcement under the California and Illinois laws rests with those states’ AGs — expect increased action from both offices in the months ahead.

Federal Preemption Efforts Draw Bipartisan AG Opposition: In June, a bipartisan coalition of Congressional House members introduced the “Great American AI Act of 2026.” This federal legislation contains requirements in line with the California and New York frontier laws but would preempt enforcement of such state laws for three years and, while it grants some enforcement powers to state AGs, it would allow the U.S. AG to have final say on a particular matter. This bill will likely garner AG opposition in the months ahead, consistent with the bipartisan resistance to federal preemption in the AI space that has already emerged this year.

AGs Signal Intent to Enforce AI-Agnostic State Laws: In January, a bipartisan coalition of more than 20 state AGs opposed action by the Federal Communications Commission (FCC) to preempt enforcement of state and local laws relating to AI. The comments submitted to the FCC identified several uses of AI regulated by specific state laws — such as consumer protection and privacy laws — and made clear that AGs will scrutinize AI use under those laws. These comments align with recent state AG settlements and warnings signaling that AGs will enforce AI-agnostic state laws related to AI development and deployment.

AGs Embrace AI as an Enforcement Tool: In May, a bipartisan coalition of seven state AGs reached a settlement with the Chinese-owned messaging and payment platform WeChat, under which the company committed to take steps to combat the use of its platform in fentanyl-related money laundering. The agreement focuses on improving law enforcement cooperation, preserving and producing user data in response to law enforcement requests, and proactively detecting illicit activity on the service. Particularly notable is that the AGs required WeChat to deploy AI tools to detect and report content associated with money laundering and drug trafficking — a signal that AGs are willing to embrace the potential benefits of AI, not only monitor its risks.

AI Communications and Privilege — A Ruling to Watch: In an evidentiary ruling of first impression in February, the U.S. District Court for the Southern District of New York in United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y.) held that exchanges between a defendant and a publicly available generative AI platform in connection with pending litigation are not protected by the attorney-client privilege or the work product doctrine. Applying traditional principles, the court reasoned that the communications did not involve an attorney-client relationship, were not confidential, were not made for the purpose of obtaining legal advice, and did not reflect an attorney’s trial strategy. The ruling will likely impact whether legal protections are afforded to AI communications, prompts, and output in both litigation and regulatory inquiries, including state AG investigations.

Consumer Financial Services

States have increased their efforts to regulate the financial services industry throughout 2026 — through new state laws, regulatory guidance, and heightened enforcement activity — and that trend is expected to continue through year-end. These efforts are at least partially motivated by the reduction in federal enforcement activity, and companies should expect states to remain active and aggressive in filling that void.

Federal-State Tensions: Preemption Battles Take Center Stage: The federal-state misalignment on consumer protection has produced direct conflict over regulatory authority. In June, a federal district court found that the Illinois Interchange Fee Prohibition Act (IFPA) — a statute the Illinois AG has been actively defending in litigation against industry trade groups — is preempted in part by federal law. The court issued its decision shortly after the Office of the Comptroller of the Currency issued an interim final rule affirming that federal law allows national banks to charge interchange fees and specifically stating that federal law preempts the IFPA. Similarly, the Federal Deposit Insurance Corporation has directly intervened in litigation between the Colorado AG and industry trade groups over Colorado’s attempt to apply its own interest rate caps to loans made to Colorado borrowers by out-of-state, state-chartered banks. These federal-state tensions are likely to continue playing out in the courts in the months ahead.

Fair Lending: States Step In as Federal Landscape Shifts: States are continuing to prioritize fair lending issues, particularly as the federal government moves to significantly alter the fair lending regulatory landscape. In response to the Consumer Financial Protection Bureau’s (CFPB) issuance of a revised Regulation B removing disparate impact liability from the Equal Credit Opportunity Act, the New York Department of Financial Services issued an industry letter reminding supervised entities that credit decisions with a disparate impact on protected classes can constitute unlawful discrimination under New York state law. In February, the D.C. AG filed a fair lending lawsuit against a real estate lending and investment firm, and Connecticut’s AG released a memorandum confirming that the office intends to enforce existing consumer protection laws against entities whose misuse of algorithms results in discrimination and bias.

Pricing and Fees: New York Leads the Charge: New York officials have made clear that pricing transparency and fee enforcement remain top regulatory priorities. In January, the New York City Mayor, joined by the New York AG, signed two executive orders intended to increase investigation and enforcement of practices involving misleading or undisclosed fees and illegal subscriptions. In June, the New York legislature passed the One Fair Price Act — legislation championed by the New York AG — which would prohibit surveillance pricing and authorize the AG to pursue it as an unfair and deceptive practice. The bill now heads to the governor for signature.

Cryptocurrency: State Enforcement of Virtual Currency Kiosks Accelerates: States are consistently initiating enforcement actions against operators of virtual currency kiosks to enforce state licensing and consumer protection requirements. In January and February, the California Department of Financial Protection and Innovation entered into consent orders with several bitcoin ATM operators after finding violations of California’s Digital Financial Assets Law and the California Consumer Financial Protection Law. In February, the Texas Banking Commissioner issued a consent order against a fintech operating virtual currency kiosks, finding that it conducted unlicensed money transmission by selling stablecoins in violation of the Texas Finance Code. In May, the Missouri AG filed a lawsuit against a cryptocurrency ATM operator alleging violations of Missouri’s Merchandising Practices Act.

The actions described above confirm that states intend to remain active in the consumer financial services space through the remainder of 2026 and beyond. Financial services companies should continually assess their policies, procedures, and practices to ensure compliance with both federal and state law.

Health Care

State attorneys general have emerged as arguably the most assertive regulators of the health care industry in 2026, and the activity shows no signs of slowing through year-end. States are filling perceived gaps left by federal retrenchment across antitrust review, 340B drug access, and AI oversight; private equity involvement in health care is drawing legislative and enforcement attention at an unprecedented scale; and existing legal frameworks, from consumer protection statutes to medical licensing acts, are being deployed against novel business models and technologies without waiting for sector-specific legislation. Coordinated multistate action is amplifying the impact of individual AG offices, and the November elections will shape the enforcement bench heading into 2027. For health care companies, the message is clear: compliance strategies must account for an increasingly assertive and well-resourced state enforcement apparatus operating across every major sector of the industry.

States Continue to Target PBMs Through Regulation and Enforcement: States are driving an accelerating wave of regulation and enforcement targeting pharmacy benefit managers (PBMs), reflecting deepening concerns over drug affordability, transparency, and vertical integration. States including Arkansas, California, Illinois, and Tennessee have enacted laws that ban spread pricing, impose fiduciary duties on PBMs, mandate full rebate pass-throughs, restrict steering to affiliated pharmacies, and, in Tennessee’s case, require outright divestiture of co-owned pharmacy and PBM/insurer operations by 2028.

The PBM industry has challenged these laws in federal courts, including the Eighth Circuit, which held that an Arkansas law imposing “Geographic Coverage Requirements” on in-network pharmacies was preempted by ERISA. As states continue to pursue PBM regulation, pushback from industry is expected to continue. Courts will ultimately determine which new state PBM-related provisions are preempted by federal law.

State AGs have also initiated enforcement actions against PBMs. For example, on June 23, 2026, the Florida AG announced a civil investigative demand (CID) targeting a PBM and its retail pharmacies. The investigation focuses on whether the company “steers patients to its own locations, reimburses its affiliated stores more generously than independent pharmacies for identical prescriptions, imposes burdensome audits that claw back payments, and enforces restrictive contracts that threaten small businesses.”

These PBM-focused legislative and state AG actions signal continued scrutiny of PBMs across the state regulatory and enforcement landscape.

Antitrust: States Fill the Federal Gap: As the federal government has scaled back antitrust enforcement, state AGs have continued to move to fill the gap. State AG offices have secured budget increases, hired former-Department of Justice (DOJ) and former-Federal Trade Commission (FTC) staff, retained outside counsel for complex cases, and formed bipartisan multistate coalitions.

The Nexstar-Tegna merger has emerged as a key playbook for state AG antitrust enforcement in 2026. In March 2026, eight state AGs filed suit to block Nexstar Media Group’s $6.2 billion acquisition of Tegna hours after both the DOJ and FCC cleared the transaction, securing a preliminary injunction that halted integration of the already-closed deal.

For health care companies, the takeaway is clear: federal merger clearance no longer guarantees deal certainty. State AGs are independently bringing Clayton Act challenges, seeking injunctive relief and building multistate coalitions to block transactions.

State legislatures are also expanding AG authority to review, approve, or block health care transactions. Earlier frameworks required only pre-closing notice, but recent laws grant AGs substantive approval authority. The most recent legislative wave focused on private equity involvement in health care. California’s AB 1415, effective January 1, 2026, expanded the state’s health care transaction notification regime to require private equity firms and management services organizations (MSOs) to seek approval from the Office of Health Care Affordability (OHCA) for certain transactions. The Washington governor signed HB 2548 into law on March 25, 2026, broadening that state’s health care transaction review framework. Illinois has proposed legislation (SB 1998) that would require prior written consent from the AG for health care transactions receiving private equity or hedge fund financing.

340B Drug Access Under Threat: States have continued a pattern of using both legislation and enforcement to ensure covered entities’ access to discounted drugs under Section 340B. However, recent developments suggest that the DOJ may undercut those state efforts.

In February 2026, DOJ filed amicus briefs in the First and Tenth Circuits arguing that Rhode Island’s and Colorado’s 340B contract pharmacy protection laws are preempted. These state laws prohibit manufacturers from restricting delivery of 340B drugs to contract pharmacies. While the Fifth and Eighth Circuits have upheld similar statutes, DOJ’s position aligns with the manufacturer-friendly rulings from the D.C. and Third Circuits. This creates significant uncertainty for states with enforcement regimes protecting 340B access. A circuit split resolution could either reinforce or curtail state authority.

The First Circuit heard oral argument on June 3, 2026; no decision has been entered. In the Tenth Circuit, the lower court granted the state’s motion to dismiss on June 10, 2026, rendering the appeal moot. Plaintiffs filed a new appeal on June 24.

The stakes for covered entities are significant: the 340B program serves approximately 50 million patients annually through more than 50,000 contract pharmacy arrangements. If the Supreme Court ultimately sides with DOJ’s preemption theory, states that have enacted 340B protection laws — now numbering more than 30 — would lose their primary enforcement tool for ensuring patient access to discounted medications at contract pharmacies.

State AG False Claims Act Enforcement: False Claims Act (FCA) cases remained a priority for state AGs and Medicaid Fraud Control Units (MFCUs) during H1 2026.

State MFCUs continue to target traditional Medicaid billing fraud. On June 29, 2026, New York AG Letitia James announced the arrest of Nduka Lewis Ekpenyong in connection with an alleged $2.5 million scheme submitting false claims for medical supplies never purchased. In March 2026, Vermont AG Charity Clark announced a $483,464 settlement with United Counseling Service, resolving allegations that it billed Vermont Medicaid for services while failing to meet applicable standards of care.

Coordinated state-federal enforcement in this area expanded. In March 2026, eight states and the federal government announced a $4 million settlement with CVR Management, LLC, resolving allegations that CVR billed Medicare, Medicaid, and TRICARE for medically unnecessary vein procedures. DOJ’s “2026 National Health Care Fraud Takedown,” announced on June 23, 2026, charged 455 defendants across 56 federal districts in 45 states in connection with schemes involving more than $6.5 billion in false claims. The initiative included international cooperation, reflecting DOJ’s view that health care fraud is a cross-border concern.

In a notable parallel development, the California AG announced on June 26, 2026, a $4.5 million settlement with Carbon Health Technologies, Inc. and its co-founder, resolving allegations that the company violated California’s prohibition on the corporate practice of medicine (CPOM), engaged in false advertising, and improperly billed patients and insurers. The settlement requires Carbon Health to restructure its corporate model to ensure physicians retain independent control over medical decisions — a first-of-its-kind resolution that signals heightened AG enforcement of corporate practice doctrines against technology-enabled health care platforms operating MSO-physician corporation structures. This example also reinforces the 2026 reality that CPOM-related enforcement is not simply a state licensing board matter, but rather an enforcement priority for the state AG offices utilizing both state CPOM and traditional consumer protection laws.

ACA Marketplace Integrity: State AG ACA Marketplace fraud enforcement has been relatively limited in H1 2026, with federal agencies leading notable actions. However, AGs remain engaged on access and integrity.

On March 13, 2026, 19 state AGs submitted a comment letter urging HHS to withdraw a proposed ACA Marketplace payment rule. Shortly before 450,000 New Yorkers would lose eligibility for the Essential Plan on July 1, 2026, AG James issued public guidance warning consumers to watch for unauthorized enrollment scams.

These actions show AG offices positioning themselves on ACA Marketplace issues through regulatory advocacy and consumer warnings. As the federal government considers further changes to ACA enrollment and eligibility rules, state AGs are likely to continue leveraging comment letters, consumer advisories, and investigative authority to protect marketplace access — particularly for vulnerable populations facing coverage transitions.

Artificial Intelligence in Health care: No publicized AG enforcement actions have directly targeted health care AI in 2026, but state legislators continued to pass bills granting AGs enforcement authority over health care AI practices.

AGs can also act without new AI-specific legislation using state UDAP statutes and professional licensing authority. Pennsylvania’s Department of State brought a first-of-its-kind action against Character.AI, alleging that its chatbots held themselves out as licensed medical professionals and engaged in unlicensed practice of medicine. Filed on May 1, 2026, the complaint describes a chatbot named “Emilie” that claimed to be a licensed psychiatrist, stated it attended medical school at Imperial College London, practiced for seven years, was licensed in Pennsylvania, and provided a fabricated Pennsylvania license number — all while offering to conduct mental health assessments and prescribe medication. The platform had logged approximately 45,500 user interactions with that single chatbot character. This case is significant because it approaches AI regulation not through new AI-specific legislation, but through existing state professional licensing frameworks under the Medical Practice Act, an avenue available to regulators in virtually every state.

Pennsylvania’s action is not isolated. On June 1, 2026, the Florida AG filed a lawsuit against OpenAI, alleging that the company violated consumer protection laws by promoting ChatGPT in a way that led users to believe it could diagnose medical conditions. And on February 25, 2026, the Connecticut AG issued formal guidance confirming that existing state laws — including anti-discrimination and consumer protection statutes — apply directly to AI systems, mirroring a similar advisory issued by the Massachusetts AG in 2025. In November 2025, a bipartisan coalition of 36 state AGs signed a letter opposing any federal legislation that would preempt state AI enforcement authority.

Colorado signed HB26-1139 on June 2, 2026 (effective January 1, 2027), prohibiting health insurers, PBMs, and utilization review organizations from basing coverage determinations solely on AI-generated group data. It requires clinician review of any medical necessity denial, with enforcement vested in the Colorado AG.

Effective July 1, 2026, Tennessee’s SB 1580 prohibits AI developers from advertising that systems can act as licensed mental health professionals. Violations constitute deceptive practices under the Tennessee Consumer Protection Act.

Companies developing or deploying health care AI or other AI systems to be implemented in health care company operations should closely monitor these rapidly evolving developments.

Marketing and Advertising

The remainder of 2026 will bring continued and expanding regulatory pressure across four interconnected fronts: junk fees, algorithmic pricing, subscription practices, and deceptive advertising. Activity at both the state and federal levels signals that pricing transparency is no longer a peripheral compliance concern — it is now a central enforcement priority for regulators nationwide.

Junk Fees: Pricing and subscription reform continues to draw bipartisan consensus, with new laws taking hold across the U.S. Illinois (effective July 2027) enacted junk fee legislation targeting all businesses, and Louisiana (effective January 2027) recently enacted a “Click to Cancel” Act that requires businesses to clearly and conspicuously present all offer terms and provide consumers with a simple mechanism to cancel subscriptions and recurring charges.

State AGs have matched this legislative momentum with targeted enforcement. Key actions so far this year include: In January 2026, the Texas AG reached a settlement with Hyatt reinforcing pricing transparency commitments in the hospitality industry. In April, the District of Columbia AG announced that Live Nation would pay $9.9 million for alleged deceptive ticket pricing practices. That same month, a coalition of state AGs backed the FTC’s proposed rule on rental junk fees. In May, the Washington AG settled with a cleaning service company over junk fee allegations.

Algorithmic Pricing: State AGs are also focusing on algorithmic pricing, which encompasses dynamic pricing and surveillance pricing. What first began with an initial call for algorithmic transparency — as seen by New York’s Algorithmic Pricing Disclosure Act (effective November 2025) — has grown into a wider effort to restrict these pricing methods entirely — as seen by new legislation in Maryland (effective October 2026); Connecticut (effective July 2027); New York (pending the governor’s signature); and New Jersey (pending the governor’s signature). Where legislatures have yet to act, AGs are not waiting. For example, in January 2026, the California AG announced an investigation into surveillance pricing, utilizing a consumer privacy act. In January 2026, the New York AG announced an investigation into Instacart about its use of algorithmic pricing and price-setting experiments.

FTC: On the federal front, similar trends are emerging from the FTC, with a particular focus on subscription and negative option practices, junk fees, and deceptive advertising. Federal enforcement activity does not exist in a vacuum — state AGs have long monitored federal regulatory priorities, using them as both a legal roadmap and a political mandate for their own enforcement agendas. In March, the FTC revived negative option rulemaking, a significant development signaling renewed regulatory attention to subscription-based business models and automatic renewal practices.

The FTC has remained active in its enforcement actions in 2026. In January, the FTC sued JustAnswer over allegedly deceptive subscription practices, and that same month sent letters to other companies to flag their potential online review practices. A few months later, in April, the FTC settled with StubHub, resolving allegations that StubHub advertised ticket prices without including mandatory fees and failed to disclose the full total price wherever prices were displayed. Additionally, the settlement required $10 million in “junk fee” refunds to U.S. customers who purchased live-event tickets during select days in 2025. In May, the FTC settled with Shutterstock for $35 million over alleged illegal subscription and cancellation practices. These actions underscore the FTC’s broader commitment to combating what it perceives as hidden fees and misleading subscription practices.

Privacy + Cyber

The remainder of 2026 will continue the trend of increasing regulatory scrutiny regarding privacy, security, and AI. State legislatures, AGs, and other state regulators are adopting a more sophisticated whole-of-government approach — not only toward technology companies and innovations, but also concerning how industries apply new technologies, particularly where there is potential consumer harm or impact on children and vulnerable populations.

State Consumer Privacy Laws: A Patchwork That Demands Jurisdiction-Specific Compliance: Twenty states now have comprehensive consumer privacy laws in effect. Indiana, Kentucky, and Rhode Island joined the roster on January 1, 2026, each introducing data protection impact assessment obligations, sensitivity-based restrictions, and expanded notice requirements. California, Connecticut, Colorado, Maryland, and Minnesota have also raised the compliance bar — tightening data minimization standards, expanding profiling opt-out rights, mandating independent cybersecurity audits, and requiring privacy notices to disclose whether personal data is used to train large language models. Virginia added a precision geolocation sales ban effective July 1, 2026. For companies operating nationally, a patchwork of materially different obligations now requires jurisdiction-specific analysis rather than a single unified policy.

Enforcement Has Teeth: This privacy legislation is being actively enforced. New Jersey recently issued a number of cure letters — obtained through public records requests by Troutman Pepper Locke — showing that regulators are scrutinizing the accuracy of privacy notices, the design of appeal processes, and opt-out functionality. These efforts go far beyond superficial disclosure compliance and examine how a company actually collects, processes, and shares consumer data.

Automated Decision-Making: Risk Frameworks Now Required: States are increasingly requiring companies to assess consumer risks and provide transparency before deploying automated decision-making technology. California and Colorado expressly mandate risk management frameworks before deploying AI tools that make or inform decisions with legal or similarly significant effects — frameworks that typically require maintaining inventories of AI systems with documented risk classifications, meaningful consumer disclosures, and, in some cases, opt-out rights regarding automated processing. State AGs are also leveraging existing consumer protection statutes to investigate and sue technology platforms, including AI chatbots, and most AGs oppose federal legislation that would preempt state-level enforcement authority, reflecting their intent to remain the primary enforcers of the industrial use of AI.

Children’s Privacy: Heightened Scrutiny at Every Level of Government: The updated COPPA rule, which took effect on April 22, 2026, imposes stricter parental consent requirements, data retention limits, and Safe Harbor transparency requirements. State AGs are actively pursuing children’s data enforcement, as illustrated by the Michigan AG’s COPPA suit against Roku. Alabama’s new App Store Accountability Act and bipartisan AG opposition to the federal KIDS Act further signal that child-directed services face heightened scrutiny at every level of government through year-end and beyond.

Looking Ahead

One thing has become clear in 2026: state AGs are not standing still. Whether driven by the reduction in federal enforcement activity, evolving legislative mandates, or their own independent enforcement priorities, state AGs across the U.S. are expanding their reach and sharpening their focus across virtually every sector of the economy. The November general elections will bring additional clarity to the enforcement landscape heading into 2027, but companies should not wait for those results to act. Businesses operating across these areas should be proactively assessing their compliance programs, monitoring state-level legislative and enforcement developments, and engaging experienced counsel to navigate an environment that is only growing more complex.

For questions about state AG enforcement activity or its implications for your business, contact Troutman Pepper Locke’s State Attorneys General Practice.