State governments are building the integrated data systems the Fourth Amendment was written to forbid, one procurement at a time. Three coordinated model acts let a legislature govern that power directly: they impose enforceable fiduciary duties on government's use of personal information and require systems built so that unnecessary power is unavailable, not merely unused.
A six-Justice majority held that acquiring cell-phone location data is a Fourth Amendment search, rejected durational thresholds, and warned that government "possesses a virtual panopticon." The Court located the danger in the capability itself. It then remanded on particularity and probable cause, because courts decide cases; they cannot redesign the systems that make the panopticon possible.
SB 260 (2025) set the principles for state-endorsed digital identity: individual control, anti-surveillance protections and selective disclosure. SB 275 (2026), passed unanimously, created the State-Endorsed Digital Identity program, a digital identity bill of rights and the first statutory duty of loyalty for digital identity. Both incorporate elements of VIDA and PDTA.
Each act addresses a distinct layer. They are drafted to reinforce one another, and the protection is strongest when all three are enacted together. Current texts are Version 2.2. They are model legislation, not enacted law.
Governs identity architecture. Requires holder-controlled credentials and privacy-preserving verification, and prohibits centralized identity repositories and surveillance-capable designs.
In plain termsGovernment confirms the fact it needs and keeps no file on everything else.
Governs the relationship. Establishes the individual as primary trustee and imposes the duties of loyalty, care, confidentiality and transparency on government actors, with purpose sequestration and a private right of action.
In plain termsGovernment handles personal data the way a lawyer handles client confidences, and a citizen can enforce that in court.
Governs computational power. Extends the same duties to AI, inference and automated decisions, with tiered governance, pre-deployment assessment and a right to explanation.
In plain termsAI inherits government's authority. It never creates new authority.
Companion acts apply the same architecture to narrower problems: the Vehicle Location Privacy and Fiduciary Accountability Act (license plate readers, query-without-collection) and the Commercial Surveillance and Digital Likeness Protection Act.
A state that has enacted SEDI-model identity legislation has already built much of VIDA's foundation. Compare the configurations in detail.
The acts implement an argument developed across six articles. Each is available on SSRN.
Drafting, testimony and briefings. Michael G. Leahy, JD, former Maryland Secretary of Information Technology and past President of NASCIO, is available to legislators and staff for drafting assistance, committee testimony and briefings. Write to legislative@fiduciarycommons.com.