How state attorneys general are driving tech policy