The Midterms Flipped Congress. What Could Change for AI and Privacy Laws?
Democrats won control of both chambers of Congress on November 3, 2026. However, the President can still veto bills, so any new federal AI or privacy law will need support from both parties. Proposals to preempt state laws are now harder to pass, which means state AI and privacy laws will likely keep setting the rules for most businesses.
By Alex Proctor
Published November 4, 2026
Summary
With Democrats in the majority from January 2027, proposals that would preempt state AI and privacy laws, such as the FRONTIER Act and the SECURE Data Act, are less likely to advance. The administration can still challenge state AI laws in court. Congress is most likely to agree on children's privacy, since a broader privacy law would need a compromise on preemption and private lawsuits. For most businesses, state AI and privacy laws that take effect on January 1, 2027, are more pressing than anything Congress is likely to pass.
What Changed on November 3?
Democrats won control of the House and the Senate, based on projections from the Associated Press and other outlets. The new Congress will be seated in January 2027. Democrats will then chair the committees that write federal AI and privacy bills.
President Trump can still veto any bill that passes. Neither party has the two-thirds majorities needed to override a veto, or the 60 votes that most bills need to advance in the Senate. After the results, the President told Fox News that Democrats will "send over things that are insane, and I'll veto them." He also said, "We'll probably work something out."
In the NBC News exit poll, 56 percent of voters said AI and data centers were a "crucial or major factor" in their vote for Congress. In Texas, Gina Hinojosa defeated Governor Greg Abbott after calling for a moratorium on new data centers until the Legislature sets rules for them.
Could Congress Pass a Federal AI Law?
Congress has not passed a broad federal AI law. Both leading proposals would preempt some state AI laws, an approach the White House supports. Its National Policy Framework for AI, released in March 2026, says "Congress should preempt state AI laws that impose undue burdens." That would leave in place general state laws that protect children, prevent fraud, and protect consumers.
In the House, the FRONTIER Act from Representatives Jay Obernolte and Lori Trahan would preempt state laws that impose duties on AI developers for catastrophic risk transparency, third-party audits, and incident reporting. It leaves states free to regulate how AI is used, "including via consumer protection, civil rights, contract, criminal, or privacy laws." In September, Energy and Commerce Chair Brett Guthrie said, "I'm not going to say that the bill is going to move." In the Senate, the AI safety bill drafted by Senators Thune and Klobuchar has not been introduced.
The election makes broad federal preemption of state AI laws less likely to pass, since Democrats will control both chambers. TIME reported that "the ban on state AI regulation Republicans have sought will be harder to enact."
However, the administration can still challenge state laws without Congress. A December 2025 executive order created a Justice Department task force to challenge state AI laws. In April 2026, the department joined xAI's lawsuit against the Colorado AI Act, which the state replaced a month later.
Could Congress Pass a Federal Privacy Law?
Congress has debated a federal privacy law for years without passing one. The two sticking points are preemption and whether consumers can sue. The American Privacy Rights Act of 2024 would have preempted most state privacy laws and included a private right of action. Its House markup was canceled in June 2024, before a committee vote.
In April 2026, House Republicans introduced the SECURE Data Act. It would bar any state law that "relates to the provisions of this Act." It does not include a private right of action, so the FTC and state attorneys general would enforce it, after giving businesses at least 45 days to cure a violation. Frank Pallone, the senior Democrat on the Energy and Commerce Committee, said the bill "adds expansive preemption that will leave many Americans with fewer privacy protections than they have today."
The election makes the SECURE Data Act less likely to pass in its current form, since Democrats will chair the committees that write privacy bills. The bill never received a committee vote in this Congress. Pallone is in line to chair the Energy and Commerce Committee, according to the IAPP. Any federal privacy law would need a compromise on preemption and private lawsuits.
Children's privacy is the most likely area for agreement, because COPPA 2.0 passed the Senate and the KIDS Act passed the House. Both would let states keep stronger protections for minors.
Where Do the Proposals Stand?
Introduced bills expire when this Congress ends in January, unless they pass during the lame-duck session. After that, the new majorities would write their own versions.
| Proposal | What it would do | Status |
|---|---|---|
| FRONTIER ActObernolte (R) and Trahan (D) |
| IntroducedJuly 23, 2026 |
| Senate AI Safety BillThune (R) and Klobuchar (D) |
| DraftNo text published |
| SECURE Data ActJoyce (R) and eight Republicans |
| IntroducedApril 21, 2026 |
| COPPA 2.0Children's and teens' privacy |
| Passed SenateMarch 5, 2026 |
| KIDS ActHouse children's safety package |
| Passed HouseJune 29, 2026 |
As of November 4, 2026.
What Happens to State AI and Privacy Laws?
States will likely keep writing most of the new AI and privacy rules. The IAPP reports that privacy and AI bills that had stalled could get a fresh look in states where Democratic majorities grew. Twenty-three states now have comprehensive privacy laws, after Vermont became the 23rd in June 2026. Oklahoma's and Louisiana's laws take effect on January 1, 2027.
Some state privacy laws now address AI directly. Connecticut requires a privacy notice to state whether the business uses personal data to train large language models. California's regulations on automated decisionmaking apply to existing uses from January 1, 2027.
Colorado replaced its AI Act in May 2026 with a narrower law on automated decisions. Its duties are scheduled to begin on January 1, 2027, the same day New York's RAISE Act takes effect for frontier AI developers. Scott Singer of the Carnegie Endowment for International Peace told TIME, "If Congress is gridlocked, what happens in California will govern AI for the U.S. and the world."
Attorneys general enforce most state privacy laws, so the election will shape enforcement as well. In Texas, Nathan Johnson won the open seat after promising to review consumer protection laws for gaps involving AI. During the campaign, he said that "predatory practices are predatory, no matter what's driving them."
What Should Businesses Do?
Federal preemption of state AI and privacy laws appears unlikely in the near term. Businesses should expect to keep managing the differences among state laws. Each law has its own scope, so coverage can differ from one business to the next.
Businesses that use AI should also make sure their privacy notices describe that use accurately, including AI tools added since the notice was last updated. Regulators compare those statements with what the business does.
Questions
Can Democrats pass AI laws without Republican support?+
No. Most bills need 60 votes to advance in the Senate, which neither party has. The President can also veto any bill that passes. Overriding a veto takes a two-thirds vote in each chamber, so a federal AI law would likely need support from both parties.
Would a federal privacy law replace state privacy laws?+
It depends on the bill. The SECURE Data Act would preempt any state law that relates to its provisions, while COPPA 2.0 and the KIDS Act would let states keep stronger protections for minors. Preemption has stalled federal privacy bills for years, so any bill that passes will likely be a compromise on how far it overrides state law.
Does the election change any state law deadlines?+
Not directly. State laws and regulations take effect on the dates already set, unless a legislature changes them, a court blocks them, or a federal law preempts them. Oklahoma's and Louisiana's privacy laws, Colorado's automated decision law, California's automated decisionmaking rules for existing uses, and New York's RAISE Act are all scheduled for January 1, 2027.
Briefings are informational and do not constitute legal advice.
Using AI with customer data?
I'll check what your privacy notice says about AI.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.