The right to repair won. After a decade of bills dying in committee, the movement broke through: eight states have now enacted electronics repair statutes, and by one industry count coverage reached about 26 percent of Americans on January 1, 2026, rising above 35 percent once the Texas law takes effect in September. Connecticut’s took effect July 1. That is a genuine, hard-fought policy victory.
And yet if you walk into a repair shop today with a cracked phone, the technician may still tell you the part they installed will throw a warning, lose a feature, or refuse to work at all. Not because they lack the part. Because the device decided the part is not the right part. The laws made the components available. They did not, in every state, make the software let you use them — and that gap is where the entire next phase of this fight is being waged.
The lock that survived the law
The mechanism is called parts pairing, and it deserves to be understood clearly because it is the single most effective tool ever devised for defeating a repair mandate without technically violating one. A manufacturer assigns each component a serial identity tied to the specific device it shipped in. Swap in a genuine, identical, brand-new part, and the software notices the serial does not match. The screen works but loses true-tone color. The battery works but stops reporting health. The camera works until it doesn’t. Nothing was withheld. The repair was simply made worthless from the inside.
This is why the sophisticated version of repair legislation stopped focusing on parts availability and started targeting software behavior. Oregon went first, and its law is the current high-water mark: it classifies deceptive parts-pairing alerts as a prohibited unfair trade practice. Colorado followed the same approach. But New York’s and California’s laws — the two most famous, covering the largest populations — are silent on software verification gates, a gap critics argue manufacturers have quietly exploited. Two states can have “a right to repair law” and mean substantially different things by it.
Why a patchwork beat a federal law
Here is the part that makes this story more interesting than a legislative scorecard, and it runs against the usual assumption that a messy state-by-state patchwork is a weaker outcome than one clean federal statute. In this case the patchwork may be doing more work than a federal law would have.
The reason is manufacturing reality. Nobody builds a Colorado-specific laptop. When a company sells one product line nationally, the most restrictive applicable state standard effectively becomes the national floor for that product class. Oregon has roughly one percent of the U.S. population, but if complying with Oregon means shipping firmware that does not punish third-party parts, that firmware ships to all fifty states. A small state with a strict rule can set policy for the whole country, not because it has power, but because segmentation costs more than compliance.
This is the same dynamic that let California set national emissions standards for decades, and it explains why the industry fought these individual state bills so much harder than their population numbers seemed to justify. Manufacturers understood something the coverage percentages obscure: in a national market, the strictest law is the only law that matters.
The escape hatch nobody’s watching
Which brings us to the thing that should worry repair advocates more than any remaining unpassed bill: the cybersecurity carve-out. Nearly every one of these laws exempts materials that could compromise device security — a reasonable-sounding provision that is also, potentially, a door left ajar. Minnesota’s law exempts parts, documentation, and tools related to cybersecurity, and the advocacy group SecuRepairs has argued that the language is overbroad and could let manufacturers invoke security to block access to ordinary repair materials. Colorado wrote a narrower version. How regulators and courts read those carve-outs will shape enforcement far more than how many additional states pass bills.
Notice the pattern, because we have seen it before in this exact shape. When a company wants to restrict something users want, “security” is the argument that is hardest to refute and easiest to assert. It may be entirely sincere — device security is a real concern and repair access genuinely does create some attack surface. But an exemption that a manufacturer gets to invoke on its own judgment, in a law enforced only when someone notices and complains, is a very different thing from a rule.
What comes next, and what to actually expect
The 2026 model legislation shows advocates have learned exactly this lesson. The updated template expands the parts-pairing prohibition to clarify that manufacturers may not use software-based restrictions to limit access to parts or tools, or to control who may perform repairs — language written specifically to close the gap between “you may buy the part” and “the part will function.” Enforcement still runs primarily through state attorneys general under unfair-and-deceptive-practices statutes, with real teeth where it applies: in Colorado, a violation can carry a civil penalty of up to $20,000 per violation.
But enforcement by attorney general is a thin reed to hang a consumer right on. AGs are busy, complaints are technical, and the violations are subtle by design — a feature quietly degraded after a screen swap does not generate headlines. The realistic expectation for the next two years is not dramatic enforcement actions. It is slow, uneven, product-by-product compliance, driven less by fear of penalties than by the sheer inconvenience of maintaining different behavior in different states.
So the honest verdict is that the right to repair has moved from a fight about law to a fight about implementation, and implementation fights are quieter, longer, and much easier to lose while appearing to win. The statutes on the books are real. Whether your specific device, in your specific state, actually lets a third-party part work at full function is a separate question with a separate answer — and the only reliable way to find out is still the oldest one: try to fix something and see what the software says.
Related reading: Chrome Broke Ad Blockers and AI Answers Broke Traffic. It’s the Same Story.
