States should be allowed to regulate AI because realistically Congress won't

A provision in the “Big Beautiful Bill” (the massive federal spending and policy package currently being negotiated) aims to stop all state-level AI regulation for the next ten years. Now, I’m not anti-AI. My company (DuckDuckGo) offers our own private chatbot service at Duck.ai, we now generate millions of anonymous AI-assisted answers daily for our private search engine, and we are working on more AI features in our browser. We’re investing heavily in AI because, to achieve our aim of protecting people online as comprehensively as possible, we must offer a compelling alternative to the most commonly used untrusted online workflows, most notably searching, browsing, and now chatting.At the same time, I believe the AI backlash is real and growing, which is why I’m thinking and writing about it, and why we’re designing all our AI features to be useful, private, and optional. And, the backlash is real for good reason. AI poses a wide range of risks, including massive job displacement, extensive privacy concerns, and, at the extreme, existential risks. That’s why this “pause” is particularly dangerous. I’m not taking a position here on which risks should be regulated, when, or how. More on that in future posts. But I am saying that AI will require at least some well-crafted regulation to address some of its risks over the next ten years, and yet Congress has proven incapable of taking action. The states, on the other hand, do take action.Look no further than privacy law as a close parallel. It’s 2025, and the United States still lacks a comprehensive federal privacy law. The International Association of Privacy Professionals (IAPP) now tracks 144 countries with such laws (as of Jan 2025). The U.S. is a clear outlier:The most populous countries without a comprehensive national privacy law include the U.S., Pakistan, Bangladesh, Iran, and Iraq.This isn’t for lack of trying. Numerous bills have been proposed, and many hearings have been held, yet nothing has even come close to passing, not even after Snowden or Cambridge Analytica. Unrelated to privacy, Congress has proven unable to legislate effectively, and while we should work to fix that independently, we can’t wait for it.Meanwhile, IAPP tracks 19 states that have managed to pass general privacy laws to protect consumers to some extent, including the two most populous states, California and Texas. Despite fears that a “patchwork” of state laws would wreak havoc on innovation by going too far, they haven’t. Innovation hasn’t stalled, and neither have big-tech privacy violations. That’s because state privacy laws, while better than nothing, in my opinion, don’t nearly go far enough, which is why we (DuckDuckGo) still need to develop dozens of overlapping protections to keep consumers safe online. Meta’s latest AI-chatbot leak foreshadows a bleak AI-privacy future if there are literally no regulations in sight. State laws also provide Congress with both a blueprint for action and further incentive to enact laws. Nothing prevents a future AI bill from overriding (preempting) state AI laws. Of course, for that to happen, Congress would need to pass general tech legislation. I would love to witness that and have been working to help make it happen, but I am also realistic about Congress’s current capacity to regulate tech.Finally, the current proposal would seemingly preempt the most protective provisions of existing state privacy laws. That would be a giant step backward for online privacy. We helped pioneer Global Privacy Control, an opt-out signal that is on by default in our browser and extension, which has legal effect in California and other jurisdictions. Senator Maria Cantwell, ranking member on the Senate Commerce Committee, notes that the bill would nullify provisions of many state privacy laws that “give consumers the right to opt-out of profiling.” In the last 25 years, states filled the privacy law vacuum left by Congress; let them do the same for AI. We should not silence states from protecting their citizens from dangerous new risks for a decade. And, if Congress gets its act together, then great—those future bills can preempt any conflicting state provisions.Thanks for reading! Subscribe for free to receive new posts or get the podcast. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit gabrielweinberg.com