Digital Sovereignty Audit
Fifty states, one question, graded on a published rubric. If your data were taken from you tomorrow, what could you actually do about it?
Last verified · Rubric v1.1
If your data were taken from you tomorrow, sold, leaked, subpoenaed, or used in a way you never agreed to, what, in this state, could you actually do about it?
If the honest answer is nothing, the state does not have digital sovereignty. It has a privacy policy.
The spread, state by state
The best score is a .
leads the board with a .
Money is not sovereignty.
Texas has collected about $2.78B in privacy settlements, and no Texas resident has standing to sue. Enforcement dollars and citizen power are different things.
Having a law is not having a remedy.
Virginia, with a comprehensive statute and no publicly announced enforcement action found, outscores Illinois by two points, 33 to 31. Illinois has no comprehensive law and the strongest private remedy in the country, for biometrics only.
Accountability and Ownership carry the most weight. Accountability is the only pillar that can invalidate the others: a state can score well on the first four and still be worthless if nobody can sue.
Read the statute for its exemptions
The audit reads the law the way a lawyer for the other side would, starting with who it leaves out.
Score five pillars from criteria
Every pillar is 0 to 100, built from fixed criteria with fixed points. Laws are scored as enacted, never as pending.
Apply the penalty and the Reality Test
States with a comprehensive law lose points for exemptions. The Reality Test can cap a score the arithmetic flatters.
Publish the score and the forecast
Each entry ships with a 500-word article, a date stamp, and the pre-registered forecast next to the result.
Every entry carries a date stamp and a dated log of changes since the audit. A score changes only when an enacted, in-force change moves a rubric criterion, and the change is published here. The ruler stays frozen. The world is allowed to move.
The first audited state where a resident can personally sue over a data violation, if only for health data.
One state graded every week for fifty weeks, with the score, the article and the forecast published together. Free on Substack.
Subscribe