You should know where I've stood on this, because it's in writing. On January 1, under the headline "Why Federal Preemption of AI Regulation Would Be a Dangerous Mistake," I wrote that "States should have the authority to regulate AI products and services consumed within their borders," and then, in case anyone skimmed: "This is basic consumer protection." In July, writing about a draft federal AI bill, I put it this way:
If someone tells you this bill wipes out every state AI protection, they're overstating it. If someone tells you it's harmless, they're understating it. The truth is in the word "development," and now you know to look for it.
Now both lines meet in one document. The White House wants Congress to override state AI laws; its March 20 plan asks lawmakers to "preempt state AI laws that impose undue burdens." Yet the same plan tells Congress not to preempt the states' power "to enforce laws of general applicability against AI developers and users, including particular laws to protect children, prevent fraud, and protect consumers." On October 14, eight states used those very laws to sue OpenAI. And in the same section, the plan says: "States should not be permitted to regulate AI development."
So which is it? Can a state use a consumer-fraud law from the 1960s to set conditions on how an AI company tests its models? And if Congress does what the White House asks, could it still?
What Washington has asked for, in writing
How did we get here? In December 2025, an executive order called for "a minimally burdensome national standard—not 50 discordant State ones," set up a Justice Department task force whose "sole responsibility shall be to challenge State AI laws inconsistent with the policy" the order sets out, and told the drafters of a legislative proposal to spare "otherwise lawful State AI laws relating to" child safety, data-center infrastructure and state procurement. The list ends with "other topics as shall be determined"; consumer protection wasn't named.
The March 20 plan added it (the sentence quoted above) and gave its reason for the other line: AI development is "an inherently interstate phenomenon with key foreign policy and national security implications." Congress, it adds, "should not create any new federal rulemaking body to regulate AI."
Does any of this bind the states yet? No (and the plan doesn't pretend otherwise; it's labeled "LEGISLATIVE RECOMMENDATIONS"). Georgetown's Center for Security and Emerging Technology calls it "a non-binding list of recommendations to Congress."
And Congress? The leading preemption bill is the FRONTIER Act, H.R. 9925, from Rep. Jay Obernolte, a California Republican, and Rep. Lori Trahan, a Massachusetts Democrat. It's narrower than the plan: it bars any state "law, regulation, order, or other requirement that imposes new substantive obligations on artificial intelligence developers" in three areas, among them third-party auditing and incident reporting. It keeps "generally applicable laws, regulations, orders, or other requirements that do not target artificial intelligence developers" and state consumer-protection enforcement against deployers and users, "provided that no substantive obligations are imposed on developers with respect to model development, training, evaluation, or release."
As of October 24, 2026, the bill has sat in committee since July 23. Obernolte wants a committee vote in November; the chairman of House Energy and Commerce, Brett Guthrie, said in September he "wouldn't want to do something in a lame duck session to do it quickly and not get it right." Senate talks on broader AI measures that could preempt the states "did not yield a compromise" before the summer recess, and none has reached a markup since. (An older House bill, H.R. 5388, proposes a five-year moratorium on "certain State laws that restrict artificial intelligence models and systems"; it hasn't moved since 2025.)
Who's policing AI in the meantime? Mostly old laws
So who is minding the store? Mostly statutes — state and federal — written long before anyone had heard of a chatbot.
On October 14, Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia individually sued OpenAI in their own state courts, each, as Kansas Attorney General Kris Kobach noted, under its own consumer protection laws. Iowa's Consumer Fraud Act dates to the 1960s; the state's petition accuses OpenAI of "maintaining a sycophantic product that excessively agrees with users." Some states added other statutes: Nebraska a children's online design code, Montana its Consumer Data Privacy Act, Arkansas a 2025 teen online-privacy law.
These are allegations. As of October 24, 2026, no court has ruled in any of the eight, and I found no report of OpenAI's first filings or a move to federal court (OpenAI did that in Florida's earlier suit, and a federal judge sent it back to state court). OpenAI says it has "built industry-leading age-specific protections into our product" and wants "pragmatic AI policies that apply to the entire AI industry, not just one company." Nebraska's Mike Hilgers says his suit "simply holds OpenAI to the same standards under Nebraska law as any other company." Kobach, on waiting for Congress: "we are not going to hold our breath."
Washington is reaching for an old law, too. The day the states sued, the Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic, Axios reported. (A disclosure: this piece was drafted with help from Anthropic's Claude.) An FTC spokesperson confirmed the subpoenas to CBS News. Axios's source says they seek documents on security incidents, safeguarding practices, marketing and privacy policies — a demand, not an accusation. OpenAI said, "We will engage constructively with the FTC"; I found no public statement from Anthropic.
The FTC's own power over "unfair or deceptive acts or practices" came from Congress "nearly ninety years ago," the agency notes, and its chairman, Andrew Ferguson, said in September that the U.S. should look to existing laws before seeking to pass new ones regulating AI. On October 15, the White House's new AI task force (the president calls it the Super Intelligence Force) agreed to create a "law enforcement and consumer protection coordination committee" led by Ferguson.
And federal rules for how the most advanced models are built and tested? So far, they're mostly voluntary. In a September 29 White House accord, the signing companies committed to partner "with an independent external auditor or evaluator," and the president praised their "tremendous self-policing." The exception came on October 9, after Anthropic disclosed incidents it discovered in late September involving what the task force called "unauthorized and fraudulent use of government and other systems" by its AI: the task force told all AI companies that reporting and fixing incidents involving their models "is not optional," warned that "delayed notification" would "not be tolerated," and named no penalty.
Isn't eight courtrooms just a patchwork by another name?
Fair question, and the one-rulebook camp has a serious answer.
They aren't proposing to abolish consumer protection. R Street's summary of Adam Thierer's September 2025 House testimony says "every state government already possesses a diverse policy toolkit of generally applicable laws." The White House plan says much the same. On that reading, October 14 proved the preemption camp right — the states had tools all along.
Eight judges applying eight statutes could also produce the very patchwork preemption is meant to prevent, by injunction instead of legislation. Thierer, of the libertarian R Street Institute, told POLITICO before the suits were filed that the states "make a fair point" about a "dysfunctional" Congress but are rushing ahead because "it's the politically opportunistic thing to do." Six of the eight attorney-general offices are on the November 3 ballot. A pro-AI group, the Innovation Council, says Washington "already has plenty of tools at its disposal." Even Noah Knapp, who argues for a federal floor in The Regulatory Review, concedes: "The case for preemption is legitimate."
So far, so good, for the laws. The remedies are another matter.
Some states want more than penalties. Iowa accuses OpenAI of "developing and testing unsafe advanced AI models without appropriate safeguards" and asks the court to stop "any further testing of advanced AI models until adequate safeguards are implemented … and until third-party monitors have verified the same." Arizona wants testing barred "outside of a secured, independently verified testing environment," and Arkansas, the Arkansas Advocate reports, wants further advanced AI testing, and the creation of models capable of recursive self-improvement, halted until adequate safeguards are in place. Texas, which sued separately on October 23 under its own consumer-protection law, wants no new OpenAI model released to Texas users unless "an independent third-party evaluator, approved by the Court, has reviewed its safety guardrails and approved its release." (Its attorney general, Ken Paxton, is the Republican nominee for the U.S. Senate, and Elon Musk, a rival of OpenAI's Sam Altman, has spent nearly $200 million supporting him, the Texas Tribune reports.) Those requests reach past marketing, into how a model is built and tested. Is that the "AI development" the plan says "States should not be permitted to regulate"? The plan doesn't say.
Would a federal law cut those remedies off? H.R. 9925's bar covers any state "order," and its proviso stops the consumer-protection carve-out at development. Whether a state judge's injunction would count, no court has had to say, and I won't guess. Georgetown's researchers read the plan as suggesting the administration "would prefer Congress explicitly ban states from these types of regulatory actions and decline to take such action at the federal level."
The two companies that got the FTC's demands draw similar lines. OpenAI's June blueprint asks Congress, once a federal framework exists, to preempt state laws aimed at "the same frontier safety risks," leaving states "laboratories of democracy" on youth protection and more. Anthropic says preemption "should be surgical," sparing issues "such as child safety and consumer protection," and POLITICO reports that its own draft federal bill would "preempt some state AI laws related to public disclosure of risk, third-party evaluation and reporting of critical incidents." Both would preempt narrowly — and only alongside federal rules that don't exist yet. Not everyone reads Anthropic's draft that way: Encode AI's general counsel, Nathan Calvin, wrote that some of its preemption provisions would also "remove general powers that state courts have to enjoin defendants and protect the public," and Anthropic's head of federal affairs, Anthony Cimino, replied that the company would update that language to make clearer that states keep a role in "regulating a lab's capacity to shut down a model."
In Brazil, the AI bill waits and the consumer code works
Has anyone tried passing the comprehensive AI law first? Brazil has — and its record should unsettle both sides of our argument.
Brazil's Senate approved the country's AI framework, bill PL 2338/2023, in December 2024. As of October 24, 2026, the Chamber of Deputies still lists it as awaiting the rapporteur's report in a special committee, with no vote on record; in August the rapporteur pushed the vote to after the October elections, with no date set.
Older laws did the work instead. In July 2024, the data-protection authority, the ANPD, moved to suspend with immediate effect Meta's new policy of training generative AI on Brazilians' personal data. The same day, the national consumer secretariat, Senacon, notified Meta under the 1990 Consumer Defense Code; its chief, Wadih Damous, said internet companies must understand that Brazil's laws prevail over their terms of use. Eight weeks later, once Meta agreed to notify users, honor objections and leave out minors' data, the ANPD reversed the suspension. In February 2026, when tests indicated the failures persisted in X's Grok, the ANPD and Senacon ordered X to stop it from producing sexualized content of children and of nonconsenting adults, Senacon citing the consumer code, and federal prosecutors demanded monthly reports.
The structural difference is worth borrowing. Brazil runs one national consumer code, which makes federal, state and municipal agencies members of a single enforcement system. Under it, a decree signed October 9 lets the companies it covers use AI in customer service only if the customer can reach a real person in real time during the hours the decree sets; Senacon enforces it alongside the state and local consumer agencies, and it will take effect on November 2. Brazil's version of a patchwork, as I read it, is a crowd of enforcers applying one rulebook — not fifty rulebooks.
It isn't free. Meta called the ANPD's order a "setback for innovation" and later decided to suspend genAI features in Brazil. The Grok case shows how slowly old-law enforcement can move, and a dissenting senator, citing unnamed specialists, called the Senate's bill one of the world's worst AI frameworks. Brazil's actions also concern data and children (including what data a model may be trained on), not the safety testing Iowa wants a judge to police.
Picture four judges and one training run
None of this has happened; it's my extrapolation, not a forecast.
It's 2027. A judge in Polk County, Iowa, bars OpenAI from further tests of advanced models until third-party monitors sign off. Arizona's court allows testing only in "a secured, independently verified testing environment." Arkansas's halts self-improving models, and Florida's, in the suit that came first, requires "independent third-party guardrails and approval" for any new model. Four courts, four sets of conditions (and, presumably, four invoices), one training run. Whose monitor counts?
Now suppose Congress passes something like H.R. 9925 in a hurry. OpenAI's lawyers arrive in Polk County citing its bar on any state "order" touching third-party verification, and while the courts work out what "order" means, the bill's federal audit market is still being built. For a while, the only independent audits are the voluntary ones.
Then the FTC finalizes the policy statement it proposed in July (still a proposal as of October 24), which says steering an AI system's outputs against consumers' reasonable expectations "may deceive consumers in violation of section 5 … even if the deceptive steering is done in an effort to comply with State laws." The law the agency is using to investigate OpenAI and Anthropic becomes a tool for overriding a state's AI rule. One old law, two jobs.
No villain is required. Preempt first and build later, and the gap opens by itself.
Who agrees, and where they split
Who's right? The case for one rulebook has real backers. David Sacks, the president's former AI czar, said in September: "We should have one rulebook with respect to AI." Samuel Hammond of the Foundation for American Innovation calls the FRONTIER Act "light-touch with dynamic, third-party oversight where the risks are greatest."
Others see a gap. Americans for Responsible Innovation (ARI) says the bill's preemption clause leaves "a serious hole in regulatory oversight of AI models," since its safety-assurance market "will take years to set up" while preemption "would be effective immediately." The Center for Democracy and Technology (CDT) says a Senate kids-safety-and-AI package "does not justify preemption of state AI protections." In September, 26 attorneys general asked Congress for "explicit preservation of state authority by prohibiting the preemption of state laws" (of the eight suing states, only Arizona signed).
Charlie Bullock of the Institute for Law & AI, writing in Lawfare about an earlier draft, expects courts to treat as preempted any state law that "functions primarily to regulate development, or can realistically be complied with only by altering development practices," even one that "purports to regulate deployment."
Line them up and the agreement is wider than the shouting: a libertarian preemption advocate, the White House, the bipartisan House bill and both companies' own papers would leave general consumer-protection law standing, while the 26 attorneys general, ARI and CDT want states to keep more. They split on development: who sets the rules for how models are built and tested.
What does this mean for you?
What you can do while Washington decides:
Know what the suits are, and what they aren't. They're allegations, unresolved as of October 24, 2026, and not class actions you join: Iowa's law, Attorney General Brenna Bird says, "allows me, as attorney general, to step in on behalf of the whole group of Iowans who have been hurt."
If a chatbot company misled you or your child, tell your state, and the FTC. USA.gov will point you to your state's consumer protection office, the attorneys general's association lists every state's complaint page, and USA.gov also tells you how to report scams and suspicious communications to the Federal Trade Commission.
Read the two sentences that decide your state's power. In the White House plan, the carve-out for "laws of general applicability" and the line on "AI development" sit in the same section; in H.R. 9925, read the proviso in section 9(c). Then ask your representative where your state's laws fall.
Speak up before the lame duck. Find your representative by ZIP code, write to your senators, and name H.R. 9925. Government funding runs only through December 11, 2026; a must-pass bill could carry a preemption clause, though as of October 24 I could find none that does.
Watch the calendar. November 2, when Brazil's human-option rule takes effect; November 3, when six of the eight attorney-general offices are on the ballot; a possible Energy and Commerce vote in November; and OpenAI's first filings in the eight cases and Texas's.
The lesson, as I see it
In January I called a state's authority to regulate the AI products and services consumed within its borders "basic consumer protection." The White House plan keeps a narrower version: the general laws every business answers to, applied to AI like anything else. That's worth something, and October 14 showed what those laws can do. What the plan takes back is the word I flagged in July — development — and some of the suing states want judges to set conditions on how models are developed and tested.
The test I quoted in July, from Brendan Steinhauser of the Alliance for Secure AI, still sorts this out: "A national AI standard should protect at least as much as it preempts." By that measure, the plan falls short on development: it would bar state rules there, and what Washington has in their place today is a voluntary accord, an incident-reporting demand with no stated penalty, a bill no one has scheduled and an investigation whose demands aren't public.
My vote? Keep the carve-out, and write it so a state judge knows whether an order counts. Preempt nothing on development until a federal rule with a real enforcer is in force. Until then, let the eight cases run, with OpenAI free to answer every allegation in court. Who sets the rules for how AI is built is the question under every AI law to come; Congress should answer it on purpose.
Know someone who's about to tell Congress what they think about AI? Get this to them first. The whole fight turns on one word.