The clearest verdict on artificial intelligence in Tuesday’s midterm elections did not come from a Senate race. It came from town halls, township ballots and county referendums, where voters were asked directly whether they wanted more data centers built near them. In 40 of the 41 local measures on the ballot across 10 states, they sided against the facilities, according to a CNBC tally built on Ballotpedia data. At the top of state tickets, governors and legislators who promised to slow the AI buildout and put guardrails on the technology won in places that had spent years courting the industry with tax breaks.
Most of the coverage has focused on what a Democratic Congress might do in January. For companies that handle personal data or deploy AI, the statehouse result may matter sooner. State legislatures are where most U.S. privacy and AI law has been written for the past five years, and several of the new governors take office with explicit promises on data centers, utility costs and AI safety. The 2027 sessions open in a few weeks, and a stack of state laws already on the books takes effect on January 1.
What happened on the local ballots
Ballotpedia counted 41 local ballot measures related to data centers in California, Florida, Illinois, Kansas, Maine, New Jersey, Nevada, North Dakota, Ohio and Wisconsin. Ohio alone had 21. The measures took different forms: outright bans on large facilities, temporary moratoriums, zoning limits and added review for big industrial projects. The single result that went the industry’s way was in Harwood, North Dakota, where voters rejected an added review of industrial projects that would have covered data centers.
A few results show the range:
- Ohio. At least 14 municipalities passed bans or restrictions, The Guardian reported, including Sunbury, where Amazon has proposed a $2 billion data center project.
- Maine. Eight municipalities approved temporary data center moratoriums.
- Kansas. Voters in Emporia, where a 1,000-acre, gigawatt-scale data center was recently proposed, approved a ban on high-impact data centers.
Two caveats apply. Counts published on Wednesday were based on partial and unofficial returns, and early tallies varied; one initial Ballotpedia estimate reported by Axios put the number of restrictive measures that had passed at about two dozen, with votes in some places still outstanding. Local measures are also narrow by design. A township moratorium can stall a single project for a year, but it does not regulate how AI systems use personal data. What the results do is tell state officials that slowing or taxing the buildout is popular, and that changes the bargaining position of everyone who wants something from the next legislative session.
The governors who ran against the buildout
The biggest statewide result came in Texas, which is expected to see more data center growth than any other state over the next several years. Democrat Gina Hinojosa unseated Gov. Greg Abbott after blaming him for the speed of the buildout. During the campaign she promised an “immediate moratorium on data centers” until the state passes stronger protections for residents, and Axios reported that she framed the pause as lasting until lawmakers address water, electricity, air and property rights in the 2027 session, which ends in mid-2027.
In Ohio, Democrat Amy Acton defeated Republican Vivek Ramaswamy for governor. She has backed a “conditional moratorium” that would require data centers to cover 100% of their utility costs and build exclusively with union labor. In Georgia, Governor-elect Keisha Lance Bottoms has also pledged a moratorium on large data center construction. How any of these pledges become policy is not settled. A governor can direct state agencies on permitting and set the legislative agenda, but a statewide moratorium of the kind described on the campaign trail would almost certainly need legislation, and Axios noted it is not yet clear how the Ohio and Georgia plans will take shape.
The shift is not purely partisan. Florida Gov. Ron DeSantis, a Republican, signed a bill in May imposing strict rules on large-scale data centers, and Abbott himself called late in his term for an end to electricity subsidies for the facilities. In a CNBC Voter Poll, 56% of voters said data centers were a crucial or major factor in their decision.
Why a power plant fight becomes a privacy and AI fight
Data center politics and data protection law look like separate subjects. In state capitols they tend to travel together. The candidates who won on data center skepticism generally paired it with promises on AI safety, children’s use of chatbots and corporate accountability, and the coalitions behind them are the same ones that push privacy bills. New York Assemblymember Alex Bores, the author of that state’s RAISE Act on frontier AI safety, told Axios that AI had made its “official debut” as the biggest issue in American politics.
There is also a federal backdrop. Axios reported that Democratic groups ran ads against Republican House incumbents over a 2025 vote for a measure that would have blocked state AI laws. The Senate stripped that moratorium before final passage, but preemption has stayed on the table in Washington. Tuesday’s results make it harder to argue that voters want states to step aside, and they give state lawmakers political cover to keep writing their own rules even as the debate over state AI regulation continues in Congress.
Five state rules already scheduled for 2027
Whatever the new legislatures do, several obligations are already fixed. Teams planning for next year should start with what is enacted rather than what is promised:
- Colorado’s rewritten AI law. Senate Bill 26-189, signed on May 14, 2026, replaced the original Colorado AI Act with a narrower framework for automated decision-making technology that materially influences consequential decisions in areas such as employment, lending, housing, insurance and health care. It takes effect on January 1, 2027, according to a Mayer Brown summary of the law. Deployers owe consumers a pre-use notice and, after an adverse outcome, a notice within 30 days with information on correction and human review. Impact assessments and the risk-management policy from the earlier version are gone. Enforcement is by the attorney general only, with a 60-day cure period that sunsets in 2030. The revision of Colorado’s AI law is a useful template for what a negotiated state AI statute now looks like.
- California’s chatbot laws. SB 1119 requires operators of companion chatbots to perform and document a risk assessment before offering a new or substantially modified product to California users, with most requirements in force on January 1, 2027. AB 1609 requires businesses with more than $500 million in annual revenue to disclose when a customer service chatbot is not human and to offer a route to a live agent. Other states have been moving on the same front, as state chatbot rules spread through 2026.
- California’s deletion expansion. SB 923 extends the CCPA deletion right to personal information a business obtained from sources other than the consumer, and requires online-only businesses to accept deletion requests by both email and web form. The change to the CCPA deletion right reaches data broker feeds, enrichment vendors and purchased lists.
- Delaware’s tougher thresholds. HB 380 lowers the applicability threshold to businesses processing data of more than 10,000 Delaware consumers, adds third-party due diligence and contract terms, adds profiling and risk assessment provisions, and expands sensitive data to include neural data. The Delaware amendments take effect January 1, 2027.
- New comprehensive laws. Comprehensive privacy laws in Oklahoma, Alabama, Louisiana and Vermont are scheduled to take effect during 2027, according to BakerHostetler’s quarterly tracker. Effective dates differ by state, so check each statute rather than assuming January 1.
Texas deserves separate attention. The Texas Responsible AI Governance Act has been in force since January 1, 2026, and the legislature that convenes in January will be working with a governor who campaigned on pausing the industry. Data center siting, energy costs and AI accountability are likely to be negotiated in the same session.
What privacy and AI teams should do before January
None of this requires guessing which bills will pass. It requires knowing where your own data and models sit:
- Map automated decisions by state. List every system that scores, ranks or recommends in hiring, credit, housing, insurance, health care or education, and note which state residents it touches. Colorado’s notice and adverse-outcome duties attach to use, not to where the vendor is based.
- Inventory chatbots by purpose. Separate customer service bots from anything that could be read as a companion product. The California rules treat them differently, and a misclassification is expensive to unwind.
- Trace third-party data. For SB 923, deletion now has to reach data you bought or inferred. A closed deletion ticket is not proof that a vendor or downstream recipient actually removed the record.
- Ask infrastructure questions. If your AI roadmap depends on new capacity in Texas, Ohio or Georgia, ask providers how a state moratorium, local ban or utility cost rule would affect timelines and data residency commitments.
Frequently asked questions
Did the ballot measures regulate AI itself?
No. The local measures dealt with land use, zoning and construction of data centers. They do not govern how AI systems process personal data. Their influence is political: they signal to state lawmakers that limits on the buildout are popular.
Can a governor impose a statewide data center moratorium alone?
It depends on the state. Governors can direct agencies that issue permits and can push legislation, but a broad moratorium would usually need a statute. The Texas, Ohio and Georgia pledges have not yet been turned into specific proposals.
Which AI and privacy obligations are certain for 2027?
Enacted laws with 2027 effective dates include Colorado SB 26-189, California SB 1119, AB 1609 and SB 923, Delaware HB 380, and new comprehensive privacy laws in several states. Proposals from new governors and legislators are not law until passed and signed.
Does a Democratic Congress change the state picture?
Probably not in the short term. Federal preemption of state AI laws becomes harder to pass, and without a veto-proof majority, sweeping federal AI legislation faces a likely veto. That leaves states as the main source of new rules.
The bill comes due in Austin
For years, the price of a data center campus was a tax abatement and a fast permit. Voters have now said the price should include the power bill, the water and some say over what gets built. The open question for 2027 is whether the same legislators who will rewrite the siting rules also decide that the companies filling those buildings with servers owe residents more on how their data is used. The first test arrives in January, when Texas lawmakers sit down with a governor who promised to hit pause.
