Digital sovereignty, in plain English

Governments use "digital sovereignty" to mean control over their own technology, data and online rules. A 2020 European Parliament research paper, for example, framed it as Europe keeping control of its data, its capacity to innovate and its ability to set and enforce digital rules.⁴

That debate is real, but it isn't our focus. We use the term at human scale: you, your family and your business staying in charge of your own data, identity and choices as more of daily life runs through artificial intelligence (AI) and cloud services.

None of this depends on your politics. Holding your own keys, keeping a copy of what matters and being able to walk away from a service are good habits for anyone.

Every AI assistant and cloud service keeps what you give it under its own terms. Those terms decide who at the company can see it, how long it's kept, and whether it helps train future AI models.

The defaults vary. ChatGPT's Free, Go, Plus and Pro plans share your chats for training unless you switch that off, while OpenAI, Google and Microsoft say their business plans keep your data out of training their general models by default.⁵⁶⁷⁸ Our explainer on who owns your AI conversations goes product by product.

An exit only counts if your data can come with you in a form another service can read. In the European Union (EU), the General Data Protection Regulation (GDPR) gives people the right to receive data they provided in a structured, machine-readable format and to have it sent straight to another provider where that's technically feasible.¹

In the US, your rights depend on your state. By the count of the International Association of Privacy Professionals (IAPP), 23 states had signed comprehensive privacy laws by September 2026.⁹ Nineteen were in effect by January 2026, and Oklahoma, Louisiana, Alabama and Vermont signed theirs in 2026 with start dates between January 2027 and January 2028.^2310111213

The states with laws in effect are California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island.² Details and thresholds differ, but recent laws such as Oklahoma's and Louisiana's follow a common pattern: you can see your data, correct it, delete it, get a portable copy, and opt out of targeted ads, data sales and some automated profiling.¹⁰¹¹

California's law, the oldest of them, requires businesses to answer requests to know, correct or delete within 45 days and to hand over your data in a machine-readable format where technically feasible.¹⁴

Businesses get exit rights too. In the EU, the Data Act has applied since September 12, 2025: cloud providers must remove obstacles to switching, and from January 12, 2027 they may not charge switching fees.¹⁵

Whoever controls the email address or phone number that resets your passwords effectively controls your accounts. Owning your keys means those recovery details are yours, current and protected.

Passkeys make the keys harder to steal. The National Institute of Standards and Technology (NIST) notes that properly set-up synced passkeys are tied to the real website, so a fake sign-in page can't capture and reuse them.¹⁶ Its 2025 guidelines for government systems also require services at the middle assurance level to offer at least one phishing-resistant sign-in option.¹⁶

Adoption is growing. In an April 2026 survey of 11,000 consumers in ten countries, conducted for the FIDO Alliance (the industry group behind passkeys), 75% said they had turned on a passkey for at least one account.¹⁷

Local-first means your data lives on your own device first and syncs to the cloud only when you choose. Some AI features now run directly on phones and laptops, and some openly released AI models can run on a capable home computer.

The trade-off is real. Models small enough to run locally are usually less capable than the big cloud services, and you take on the updates, backups and device security yourself.

A practical middle path: keep the most sensitive material, such as medical, legal, financial and client records, on your own devices or out of AI tools, and use cloud AI for the rest.

Sovereignty covers your likeness too. The federal TAKE IT DOWN Act, signed May 19, 2025, makes it a crime to publish non-consensual intimate images, including AI-generated ones.¹⁸ Since May 19, 2026, covered platforms must remove reported images within 48 hours, and the Federal Trade Commission (FTC) takes complaints about platforms that don't.¹⁹

States have acted as well: Ballotpedia's tracker counted 49 states with at least one deepfake law by July 2026.²⁰ Tennessee's ELVIS Act, in effect since July 1, 2024, added a person's voice to the name and likeness rights they can enforce in court.²¹

Voice cloning in robocalls falls under federal rules. In February 2024 the Federal Communications Commission (FCC) ruled that calls using AI-generated voices count as "artificial" voice calls under the Telephone Consumer Protection Act.²²

Data brokers build and sell profiles of people they've never met. California's free DROP (Delete Request and Opt-out Platform) lets residents send one deletion request to over 600 registered brokers, who have had to start processing those requests since August 1, 2026.²³ Texas also keeps a public registry of data brokers.²⁴

In California you can also opt out of the sale or sharing of your data through a browser setting called Global Privacy Control, according to the state attorney general.²⁵

This is a status check, not legal advice. Laws change, and how they apply depends on your situation.

EU AI Act: in force since August 1, 2024.²⁶ Bans on certain AI practices and a duty to build AI literacy have applied since February 2, 2025, and rules for general-purpose AI models since August 2, 2025.²⁶ Transparency rules, including labeling deepfakes and telling people when they're talking to an AI, apply from August 2, 2026 (generative AI already on the market before then has until December 2, 2026 to add machine-readable marking).²⁶²⁷

A July 2026 amendment, the Digital Omnibus on AI, moved the rules for high-risk AI (such as systems used in hiring or credit decisions) to December 2, 2027, and to August 2, 2028 for AI built into regulated products.²⁷ It also adds a ban on AI systems that generate non-consensual intimate images or child sexual abuse material from December 2, 2026, and softens the AI literacy duty to taking measures that support it, without requiring any set level.²⁷

The AI Act can reach a US business whose AI output is used in the EU, but it doesn't cover individuals using AI for purely personal reasons.²⁶

Still pending in the EU: a separate "Digital Omnibus" that would amend the GDPR, including how companies may use personal data to develop AI. EU governments agreed their negotiating position on October 21, 2026, and the text still needs agreement with the European Parliament.²⁸

Colorado: the 2024 Colorado AI Act was delayed to June 30, 2026, then repealed and replaced in May 2026 by a law on automated decision-making technology, with developer duties starting January 1, 2027 and rules from the attorney general due by then.²⁹³⁰ Under the new law, people can ask for the personal data used in a consequential decision, correct it, and request human review after an adverse outcome.³⁰

California: the AI Transparency Act, which requires large generative AI providers to offer free tools for checking whether images, video or audio came from their systems, has applied since August 2, 2026 under a 2025 amendment.³¹

• ThreatHomeBusiness

  AI chatbot data leaks and shadow AI

  Whatever you paste into an AI assistant can be stored, read by reviewers or used to train future models, depending on the app, the plan and your settings. In a 2025 survey of workers in 47 countries, 48% of those who use AI at work said they had uploaded sensitive company or customer information into public AI tools. The fix is mostly unglamorous: business accounts for work, the right settings at home, and a clear rule about what never goes in.

  Read
• ThreatHomeBusiness

  Voice cloning and deepfake scams

  Criminals can copy a voice from a short clip and fake faces on a video call, then use them to ask for money in a hurry. In 2025 the FBI logged 22,364 complaints that mentioned AI, with losses near $893 million, most of it in investment scams; voice-cloned 'distress' calls alone cost victims more than $5 million. The defense is low-tech: pause, hang up, and confirm through a number or channel you already trust.

  Read
• GuideHomeBusiness

  Lock down your AI assistants

  Each major AI assistant has a training setting, a memory setting, connected apps and a way to delete history, and the defaults favor the vendor. This guide walks through ChatGPT, Claude, Gemini, Microsoft Copilot and Meta AI one at a time, with notes for business accounts. Plan on about five minutes per assistant.

  Read
• GuideHome

  Digital hygiene at home: the household baseline

  A safe household runs on a few habits: one password manager, passkeys or multi-factor authentication (MFA) on the accounts that matter, automatic updates, and backups you've actually tested. AI adds one more: a family safe word and a callback rule, so a panicked call that sounds like family gets checked before anyone pays. People 60 and older reported $7.7 billion in losses to the FBI in 2025, so bring older relatives into the plan.

  Read
• GuideBusiness

  Digital hygiene for your business: the 1-50 person baseline

  A small business's security baseline fits on one page: passkeys or multi-factor authentication (MFA) on every account, email and banking first; a shared password manager; automatic updates and endpoint protection; and backups you've actually restored from. Add a second-channel check before any payment change, a one-page AI rule, same-day offboarding and a short incident plan. Business email compromise alone drew $3.05 billion in reported losses to the FBI in 2025.

  Read
• GuideBusiness

  A one-page AI use rule for your team

  Your team is probably using AI already, so the useful question is which tools, with what data, and who checks the result. This guide helps you write those answers on one page, get everyone to sign it, and review it twice a year. When you need more, our full AI Acceptable Use Policy generator uses the same structure and is free with a free account.

  Read
• ExplainerHomeBusiness

  Who owns your AI conversations?

  In practice, the company that runs the assistant holds your conversations, and its terms decide who can read them, whether they train future models and how long they're kept. Some consumer plans, including ChatGPT's, use your chats for training unless you switch it off, while the major business plans say they don't by default. You can usually export or delete your chats, but deleting doesn't undo training that already happened, and legal holds can override deletion.

  Read
• ExplainerHomeBusiness

  AI or SI? What we call it, and why

  We say AI, because it is the word most people know and prefer, across parties and age groups. When a federal notice says SI or super intelligence, read it as AI: for now, the government's own order defines the two as the same technology. We will switch if the law, major newsrooms or the public do.

  Read