created 24 August 2026 · last modified 24 August 2026
advocacy / law and policy map
What Already Exists.
Existing laws are advocacy anchors, not destinations. Each entry maps what the law protects, what substrate reform would add, and how advocates can use it as a hook.
41+ laws across five jurisdictional levels. The gaps field is the reform surface.
Jurisdictional level
DistrictCode
LAUSD Privacy Policy
LAUSD Student Data Privacy Policy (Board Resolution)
Los Angeles Unified School District · 2022
Establishes data governance requirements for EdTech vendors serving LAUSD students. Requires privacy impact assessments for new vendor contracts. Limits data use to educational purposes. Creates a student data privacy officer position.
Substrate relevance
The most comprehensive district-level student data governance framework in the U.S. The privacy impact assessment requirement is a substrate health check for EdTech deployment. The 'educational purpose' limitation is a substrate use constraint — vendor data rights are bounded by the purpose that justified the data relationship.
Use as anchor
LAUSD's scale (640,000 students) creates market pressure on vendors to comply. The template has influenced other large district policies. The privacy officer position creates an institutional contact point for advocacy.
The gap
Policy covers LAUSD vendors but not platforms students use personally. Enforcement is internal — no external audit requirement. The 'educational purpose' limitation is contested by vendors who claim broad data use rights under existing FERPA exceptions.
DistrictCode
SFUSD Phone-Free
San Francisco USD — Phone-Free School Policy
San Francisco Unified School District · 2024
Requires students to store phones in Yondr pouches or school-provided storage during the school day, including during lunch and passing periods. Provides exceptions for documented medical needs. Treats the school day as a protected substrate for focused attention and social development.
Substrate relevance
Phone-free school policies are substrate provisioning: they create conditions where attention substrate can form without constant extraction. The Yondr pouch mechanism is an architectural control that makes the policy legible and enforceable rather than aspirational.
Use as anchor
Model for phone-free policies in other large urban districts. California state law (AB 272, 2019) already authorizes phone-free policies; SFUSD's implementation is a template that removes legal uncertainty for other districts.
The gap
Equity concerns: Yondr pouches cost money and create disparate treatment for students who cannot afford replacements. Implementation quality varies across schools. Does not address device use outside school hours.
DistrictCode
LEA Wellness Policy
Local Education Agency Wellness Policy (Required under ESSA Section 4108)
United States (required of all LEAs receiving federal funds) · 2004 (reauthorized 2010, 2015)
Requires every local education agency (school district) receiving federal food and nutrition program funds to adopt a local wellness policy. Policy must include goals for nutrition education, physical activity, and other school-based activities that promote student wellness.
Substrate relevance
Wellness policies are the only federally mandated substrate governance documents at the district level. They establish a legal obligation to maintain the physical and social conditions in which learning is possible — the substrate beneath academic outcomes.
Use as anchor
Every district in the country has one. They are often weak and unenforced — which creates an advocacy entry point: demand implementation of the policy that already exists. USDA's HUSSC (Healthier US Schools Challenge) provides a public scoring mechanism that can be used to name districts in violation.
The gap
No binding enforcement mechanism for wellness policy content or implementation. Policies often consist of boilerplate language with no monitoring, evaluation, or community engagement. The federal mandate does not extend to mental health, screen time, or social-emotional conditions.
DistrictCode
Water District Conservation Rules
Local Water District Conservation and Water Quality Ordinances
Various (California, Texas, Colorado, other arid-state districts) · Varies by district (1970s–present)
Local water districts set water use restrictions, conservation tiered-rate pricing, water quality monitoring requirements, and land use restrictions near water supply infrastructure. In the western U.S., acequia associations function as district-level governance bodies with legal authority over water allocation.
Substrate relevance
Water district governance is the most direct analog to substrate governance in the physical world. Acequia water law — prior appropriation with community management — is the historical precedent for commons-based substrate protection: use rights, not ownership rights; communal monitoring; proportional allocation.
Use as anchor
Acequia associations in New Mexico have explicit legal standing under state law. California urban water districts are subject to State Water Board oversight with active enforcement. Conservation tiered pricing creates a substrate health incentive structure — use less, pay proportionally less.
The gap
Agricultural water use (the largest sector) is exempt from most conservation mandates. Groundwater governance is weaker than surface water governance in most states. Climate-driven stress is outpacing the governance capacity of districts designed for historical flow conditions.
CityCode
NYC Student Data Privacy
New York City Student Data Privacy Consortium Agreement
New York City · 2020
NYC DOE requires EdTech vendors to sign a Student Data Privacy Consortium (SDPC) agreement governing data collection, use, storage, and deletion. Vendors must certify compliance before accessing student data. Data use is restricted to the educational service contracted.
Substrate relevance
The SDPC agreement is a substrate contract — it defines the terms under which the educational data substrate flows to vendors. The certification requirement creates a vendor accountability checkpoint before data access. NYC's scale (1.1M students) effectively sets market standards.
Use as anchor
NYC's vendor agreement template is publicly available and has been adopted by hundreds of districts nationally through the SDPC network. The 'educational service' restriction is a substrate purpose limitation that advocates can enforce contractually when vendors deviate.
The gap
Contract-based governance depends on vendor compliance and district enforcement capacity — both variable. The SDPC agreement does not cover algorithmic decision-making using student data, only data transfer and storage.
CityStatute
NYC LL 144
New York City Local Law 144 — Automated Employment Decision Tools
New York City · 2021
Requires employers to conduct independent bias audits of automated employment decision tools (AEDTs) before use in NYC. Requires publication of audit summaries. Requires notice to candidates when an AEDT is used in hiring or promotion decisions. Imposes penalties for non-compliance.
Substrate relevance
Employment decisions are substrate-determinative: algorithmic hiring tools shape who enters the economic mainstream and who is excluded. NYC LL 144 is the first mandatory algorithmic audit law in the U.S. The bias audit requirement is a substrate health check — it mandates external review of what the tool is doing before deployment.
Use as anchor
The mandatory external audit requirement creates a public transparency mechanism — published audit summaries are public records. NYC's labor market reach effectively sets national standards for employers who recruit in the city. The audit requirement creates a demand for an independent audit profession.
The gap
Compliance has been low in the first years of enforcement. Auditing standards are weak — bias audits do not require disclosure of the model itself, only summary statistics. The notice requirement is often buried in application materials.
CityResolution
SF Surveillance Ordinance
San Francisco Ordinance — Surveillance Technology Policy
San Francisco · 2019
Requires the SFPD to seek Board of Supervisors approval before acquiring new surveillance technology, including facial recognition. Requires annual reporting on surveillance technology use and impact. Established a policy framework for democratic deliberation over surveillance decisions.
Substrate relevance
The first major U.S. municipal policy to treat surveillance technology as a governance matter requiring democratic approval rather than a police operations decision. The council approval requirement is a substrate control primitive — the public has a voice in what surveillance substrate operates in public space.
Use as anchor
The template has been adopted in 18+ cities nationally. Oakland, Berkeley, and other Bay Area cities adopted similar ordinances within two years. ACLU has documented and supported the model ordinance approach nationally.
The gap
Modified in 2023 to allow police to use third-party camera networks in emergencies, creating a significant carve-out. The approval process applies to acquisition, not ongoing use — systems approved once are not subject to periodic reauthorization.
CityResolution
LA Alg. Accountability (Proposed)
Los Angeles Proposed Algorithmic Accountability Ordinance (Draft, not yet enacted)
Los Angeles · Proposed 2023–2024; not yet enacted
Proposed ordinance would require city agencies to conduct impact assessments before deploying automated decision systems, maintain a public registry of algorithmic tools in use, and provide appeal rights for individuals affected by automated government decisions. Modeled on NYC and Seattle frameworks.
Substrate relevance
Would extend substrate governance to the second-largest U.S. city's government operations. The public registry is a substrate transparency primitive — citizens can see what algorithmic systems are making decisions about them. The appeal right is a substrate due process mechanism.
Use as anchor
LA's scale (4M residents) and diverse population would create significant pressure for implementation quality. Several council members have championed the ordinance. ACLU of Southern California and labor unions have expressed support.
The gap
Has not yet been enacted as of 2026. Enforcement capacity is the key gap — LA has not yet established an independent oversight office for algorithmic accountability. City contractor systems would need to be covered to have real impact.
CityResolution
Seattle Alg. Accountability
Seattle Resolution 31901 — Algorithmic Accountability
Seattle · 2021
Directs the city to develop a framework for reviewing algorithmic decision systems used by city government, including bias impact assessments, public engagement requirements, and a registry of algorithmic tools in use by city agencies.
Substrate relevance
Municipal algorithmic accountability frameworks are substrate governance applied to government itself. The tool registry is a substrate provenance primitive — it requires the government to know what algorithmic systems are running. The bias assessment requirement is a substrate health check for civic infrastructure.
Use as anchor
Municipal tool registries create transparency that advocates can use to identify high-risk systems and request impact assessments. Seattle's framework is a template for other cities. The public engagement requirement creates formal entry points for community groups.
The gap
Resolution only — no binding enforcement mechanism. Implementation has been slow and incomplete. The tool registry is not fully public. Does not cover systems operated by third-party contractors on behalf of the city.
CityCode
County Watershed Protection
County Water Quality and Watershed Protection Ordinances
Various counties (especially CA, OR, WA, CO, NM) · Varies by county (1970s–present)
County-level ordinances establish setback requirements from waterways, restrict impervious surface coverage in watershed areas, regulate stormwater runoff from development, and in some cases create watershed stewardship areas with enhanced protections.
Substrate relevance
County watershed ordinances operate at the scale where land use decisions and water quality interact. They are substrate governance at the physical level: the ordinances define what the watershed substrate can absorb before degrading.
Use as anchor
County ordinances are more responsive to local conditions than state or federal rules. Environmental impact review requirements (California CEQA at the county level) create formal public comment windows. Conservation easements negotiated at the county level can be permanent.
The gap
County authority over water quality is limited by state water law in most western states. Agricultural exemptions from county zoning ordinances reduce watershed protection for the land uses with the largest non-point source pollution contribution.
StateStatute
CCPA/CPRA
California Consumer Privacy Act / California Privacy Rights Act
California · 2018 (CCPA), amended 2020 (CPRA)
Gives California consumers the right to know what personal data businesses collect about them, to delete that data, to opt out of the sale of that data, and to non-discrimination for exercising privacy rights. CPRA expanded rights to include correction and enhanced limits on sensitive data use.
Substrate relevance
CCPA/CPRA is the strongest substrate sovereignty law in the U.S. The right to know, correct, and delete are substrate provenance primitives. The sensitive data category is a substrate layer definition — certain data requires heightened protection because it determines access to protected activities (employment, housing, credit).
Use as anchor
The CCPA template has been adopted in 13+ states. California's global market power means companies that comply with CCPA often extend the same rights nationally. CPRA's sensitive data provisions create explicit hooks for genetic, health, and financial data.
The gap
Employment and B2B data are exempted or limited. Small business thresholds exclude most data brokers by transaction count. The opt-out model (rather than opt-in for sensitive data) is weaker than GDPR consent requirements. CPPA enforcement is new and capacity-limited.
StateStatute
NY SHIELD Act
New York SHIELD Act — Stop Hacks and Improve Electronic Data Security
New York · 2019
Requires businesses that own or license computerized data about New York residents to implement reasonable data security safeguards. Expands the definition of private information and the scope of data breach notification requirements. Requires employee training on cybersecurity.
Substrate relevance
Data security requirements are a substrate integrity mandate — they require the substrate layer to be maintained against corruption. The reasonable safeguards requirement extends security obligations to any entity handling New York resident data, regardless of where the entity is located.
Use as anchor
NY's broad jurisdictional reach (any entity handling NY resident data) means compliance with SHIELD effectively extends to most U.S. businesses. The AG enforcement authority has been exercised and creates real accountability.
The gap
Reasonable safeguards standard is vague — what counts as reasonable is determined after a breach, not before. Does not create a private right of action. Does not address how data is used, only how it is secured.
StateStatute
BIPA
Illinois Biometric Information Privacy Act
Illinois · 2008
Requires informed written consent before collecting biometric data (fingerprints, face geometry, iris scans, voiceprints). Prohibits sale of biometric data. Creates a private right of action with statutory damages of $1,000–$5,000 per violation.
Substrate relevance
Biometric data is the most intimate substrate layer — it governs identity itself. BIPA's private right of action is the most powerful enforcement mechanism of any U.S. privacy law. The consent requirement is a substrate transaction primitive: biometric substrate cannot flow without explicit authorization.
Use as anchor
BIPA has generated over $1 billion in litigation settlements, including against Facebook, Google, and major employers. The private right of action bypasses regulatory enforcement gaps. BIPA has been used against algorithmic hiring tools that use facial geometry analysis.
The gap
Courts have limited the statute of limitations in recent rulings, reducing per-violation damages in multi-year data uses. The legislature has repeatedly attempted to weaken BIPA under business pressure. Does not address use of biometric data collected with consent for purposes beyond the original authorization.
StateStatute
CA AB 272
California AB 272 — Student Cell Phone Use Restrictions
California · 2019
Authorizes school districts to adopt policies limiting or prohibiting student use of cell phones and other electronic devices during the school day. Does not mandate phone-free policies but removes legal barriers for districts that want to implement them.
Substrate relevance
AB 272 is a substrate protection enabler — it gives districts legal authority to create conditions where attention substrate can develop without constant extraction. The permissive structure means implementation depends on local will, which is the advocacy target.
Use as anchor
California subsequently strengthened this with SB 1216 (2024), which mandated that districts adopt phone-free policies. The sequence — permissive 2019, mandatory 2024 — is a legislative model for phased advocacy strategy in other states.
The gap
The 2019 permissive law produced uneven adoption. Mandating phone-free policies without providing implementation resources (storage, training, parent communication) produces inconsistent compliance. Equity concerns about enforcement disparities across school demographics.
StateStatute
CA SB 1216
California SB 1216 — Mandatory Phone-Free School Policies
California · 2024
Requires all California school districts to adopt and enforce a phone-free school policy by July 1, 2026. Policy must limit or prohibit student use of smartphones during the school day, including during lunch and recess. Districts may choose implementation method (Yondr, lockers, classroom storage).
Substrate relevance
First state-level mandate for phone-free school policies in the U.S. Converts a local governance decision into a statewide substrate protection standard. The mandate structure removes the collective action problem: individual districts can no longer opt out for competitive reasons.
Use as anchor
California's mandate creates a political and market template that other states can follow. LAUSD, SFUSD, and other large districts' prior implementation provides evidence that the policy is operationally feasible. Jonathan Haidt's research and the Surgeon General's advisory on youth mental health provide the academic and public health foundation.
The gap
Implementation resources are not funded by the state. Equity concerns remain — districts with fewer resources will implement less effectively. Emergency communication needs for students with medical or safety needs require careful exemption design.
StateStatute
CEQA
California Environmental Quality Act
California · 1970
Requires state and local agencies to assess the environmental impacts of projects they carry out or approve. Environmental impact reports (EIRs) must identify significant adverse impacts and consider mitigation measures or alternatives. Creates public comment and appeal processes.
Substrate relevance
CEQA is California's primary substrate protection statute for physical systems. The EIR requirement mandates that project approvers understand what they are doing to the substrate before approving it. The mitigation hierarchy (avoid, minimize, mitigate) is a substrate preservation sequence.
Use as anchor
CEQA provides legal standing to challenge projects with inadequate environmental review. EIRs are public documents — advocates can review them and identify gaps. The public comment period creates mandatory engagement windows. CEQA has been used to require climate and cumulative impact analysis.
The gap
CEQA exemptions cover many smaller projects and infill housing. The litigation pathway is slow and expensive, which limits access. CEQA has been used against housing development, creating tension between environmental and housing equity advocates.
StateStatute
CA AB 2930
California AB 2930 — Automated Decision Systems (2024)
California · 2024
Requires developers and deployers of consequential automated decision systems to conduct impact assessments, implement governance programs, and provide notice when automated decision systems are used. Creates a right to opt out of automated decisions in certain contexts.
Substrate relevance
One of the first U.S. laws to require impact assessment for AI systems in consequential decisions. The assessment requirement is a substrate health check — deployers must understand what their systems are doing to the substrate before deployment. The opt-out right is a substrate control primitive.
Use as anchor
California's global market reach means AB 2930 compliance requirements will spread nationally. The impact assessment requirement creates a disclosure mechanism: assessments filed with CPPA may be subject to public records requests. The governance program requirement creates institutional accountability hooks.
The gap
A predecessor bill (SB 1047) was vetoed. This law covers deployers in California, not developers, creating a gap. The opt-out right does not extend to contexts where the deployer claims business necessity. Impact assessments may not be publicly available by default.
StateStatute
Colorado AI Act
Colorado Artificial Intelligence Act (SB 24-205)
Colorado · 2024
First comprehensive state AI liability law in the U.S. Requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from algorithmic discrimination. Creates a right to appeal automated decisions and requires disclosure when AI makes consequential decisions.
Substrate relevance
Colorado's 'high-risk' AI definition maps directly onto the substrate protection framework: decisions about housing, credit, employment, education, healthcare, and insurance are substrate-determinative decisions. The 'reasonable care' standard creates a substrate duty of care for AI deployers.
Use as anchor
First-mover state law creates a legislative template for multi-state advocacy. The algorithmic discrimination prohibition is the strongest anti-discrimination hook in any current U.S. AI law. The right to appeal automated decisions is a substrate due process primitive.
The gap
Effective date 2026 with significant implementation uncertainty. Business lobbyists have introduced amendment bills to weaken the law before it takes effect. The 'reasonable care' standard is vague and may be interpreted narrowly by courts or agency guidance.
StateStatute
WA MHMD
Washington My Health My Data Act
Washington · 2023
Extends health data privacy protections beyond HIPAA to cover consumer health data collected by non-covered entities (apps, wearables, retail health programs). Creates consent requirements for collection, use, and sharing. Provides a private right of action.
Substrate relevance
Health data collected outside the clinical context increasingly determines care, insurance, and employment access. My Health My Data closes the HIPAA gap by treating consumer health data as substrate regardless of the collecting entity. The private right of action is a substrate enforcement primitive independent of under-resourced agency enforcement.
Use as anchor
First U.S. law to regulate non-HIPAA health data with a private right of action. Template legislation has been introduced in other states (Nevada, Connecticut). Particularly important for post-Dobbs context where location and health data can be used to infer abortion-related activity.
The gap
Enforcement is early-stage. The definition of 'consumer health data' is broad but has litigation uncertainty. De-identified data exemptions create re-identification risk.
FederalStatute
FERPA
Family Educational Rights and Privacy Act
United States · 1974
Protects the privacy of student education records. Gives parents and students over 18 the right to inspect, review, and correct records. Requires written consent for disclosure of records to third parties, with limited exceptions for school officials and contractors.
Substrate relevance
Student data is the substrate of educational opportunity — it determines what interventions are offered and how students are tracked into life pathways. FERPA's consent requirement is a substrate sovereignty principle at the individual level.
Use as anchor
EdTech vendors receiving student data under school contracts are already FERPA-covered. The 'legitimate educational interest' exception is narrow and litigable — it creates a hook for challenging broad AI vendor data use. The law is a mandatory starting point in any advocacy conversation about school data.
The gap
Broad exceptions for 'school officials' have been interpreted to cover most vendor relationships with minimal scrutiny. Enforcement is weak — the only remedy is loss of federal funding, which no administration has ever applied to a district. Does not address algorithmic decision-making using student records.
FederalStatute
COPPA
Children's Online Privacy Protection Act
United States · 1998 (amended 2013, FTC rule updated 2024)
Requires verifiable parental consent before online services collect personal information from children under 13. Prohibits behavioral advertising to children. Requires data minimization for child-directed services. FTC 2024 rule update expanded protections and strengthened the ban on behavioral advertising.
Substrate relevance
COPPA is the federal substrate protection law for the youngest users — it establishes that children's digital substrate requires heightened protection and explicit parental authorization. The 2024 rule update extended protections to EdTech and school-authorized services, closing a long-standing gap.
Use as anchor
FTC has enforced COPPA against major platforms including Google/YouTube, TikTok, and Epic Games for over $500M in combined penalties. The 2024 rule update created stronger EdTech protections that advocates can use in district vendor negotiations.
The gap
The under-13 cutoff leaves 13–17 year olds unprotected at the federal level. Parental consent verification is technically difficult to implement and is often gamed. Age assurance requirements are not yet technically standardized.
FederalStatute
IDEA
Individuals with Disabilities Education Act
United States · 1975 (reauthorized 2004)
Guarantees students with disabilities a free appropriate public education (FAPE) in the least restrictive environment (LRE). Requires individualized education programs (IEPs) developed with family participation. Mandates procedural due process rights for placement decisions.
Substrate relevance
IDEA is the federal guarantee that educational substrate is provisioned for students whose access requires accommodation. The IEP is a personalized substrate specification — it defines what conditions the school must maintain for that student's education to be possible. The 'least restrictive environment' principle is a substrate access mandate: students should be in the richest possible educational context.
Use as anchor
Due process rights under IDEA create enforceable claims — families can challenge placement decisions through administrative hearings and federal courts. AI-based assessment or placement tools that affect IEP decisions are within the scope of IDEA procedural requirements.
The gap
IDEA covers placement and programming, not the quality of the substrate within placements. AI tools used in special education assessment are largely unregulated — no specific requirement that algorithmic assessments be validated for the populations they assess.
FederalStatute
ESSA
Every Student Succeeds Act
United States · 2015
Reauthorizes the Elementary and Secondary Education Act. Requires states to develop accountability systems measuring student performance, school quality, and progress toward equity goals. Requires reporting disaggregated by race, income, disability status, and English learner status. Gives states flexibility in designing interventions for low-performing schools.
Substrate relevance
ESSA requires states to measure the substrate conditions that predict student success — including chronic absenteeism, advanced coursework access, and school climate — not just test scores. The equity disaggregation requirement makes substrate inequity legible: disparities in outcomes must be publicly reported.
Use as anchor
ESSA's required reporting creates a public transparency mechanism for substrate inequity. Schools identified for support must develop improvement plans — creating an advocacy entry point. The 'school quality or student success' indicator requirement creates space to argue for mental health and climate metrics.
The gap
States have wide latitude in designing accountability systems, and most have chosen weak indicators for non-academic factors. Federal enforcement of state accountability plans is limited. Does not address digital substrate conditions (device access, data privacy, algorithmic decision-making) in schools.
FederalStatute
Clean Water Act
Clean Water Act
United States · 1972
Establishes the basic structure for regulating discharges of pollutants into U.S. waters and regulating quality standards for surface waters. Creates the NPDES permit system for point-source discharges. Section 404 regulates fill of wetlands and waters.
Substrate relevance
Clean water is substrate in the most literal sense — it is the medium through which an entire watershed ecosystem operates. The 'waters of the United States' (WOTUS) definition determines what counts as protected substrate. The antidegradation principle (no backsliding from current quality) is a substrate preservation mandate.
Use as anchor
NPDES permits are renewable and reviewable — advocates can intervene in permit proceedings. Section 316(b) cooling water intake rules create precedent for considering ecosystem substrate impacts. Section 404 is the entry point for wetlands and watershed advocacy near development projects.
The gap
Non-point source pollution (agricultural runoff, urban stormwater) is largely unregulated under CWA. WOTUS definition has been litigated repeatedly and currently covers less territory than under prior administrations (Sackett v. EPA, 2023). EPA enforcement capacity is constrained.
FederalStatute
Title VI / Title IX
Civil Rights Act Title VI and Education Amendments Title IX
United States · 1964 (Title VI), 1972 (Title IX)
Title VI prohibits discrimination based on race, color, or national origin in programs receiving federal financial assistance. Title IX prohibits sex discrimination in federally funded education programs. Both create administrative enforcement through OCR and private right of action under certain conditions.
Substrate relevance
Title VI and IX are the foundation of equitable substrate access in federally funded education — they establish that the substrate of education cannot be withheld on the basis of protected characteristics. Algorithmic tools in education that produce disparate impact on protected groups are subject to Title VI scrutiny.
Use as anchor
OCR complaints are a well-established advocacy tool — they create agency investigation obligations. Disparate impact analysis applies: neutral policies that produce discriminatory effects violate Title VI even without discriminatory intent. AI tools that disproportionately flag or discipline students of color are cognizable claims.
The gap
OCR has limited enforcement capacity and a large backlog of complaints. Private right of action requires proof of intentional discrimination, not just disparate impact, under current Supreme Court precedent. Does not cover private schools without federal funding.
FederalStatute
ADA / Section 504
Americans with Disabilities Act / Section 504 of the Rehabilitation Act
United States · 1990 (ADA), 1973 (Section 504)
ADA prohibits discrimination against people with disabilities in employment, public accommodations, government services, and telecommunications. Section 504 prohibits discrimination against people with disabilities in federally funded programs. Both require reasonable accommodation.
Substrate relevance
ADA and Section 504 are substrate equity mandates for people with disabilities — they require that the substrate of public life be accessible. For digital environments: algorithmic systems that screen out people with disabilities without job-related justification violate ADA. AI hiring tools that use speech pattern analysis or facial expression analysis may systematically disadvantage people with certain disabilities.
Use as anchor
DOJ and EEOC have issued guidance on AI and disability discrimination that creates clear enforcement hooks. The 'reasonable accommodation' requirement means algorithmic systems that could be modified to reduce discriminatory impact must be modified. EEOC has issued technical assistance on AI in employment.
The gap
Enforcement depends on complaint filing and investigation — proactive review of AI systems for ADA compliance is not required. The definition of 'direct threat' defense gives employers latitude to argue that certain screening criteria are job-related.
FederalStatute
FTC Act § 5
Federal Trade Commission Act, Section 5 — Unfair and Deceptive Acts and Practices
United States · 1914 (amended multiple times)
Prohibits unfair or deceptive acts or practices in commerce. The FTC has used this authority to enforce privacy commitments, prosecute data security failures, and pursue algorithmic discrimination. Does not require specific harms to be codified — the FTC can act when harm is unfair or deceptive.
Substrate relevance
FTC Act § 5 is the primary federal enforcement authority for substrate violations across multiple domains. The 'unfair' prong — conduct that causes substantial consumer injury that is not outweighed by benefits and that consumers cannot reasonably avoid — maps directly onto substrate depletion: algorithmic systems that extract value from users while degrading the underlying substrate are cognizable.
Use as anchor
FTC has used § 5 to bring enforcement actions against algorithmic discrimination (HireVue), deceptive AI claims, and data privacy violations. Section 5 can be used even before Congress passes specific AI legislation. Consent decrees from FTC enforcement actions create compliance monitoring frameworks.
The gap
FTC does not have general rulemaking authority for privacy (unlike in the EU). Section 5 enforcement is complaint-driven and resource-constrained. The 'unfair' standard requires showing substantial harm, which requires evidence that can be difficult to obtain from algorithmic systems.
FederalExec. Order
EO 14110 (AI)
Executive Order 14110 — Safe, Secure, and Trustworthy Artificial Intelligence
United States · 2023
Directed federal agencies to assess and mitigate AI risks, including establishing standards for AI safety and security, protecting privacy, advancing equity and civil rights, and ensuring workers' interests are considered. Required NIST to develop AI safety guidance (AI RMF). Directed agencies to report on AI use in government.
Substrate relevance
EO 14110 was the first executive-level substrate governance directive for AI in the U.S. federal government. The equity and civil rights requirements created agency obligations to assess how AI systems affect protected substrate access. The worker protections section recognized that algorithmic management is a labor substrate issue.
Use as anchor
EO 14110 created binding agency obligations that can be enforced through APA challenge if not implemented. NIST AI RMF (created under the EO) is now a reference standard in procurement and contracting. The equity requirements created inter-agency working groups that advocates can engage.
The gap
Rescinded by Executive Order in January 2025 under the subsequent administration. Many agency implementation actions are at risk of reversal. Enforcement now depends on statutory authority rather than executive direction. NIST AI RMF survives as a voluntary framework but has lost executive mandate.
FederalStatute
APA
Administrative Procedure Act
United States · 1946
Establishes the procedures federal agencies must follow when creating regulations. Requires notice-and-comment rulemaking for significant regulations. Creates judicial review of agency actions for arbitrariness and capriciousness. Governs how agencies must explain the basis for their decisions.
Substrate relevance
The APA is the substrate of the administrative state — the meta-governance layer that governs how governance rules are made. For AI advocacy: every significant agency use of AI in rulemaking or enforcement is subject to APA requirements, including the requirement to explain the basis for decisions. An agency that cannot explain how an AI system reached a conclusion may be vulnerable to APA challenge.
Use as anchor
The 'arbitrary and capricious' standard requires agencies to explain their reasoning. An agency decision made by an AI system without human review of the reasoning may be challenged. The notice-and-comment process creates mandatory public engagement windows for every significant rulemaking — a recurring advocacy calendar.
The gap
Post-Loper Bright (2024, overruling Chevron), courts are increasingly substituting their own statutory interpretations for agency interpretations, making agencies more conservative. APA judicial review is slow — typical administrative law challenges take 3–5 years.
FederalStatute
ECPA
Electronic Communications Privacy Act
United States · 1986
Restricts government access to electronic communications and stored data. The Stored Communications Act (Title II) governs government access to data stored by third-party service providers. Sets warrant requirements for some categories of data and subpoena standards for others.
Substrate relevance
ECPA defines the substrate access rights of law enforcement relative to individuals' digital data. It is the primary statutory protection against warrantless government surveillance of digital communications. Its rules determine what the government can access about an individual without judicial authorization.
Use as anchor
ECPA creates a statutory floor for digital privacy that operates independently of Fourth Amendment protections. Violations create suppression remedies and civil claims. ECPA reform is a cross-partisan issue — conservatives concerned about government surveillance and progressives concerned about civil rights have both pushed for updates.
The gap
ECPA was written in 1986, before cloud storage, smartphones, and algorithmic surveillance. Many provisions are outdated — the warrant requirement does not clearly apply to data stored in the cloud for more than 180 days (a gap DOJ has exploited). Significant reform has been proposed but not enacted.
Intl.Framework
EU AI Act
European Union Artificial Intelligence Act
European Union · 2024
Establishes a risk-based regulatory framework for AI systems in the EU. Prohibits certain AI applications (social scoring, real-time biometric surveillance in public spaces). Imposes requirements on high-risk AI systems (transparency, accuracy, human oversight, conformity assessment). Creates obligations for general-purpose AI model providers.
Substrate relevance
The EU AI Act is the first comprehensive AI governance framework to treat AI as a substrate governance matter. The high-risk category maps directly onto substrate-determinative decisions: education, employment, healthcare, credit, law enforcement. The human oversight requirement is a substrate control primitive — it mandates that the human substrate retains authority over consequential AI decisions.
Use as anchor
EU AI Act creates compliance requirements for any company selling AI systems in the EU, including U.S. companies. Brussels Effect: U.S. companies may extend EU compliance to U.S. markets to avoid dual compliance costs. The GPAI model tier creates specific requirements for frontier AI developers.
The gap
Implementation is phased through 2027 — critical details in delegated acts and technical standards are still being determined. Enforcement depends on national competent authority capacity, which varies significantly across member states. GPAI transparency requirements are weaker than civil society advocates sought.
Intl.Framework
GDPR
EU General Data Protection Regulation
European Union · 2018
Establishes comprehensive data protection rights for EU individuals. Creates lawful basis requirements for data processing. Grants rights to access, erasure, portability, and restriction. Requires data protection by design and by default. Prohibits solely automated decisions with legal effects without human review (Article 22).
Substrate relevance
GDPR is the global reference standard for data substrate governance. The data minimization principle is a substrate efficiency principle. The purpose limitation principle is a substrate provenance principle — data collected for one purpose cannot be repurposed. Article 22's prohibition on solely automated decisions is a substrate control mandate for AI.
Use as anchor
GDPR fines of up to 4% of global annual revenue have produced enforcement actions in the billions of euros. Article 22 creates a right to human review of algorithmic decisions invoked in credit, employment, and criminal justice contexts. The data portability right creates a substrate mobility primitive.
The gap
GDPR enforcement has been uneven — Ireland's DPC has been slow on U.S. tech companies. Article 22 'solely automated' language creates a workaround where minimal human review provides a legal shield. Consent dark patterns remain widespread despite GDPR's consent requirements.
Intl.Treaty
UNCRC
UN Convention on the Rights of the Child
United Nations (196 state parties; U.S. is not a party) · 1989
The most widely ratified human rights treaty in history. Establishes children's rights to survival, development, protection, and participation. Article 28 (right to education), Article 17 (access to information and media protections), Article 16 (privacy), and Article 31 (play and rest) are directly relevant to substrate governance.
Substrate relevance
The UNCRC frames children's rights as substrate rights — the conditions necessary for development to occur. The 'best interests of the child' standard (Article 3) is a substrate optimization principle: decisions affecting children must be evaluated by their impact on developmental substrate, not just their legality or efficiency.
Use as anchor
UNCRC is the reference standard in international advocacy on children's rights, including digital rights. The UK's Age Appropriate Design Code (Children's Code) is explicitly grounded in UNCRC principles. U.S. advocates can use UNCRC as a persuasive authority even without ratification.
The gap
The U.S. is the only UN member state that has not ratified the UNCRC — this reduces its direct legal force in U.S. advocacy but not its persuasive force. Enforcement through the UN Committee on the Rights of the Child is weak even in ratifying states.
Intl.Framework
OECD AI Principles
OECD Principles on Artificial Intelligence
OECD member states (42 countries) + G20 · 2019
Establishes five principles for responsible AI: inclusive growth and sustainable development; human-centered values and fairness; transparency and explainability; robustness, security, and safety; accountability. Adopted by G20, G7, and most major democracies as the reference governance framework.
Substrate relevance
OECD Principles are the soft law that national laws implement. The transparency and explainability principle is a substrate legibility requirement. The accountability principle is a substrate governance mandate. The 'human-centered values' principle creates an opening for substrate protection arguments in international forums.
Use as anchor
OECD Principles are cited in virtually every national AI governance framework. Advocacy that uses OECD language operates within the legitimate range of discourse in international forums. The Principles created the conceptual framework for EU AI Act high-risk categories.
The gap
Soft law — no enforcement mechanism. 'Transparency' and 'explainability' are undefined, creating wiggle room for minimal compliance. The 'human-centered' framing is contested by AI acceleration advocates.
Intl.Framework
UNESCO AI Ethics Recommendation
UNESCO Recommendation on the Ethics of Artificial Intelligence
UNESCO member states (193 countries) · 2021
First global normative framework on AI ethics adopted by all UNESCO member states. Establishes principles for AI development and deployment including human oversight, transparency, fairness, sustainability, privacy, and accountability. Includes specific provisions on AI in education.
Substrate relevance
UNESCO's AI Ethics Recommendation frames AI governance explicitly as substrate governance for human development. The provisions on AI in education are the most detailed international guidance available on protecting the educational substrate — including data governance, pedagogical autonomy, and the risks of algorithmic assessment.
Use as anchor
Unanimously adopted by 193 member states including the U.S. — creates a legitimate basis for claiming international consensus on AI ethics in education. The education provisions are detailed enough to anchor specific advocacy claims on student data, algorithmic assessment, and teacher autonomy.
The gap
Non-binding recommendation, not a treaty. No enforcement mechanism. Implementation is highly variable across member states. The consensus language required to achieve unanimous adoption produces principles that are sometimes too general to anchor specific legal claims.
Intl.Framework
UN Digital Compact
UN Global Digital Compact
United Nations member states · 2024
International framework adopted at the Summit of the Future (September 2024). Establishes principles for an open, free, and secure digital future. Creates commitments on AI governance, data governance, digital inclusion, and the global information environment. Established an International AI Safety Network.
Substrate relevance
The Global Digital Compact is the first UN-level governance framework to treat the digital environment as global shared substrate. The 'open, free, and secure' framing is a substrate design specification for the global information environment. The AI governance commitments reference substrate protection without using that language.
Use as anchor
UN adoption creates legitimacy for substrate governance arguments in multilateral forums. The digital inclusion commitments create openings for equity-based substrate advocacy at the international level. The annual review mechanism creates recurring advocacy windows.
The gap
Non-binding — commitments are political, not legal. Enforcement depends on state implementation. AI governance language is the result of significant compromise and is weaker than civil society advocates sought. Significant geopolitical divisions (US-China-Russia) limit what the UN can actually require.
FederalStatute
KOSA
Kids Online Safety Act (KOSA)
United States · Proposed; passed Senate 91–3 (July 2024); died in House
Would require social media platforms to enable the strongest privacy and safety settings by default for minors, disable addictive product features (autoplay, push notifications) for users under 17, and allow parents to control certain settings. Passed Senate with near-unanimous support but stalled in the House over First Amendment concerns.
Substrate relevance
KOSA is the first federal legislation to treat the algorithmic and design substrate of social media as a child safety matter, not merely a data privacy matter. The 'duty of care' provision would require platforms to mitigate harms to minors' physical, mental, and emotional health — a substrate duty of care for the attention environment.
Use as anchor
91–3 Senate vote establishes bipartisan consensus that federal children's online safety legislation is politically viable. The framework has been re-introduced in the 119th Congress. KOSA coalitions include pediatric health organizations, parent groups, and mental health researchers — a cross-sector substrate protection coalition.
The gap
First Amendment objections from civil liberties groups focus on the 'harmful content' provision, which critics argue creates a liability hook for platforms to over-remove LGBTQ+ and other minority content. The duty of care standard is contested. House action depends on resolving the First Amendment tension without gutting the duty of care.
FederalStatute
ADPPA
American Data Privacy and Protection Act
United States · Proposed; passed House Energy & Commerce 53–2 (July 2022); not enacted
Would create a comprehensive federal data privacy law. Establishes data minimization requirements, loyalty duties, civil rights protections, algorithmic impact assessment requirements, and a private right of action. Provides limited federal preemption of state privacy laws, with carve-outs for California's stronger protections.
Substrate relevance
ADPPA is the proposed federal analog to GDPR — a comprehensive substrate data governance framework. The data minimization requirement is a substrate efficiency mandate. The civil rights provision is a substrate equity guarantee. The algorithmic impact assessment requirement is a substrate health check applied at the federal level.
Use as anchor
53–2 committee vote demonstrates that comprehensive federal privacy legislation has strong bipartisan support when framed around consumer protection. Re-introduction in subsequent Congresses demonstrates sustained legislative interest. The private right of action provision creates an independent enforcement mechanism that complements agency enforcement.
The gap
Federal preemption of state laws remains the central sticking point — California's CCPA and CPRA are stronger than ADPPA in several respects, and California has resisted federal preemption. Industry opposes the private right of action. Congress has not enacted comprehensive privacy legislation in over 20 years despite repeated attempts.
StateStatute
State Phone-Free Wave
State Phone-Free School Mandate Wave (FL, NY, TX, VA, IN, and others, 2024–2025)
Multiple U.S. states · 2024–2025 (varies by state)
Following California SB 1216 (2024), at least 15 states have introduced or enacted legislation requiring or strongly encouraging phone-free school policies. Florida enacted a mandatory phone-free school day law in 2023. New York, Texas, Virginia, Indiana, and others are in active legislative sessions. Implementation models vary: Yondr pouches, classroom storage, full school-day bans.
Substrate relevance
The state phone-free wave represents the fastest substrate protection legislative expansion in U.S. education history. Each state law converts a local governance decision into a statewide substrate standard, solving the collective action problem — individual districts can no longer opt out for competitive reasons.
Use as anchor
Jonathan Haidt's 'The Anxious Generation' (2024) and the U.S. Surgeon General's advisory on youth mental health provide the public health mandate. The political profile is unusual: conservative parents rights coalitions and progressive mental health advocates are aligned. Template legislation from CA and FL is available and road-tested.
The gap
Implementation quality varies dramatically — mandates without resources produce symbolic compliance. States with weak teacher union relationships have mandates without training. Equity concerns about enforcement disparities between wealthy and underresourced districts remain unaddressed in most state bills.
Intl.Framework
EU AI Liability Directive
EU AI Liability Directive (Proposed)
European Union · Proposed 2022; withdrawn from fast-track 2024; under renegotiation
Would adapt EU product liability rules to cover AI systems. Creates a rebuttable presumption of causality — if an AI system causes harm and the developer cannot demonstrate the system worked correctly, the developer is presumed liable. Would apply to high-risk AI systems as defined by the EU AI Act.
Substrate relevance
AI liability is the enforcement mechanism for AI substrate governance. Without liability exposure, AI Act compliance requirements are self-imposed. The rebuttable presumption is a substrate burden-shifting primitive — the entity controlling the substrate must demonstrate it is not causing harm, rather than the harmed party having to prove causation.
Use as anchor
EU liability exposure creates compliance incentives that regulatory mandates alone do not. If enacted, the Brussels Effect would extend AI liability pressure to U.S. companies operating in EU markets. Creates a template for national AI liability legislation globally.
The gap
Industry opposition has slowed progress significantly. The 2024 withdrawal from fast-track negotiations means implementation is uncertain. The interaction between the AI Liability Directive and the AI Act's conformity assessment regime is not fully resolved. Does not address harms to collective goods (democracy, information ecosystem) — only individual compensable harms.
FederalStatute
Algorithmic Accountability Act
Algorithmic Accountability Act (Re-introduced 2023)
United States · Proposed; introduced 2019, re-introduced 2022, 2023; not enacted
Would require companies to conduct impact assessments of automated decision systems for bias, accuracy, and impact on privacy and security. Assessments would be submitted to the FTC, which would establish standards and have enforcement authority. Covers automated decision systems used in housing, employment, credit, education, and health care.
Substrate relevance
The Algorithmic Accountability Act is the federal analog to Colorado AI Act and NYC LL 144 — it applies the impact assessment requirement at the national level. The FTC submission requirement is a substrate transparency mandate: algorithmic systems in consequential domains must be documented and disclosed to a federal regulator.
Use as anchor
Has bipartisan co-sponsorship in both chambers. FTC enforcement authority is already established — the Act would add specific algorithmic accountability requirements to FTC's existing § 5 authority. Colorado and NYC precedents demonstrate that impact assessment requirements are operationally feasible.
The gap
Has not advanced past introduction in three Congresses. The current FTC under the 2025 administration has deprioritized algorithmic accountability enforcement, reducing the urgency argument. Industry opposes the public disclosure requirement for assessment results, which is the transparency primitive that gives the law teeth.
Proposed & In Progress
These laws have been introduced, passed one chamber, or are actively under negotiation. They signal where the legislative frontier is moving. None are yet enforceable as enacted law.
LA Alg. Accountability (Proposed)
Los Angeles · Proposed 2023–2024; not yet enacted
Proposed ordinance would require city agencies to conduct impact assessments before deploying automated decision systems, maintain a public registry of algorithmic tools in use, and provide appeal rights for individuals affected by automated government decisions. Modeled on NYC and Seattle frameworks.
Substrate relevance
Would extend substrate governance to the second-largest U.S. city's government operations. The public registry is a substrate transparency primitive — citizens can see what algorithmic systems are making decisions about them. The appeal right is a substrate due process mechanism.
The gap
Has not yet been enacted as of 2026. Enforcement capacity is the key gap — LA has not yet established an independent oversight office for algorithmic accountability. City contractor systems would need to be covered to have real impact.
city
KOSA
United States · Proposed; passed Senate 91–3 (July 2024); died in House
Would require social media platforms to enable the strongest privacy and safety settings by default for minors, disable addictive product features (autoplay, push notifications) for users under 17, and allow parents to control certain settings. Passed Senate with near-unanimous support but stalled in the House over First Amendment concerns.
Substrate relevance
KOSA is the first federal legislation to treat the algorithmic and design substrate of social media as a child safety matter, not merely a data privacy matter. The 'duty of care' provision would require platforms to mitigate harms to minors' physical, mental, and emotional health — a substrate duty of care for the attention environment.
The gap
First Amendment objections from civil liberties groups focus on the 'harmful content' provision, which critics argue creates a liability hook for platforms to over-remove LGBTQ+ and other minority content. The duty of care standard is contested. House action depends on resolving the First Amendment tension without gutting the duty of care.
federal
ADPPA
United States · Proposed; passed House Energy & Commerce 53–2 (July 2022); not enacted
Would create a comprehensive federal data privacy law. Establishes data minimization requirements, loyalty duties, civil rights protections, algorithmic impact assessment requirements, and a private right of action. Provides limited federal preemption of state privacy laws, with carve-outs for California's stronger protections.
Substrate relevance
ADPPA is the proposed federal analog to GDPR — a comprehensive substrate data governance framework. The data minimization requirement is a substrate efficiency mandate. The civil rights provision is a substrate equity guarantee. The algorithmic impact assessment requirement is a substrate health check applied at the federal level.
The gap
Federal preemption of state laws remains the central sticking point — California's CCPA and CPRA are stronger than ADPPA in several respects, and California has resisted federal preemption. Industry opposes the private right of action. Congress has not enacted comprehensive privacy legislation in over 20 years despite repeated attempts.
federal
State Phone-Free Wave
Multiple U.S. states · 2024–2025 (varies by state)
Following California SB 1216 (2024), at least 15 states have introduced or enacted legislation requiring or strongly encouraging phone-free school policies. Florida enacted a mandatory phone-free school day law in 2023. New York, Texas, Virginia, Indiana, and others are in active legislative sessions. Implementation models vary: Yondr pouches, classroom storage, full school-day bans.
Substrate relevance
The state phone-free wave represents the fastest substrate protection legislative expansion in U.S. education history. Each state law converts a local governance decision into a statewide substrate standard, solving the collective action problem — individual districts can no longer opt out for competitive reasons.
The gap
Implementation quality varies dramatically — mandates without resources produce symbolic compliance. States with weak teacher union relationships have mandates without training. Equity concerns about enforcement disparities between wealthy and underresourced districts remain unaddressed in most state bills.
state
EU AI Liability Directive
European Union · Proposed 2022; withdrawn from fast-track 2024; under renegotiation
Would adapt EU product liability rules to cover AI systems. Creates a rebuttable presumption of causality — if an AI system causes harm and the developer cannot demonstrate the system worked correctly, the developer is presumed liable. Would apply to high-risk AI systems as defined by the EU AI Act.
Substrate relevance
AI liability is the enforcement mechanism for AI substrate governance. Without liability exposure, AI Act compliance requirements are self-imposed. The rebuttable presumption is a substrate burden-shifting primitive — the entity controlling the substrate must demonstrate it is not causing harm, rather than the harmed party having to prove causation.
The gap
Industry opposition has slowed progress significantly. The 2024 withdrawal from fast-track negotiations means implementation is uncertain. The interaction between the AI Liability Directive and the AI Act's conformity assessment regime is not fully resolved. Does not address harms to collective goods (democracy, information ecosystem) — only individual compensable harms.
international
Algorithmic Accountability Act
United States · Proposed; introduced 2019, re-introduced 2022, 2023; not enacted
Would require companies to conduct impact assessments of automated decision systems for bias, accuracy, and impact on privacy and security. Assessments would be submitted to the FTC, which would establish standards and have enforcement authority. Covers automated decision systems used in housing, employment, credit, education, and health care.
Substrate relevance
The Algorithmic Accountability Act is the federal analog to Colorado AI Act and NYC LL 144 — it applies the impact assessment requirement at the national level. The FTC submission requirement is a substrate transparency mandate: algorithmic systems in consequential domains must be documented and disclosed to a federal regulator.
The gap
Has not advanced past introduction in three Congresses. The current FTC under the 2025 administration has deprioritized algorithmic accountability enforcement, reducing the urgency argument. Industry opposes the public disclosure requirement for assessment results, which is the transparency primitive that gives the law teeth.
federal
The Arc
Eight decades of substrate governance legislation, from the administrative state to the AI act. The pattern: state and international law advance faster than Congress. The gaps compound each decade.
1946–1979Foundations
APA · 1946Title VI / Title IX · 1964Water District Conservation Rules · 1970County Watershed Protection · 1970CEQA · 1970Clean Water Act · 1972ADA / Section 504 · 1973FERPA · 1974IDEA · 1975
The administrative and civil rights substrate is established. APA creates the rulemaking framework; Title VI, the Clean Water Act, FERPA, IDEA, and Section 504 define what public institutions owe citizens. Substrate protection is framed as anti-discrimination and environmental protection — not yet as a distinct governance category.
1980–1999Digital Baseline
ECPA · 1986UNCRC · 1989COPPA · 1998
ECPA (1986) is written for a world of fax machines. UNCRC (1989) establishes children's substrate rights globally — the U.S. does not ratify. COPPA (1998) is the first U.S. law to treat the digital environment as a substrate requiring child-specific protection. The frameworks are not yet connected.
2000–2017State Innovation
LEA Wellness Policy · 2004BIPA · 2008ESSA · 2015
BIPA (2008) is the outlier that changes everything — the first law to treat biometric data as intimate substrate requiring consent and creating private enforcement. ESSA (2015) expands federal accountability to non-academic substrate indicators. This era's pattern: state legislatures and courts advance substrate protection while Congress stalls.
2018–2024Substrate Acceleration
CCPA/CPRA · 2018GDPR · 2018SF Surveillance Ordinance · 2019NY SHIELD Act · 2019CA AB 272 · 2019OECD AI Principles · 2019NYC Student Data Privacy · 2020NYC LL 144 · 2021Seattle Alg. Accountability · 2021UNESCO AI Ethics Recommendation · 2021LAUSD Privacy Policy · 2022WA MHMD · 2023EO 14110 (AI) · 2023SFUSD Phone-Free · 2024CA SB 1216 · 2024CA AB 2930 · 2024Colorado AI Act · 2024EU AI Act · 2024UN Digital Compact · 2024
Seven years that produce more substrate governance legislation than the prior five decades combined. CCPA and GDPR (2018) create the global reference standards for data substrate sovereignty. EU AI Act, Colorado AI Act, California phone-free mandates, NYC algorithmic accountability, Washington health data — the legislative geography shifts from the federal to the state level and from the U.S. to the EU.
2024–The Proposed Frontier
SFUSD Phone-Free · 2024CA SB 1216 · 2024CA AB 2930 · 2024Colorado AI Act · 2024EU AI Act · 2024UN Digital Compact · 2024
KOSA passes the Senate 91–3 and stalls in the House. ADPPA passes committee 53–2 and fails on the floor. The Algorithmic Accountability Act is re-introduced for the third time. The pattern: strong bipartisan committee votes, floor failure due to industry pressure and preemption disputes. The proposed frontier is not a lack of political will — it is a structural problem of legislative venue and lobbying asymmetry.
District
City / County
State
Federal
Intl.
What the Pattern Means
Six structural observations from the full law catalog. These are not policy prescriptions — they are pattern recognition from the data.
01
The arc bends toward conditions, not just data.
Early substrate governance (FERPA 1974, CWA 1972) focused on prohibitions and civil rights floors. The 2018–2024 wave extended governance into the algorithmic and digital conditions that shape access to those rights. The trajectory is from 'you cannot discriminate' to 'the system that makes decisions about you must be audited.' That is a shift from anti-discrimination law to substrate health law.
02
The EU legislates; states respond; Congress waits.
GDPR (2018) and the EU AI Act (2024) are the two most consequential substrate governance instruments on earth — neither is U.S. federal law. State law (CCPA, BIPA, Colorado AI Act, CA SB 1216) is moving faster than federal law in almost every domain. The pattern is consistent across 30 years: the federal government sets floors in moments of political crisis (1964, 1972, 1974) and stalls in normal times. The legislative frontier is now in Sacramento, Denver, Albany, and Brussels.
03
2018–2024 is a phase transition, not a trend.
Seven laws in this catalog enacted before 2018. Thirty-two enacted 2018–2024. That is not a trend — it is a regulatory moment triggered by GDPR's enforcement, the Facebook–Cambridge Analytica disclosure, COVID-era EdTech expansion, and ChatGPT's public availability. Phase transitions end. The window for high-leverage substrate legislation may be narrower than it appears.
04
Enforcement is the missing primitive.
FERPA has existed since 1974 and its primary enforcement mechanism — loss of federal funding — has never been applied to a single school district. ECPA's warrant requirements do not clearly cover cloud storage. The Clean Water Act's WOTUS definition has been litigated to near-ineffectiveness (Sackett v. EPA, 2023). Strong laws with weak enforcement are not substrate protection. They are substrate theater. The gap between what laws require and what agencies can enforce is the primary attack surface for opposition actors.
05
Most laws prohibit bad things. None require measuring substrate health.
The most significant structural gap across all 43 entries: not one law requires measuring the substrate conditions that predict trust, development, or civic capacity. ESSA requires reporting on test scores and chronic absenteeism — not on attention substrate or social development conditions. The Clean Water Act monitors discharge permits — not watershed resilience. FERPA protects records — not the quality of the educational environment those records describe. Measurement reform — requiring that substrate health be measured, not just harm be prohibited — is the legislative frontier that does not yet have a law.
06
The proposed frontier reveals lobbying asymmetry, not political will.
KOSA passed the U.S. Senate 91–3. ADPPA passed the Energy & Commerce Committee 53–2. The Algorithmic Accountability Act has bipartisan co-sponsors. These are not examples of political indifference — they are examples of lobbying asymmetry: organized industry opposition at the floor vote level overwhelms committee-level bipartisan consensus. The lesson is not that substrate protection is politically unpopular. It is that floor votes require a different advocacy strategy than committee votes.
How to cite
APA 7th ed.
Perkins, C. (2026, May 7). Existing Law and Policy Map. Kinetic Trust Protocol. https://kinetic-trust-protocol.net/advocacy/existing-law