Which always struck me as a nice idea in theory but of limited use if people can just avoid state-based laws by moving interstate or even registering businesses

Which always struck me as a nice idea in theory but of limited use if people can just avoid state-based laws by moving interstate or even registering businesses interstate. In this case however it makes perfect sense to trial it at a state level. Though I'd assume federal government agencies, especially those that deal with particularly sensitive data, would already have strong restrictions on what can be installed on government devices anyway.