Automated systems now make or influence decisions that determine whether you get a mortgage, whether your resume clears the first filter, whether your insurance premium jumps, and whether an algorithm flags you as a risk. These are not neutral calculations. They encode assumptions, inherit biases from historical data, and produce outcomes that are hard to explain. Existing laws cover some uses, but audit and appeal duties vary. At the same time, the United States remains the only major democracy without a comprehensive federal data privacy law, leaving Americans with less legal control over their own personal information than citizens of the European Union, the United Kingdom, Canada, or Australia. The four proposals here attack the same governance vacuum: accountability for the automated systems that make material decisions about people, a privacy floor for the data those systems run on, safety rules for the most powerful models before they ship, and design standards that stop the machinery of engagement from being aimed at children. You cannot govern the machine if you do not first establish who owns the data it runs on, and you cannot call the rules finished while they exempt the newest systems and the youngest users.
STATE :: GOVERNANCE GAP
The four proposals here address the same underlying gap from four
angles: automated systems that must explain and defend their
decisions, a privacy floor that establishes who owns the data those
systems run on, safety rules that reach the most powerful models
before they ship, and design standards that keep the machinery of
engagement from being aimed at children. Unlike the other domains,
Protocol has no single visualization that captures the full scope.
The governance vacuum is structural, not geographic or statistical.
The evidence below maps the patchwork that fills the space where a
federal standard should be.
These proposals would begin no earlier than January 2029, after the
next presidential term starts. Each depends on the laws, funding,
and preparation it requires.
01▸Algorithmic Accountability & Transparency
Mechanism: When a bank's algorithm denies your mortgage or a computer rejects your resume, you have the right to know why and to challenge it. Some rights already exist: Regulation B requires specific reasons for a mortgage denial, or notice of how to request them. Using an algorithm does not erase that duty. Other laws address bias and some automated decisions. We broaden that patchwork with shared audit, explanation, and human-review rules.
The fix is an audit rule, built like the one public companies already live under for their books. Any company above a size floor whose software makes big decisions about people, in credit, hiring, housing, insurance, or criminal justice, files a yearly audit of that system. The audit method is public. The auditors are certified, like accountants.
People deserve to know why a machine said no, and the answer has to be one they can act on: a real record and a path to a human. Clear rules also help honest builders. A company that knows the standard builds better software, faster, than one that is guessing, and today's gaps reward whoever buries the harm.
02▸Data as Infrastructure: Federal Data Privacy Framework
Mechanism: Your data belongs to you, not to a company that buried the fine print in a 40-page agreement nobody reads. America is the only major democracy without a national privacy law. Your control over your own information depends on your state, and mostly does not exist.
The law we propose sets a floor, not a ceiling. Four rules. Consent has to be real, not a cookie pop-up designed to be clicked away. Companies may collect only what the service actually needs. You get the right to sue when your rights are violated, instead of waiting on an underfunded agency. And states stay free to go further, the way they always have.
Americans deserve the same control over their own lives that Europeans and Canadians already have. One clear national floor is also good for business: today a startup faces a different rulebook in every state, and that maze is exactly what only the giants can afford.
03▸Frontier AI Safety & Incident Reporting
Mechanism: The companies building the most powerful technology in history test it for catastrophic risks before it ships, and when something goes wrong, the public finds out. Neither is required by law today. The handful of labs at the frontier grade their own homework, under promises they can drop at any time. California passed the first transparency law. There is still no federal one.
Three parts. First, safety testing before release, required only for the few most powerful models. The labs already run these tests for the risks they themselves name. The change: the testing gets documented, follows the standard the government has already published, and is checked by a federal safety office. The bar is set high on purpose: frontier labs, not startups. Second, incident reporting on the aviation model, with the part that makes it work: separation. A defined list of serious harms gets investigated and published, like crashes. Near misses get confidential, protected reports, held by a neutral custodian that is not the regulator, the way NASA, not the aviation enforcer, runs the pilots' reporting system. Protection and separation are what make people file. That loop is how flying became safe. AI's version today is a volunteer spreadsheet. Third, legal protection for lab workers who speak up. The people closest to these systems know first and are protected least.
Write the rules before the systems lock in. Rules written now are cheap and calm. Rules written after a disaster are expensive and panicked. And a country that asks rivals to cooperate on AI safety abroad has to require something at home.
04▸Kids' Online Safety by Design
Mechanism: Your 12-year-old's feed is not engineered to keep her scrolling at 2 a.m., and her account is not visible to strangers by default. Today, both are standard. Kids get the same machinery as adults: feeds tuned to whatever is hardest to look away from, autoplay that never ends, streaks that punish logging off. The Surgeon General warns that teens on social media more than three hours a day face double the risk of anxiety and depression symptoms. A third of teens say they are on these apps almost constantly.
The rules bind design, never speech. Kids' accounts default to private. No engagement-tuned feeds for minors: newest-first is the default. No autoplay, no streaks, no notifications built to interrupt sleep. No collecting a kid's data beyond what the service needs, and no targeted ads to kids at all. The FTC enforces it. What this is not: no content rules, no topic bans, no government list of what kids may read. Mechanics, not messages.
Age checks without surveillance: no ID uploads, ever. Grabbing extra data in the name of checking ages breaks this law too. And the field levels: plenty of builders want to make products that respect kids, and lose to ones that will not. A floor ends that race to the bottom without banning a single word.
EVIDENCE BASE
STATUS :: AUDIT VACUUM▸ At least eight Americans have been wrongfully arrested after a facial recognition match; seven of the eight are Black. In every documented case, police skipped basic investigative steps like checking an alibi or comparing fingerprints. Internal records from 23 police departments show that 15 of them, across 12 states, made arrests based on an AI match with no independent evidence connecting the person to the crime. No federal law requires the systems that generated those matches to be audited, bias-tested, or explained to the people they misidentify.
◇ The Washington Post, "Arrested by AI: Police ignore standards after facial recognition matches," January 2025 ↗
STATUS :: CONSENT THEATER▸ 73% of Americans believe they have little to no control over what companies do with their personal data, 56% report they routinely click "agree" on privacy policies without reading them, and 72% favor increased federal regulation of corporate data practices. That majority holds across both parties.
◇ Pew Research Center, "How Americans View Data Privacy," October 2023 (n=5,101 U.S. adults) ↗
STATUS :: PATCHWORK PENALTY▸ In the absence of a federal privacy floor, 19 states had enacted their own comprehensive consumer privacy laws by end of 2024, with 40 or more states and territories considering over 350 additional privacy bills in a single legislative year. Each carries different thresholds, exemptions, and enforcement mechanisms that no single federal standard applies.
◇ National Conference of State Legislatures, "2024 Consumer Data Privacy Legislation," updated February 2025 ↗
STATUS :: INCIDENT CURVE▸ Documented AI incidents rose to 362 in 2025, up from 233 in 2024, which was itself a 56% jump over the year before. Those counts come from a volunteer-run database, because no government keeps one. The systems are deployed at population scale; the record of what goes wrong is maintained by people doing it in their spare time.
◇ Stanford HAI, "AI Index Report 2026" (Responsible AI chapter, citing the AI Incident Database), April 2026 ↗
STATUS :: DESIGNED FOR 2 A.M.▸ Up to 95% of teens age 13 to 17 use social media, and about a third say they use it almost constantly. Teens who spend more than three hours a day on it face double the risk of poor mental health outcomes, including symptoms of depression and anxiety. No federal design standard applies to any of it.
◇ US Surgeon General's Advisory, "Social Media and Youth Mental Health," May 2023 ↗