If passed, the measures could up the pressure on lawmakers in Washington who business leaders and consumer advocates have called on for years to step in and set a national standard.
Here is where things stand in state privacy efforts as of this week:
- At least nine states have introduced so-called comprehensive privacy bills, which broadly seek to set limits around what consumer data companies can collect and how they use it. They include Massachusetts, Iowa, Mississippi, Indiana, Oklahoma, Oregon, Tennessee, New York and Kentucky. Most of the bills have been reintroduced from prior sessions, but the new Oregon bill, which boasts sweeping consumer protections including a so-called private right of action, is poised to be a key litmus test.
- At least five states are considering proposals to increase protections for children’s data, including Connecticut, Oregon, West Virginia, Virginia and New Jersey. The Oregon and New Jersey bills mirror a recent California law that not only sets new privacy standards but requires that companies vet whether products may pose harm to kids. Children’s privacy advocates are hoping the proposals, modeled after rules in the United Kingdom, serve as a road map for legislators nationwide.
- At least seven states are weighing legislation targeting other subsets of data, such as the collection and use of health or biometric information, or seeking to put limits on third-party data brokers. They include New York, Mississippi, Maryland, Oregon, New Jersey, Virginia and Washington. Some of the bills resemble Illinois’ biometric data law, while others appear aimed at addressing privacy concerns raised by the Supreme Court decision to overturn federal abortion rights under Roe v. Wade.
While states have beaten Congress to the punch in setting new consumer privacy standards, a vast majority of the country still lacks comprehensive protections.
Only five states to date have passed privacy laws covering a broad range of consumer data: California, Colorado, Connecticut, Utah and Virginia. Their combined estimated population, 60.5 million, accounts for less than 20 percent of the total estimated U.S. population.
A number of other states, however, have passed protections dealing more narrowly with biometric data or data brokers, including Maine, Nevada and Illinois.
“Each year we see comprehensive privacy bills run in 25 to 30 states, and ultimately, one or two of those state bills will make it over the finish line,” said Keir Lamont, senior counsel at the Future of Privacy Forum, a think tank that receives funding from companies including Apple, Microsoft and Amazon. (Amazon founder Jeff Bezos owns The Washington Post.)
Lamont said that so far, the number of introductions in 2023 is “pretty consistent with what we’ve seen in past legislative cycles,” but that it could still be a big year for state legislation on privacy.
Lamont argued that with some congressional leaders, particularly in the House, focusing on efforts to pass a comprehensive privacy bill, states might focus on more tailored proposals that may not directly conflict with a federal law down the line.
“We could see an upswing in proposals around specific privacy concerns, specific uses of data, specific technologies that wouldn’t necessarily be considered comprehensive privacy laws, but would still have a major impact for consumer rights and the obligations for businesses,” he said.
Two likely areas of focus, he said, are around children’s privacy and concerns about access to reproductive health data, issues that have gained significant traction over the past year.
As states move ahead on privacy, Congress is facing fresh calls to act from the Biden administration.
In a rare op-ed last week in the Wall Street Journal, President Biden urged Republican and Democratic lawmakers to “unite” to set “serious federal protections for Americans’ privacy,” including “clear limits on how companies can collect, use and share highly personal data,” heightened protections for “younger people,” and limits on targeted advertising.
Alan Davidson, Biden’s top adviser on telecommunications and information policy, voiced support for harmonizing privacy standards nationwide at an event Wednesday.
“Though some states have taken the lead on privacy protections, far too many in America lack baseline protections for their privacy and personal information,” he said. “A national standard is a much better way to operate. … Privacy rights shouldn’t change when you cross state lines.”
TikTok bans on state devices are groupthink, experts say
At least 28 states have banned TikTok on government devices, but state officials and federal officials haven’t offered evidence for their claims that TikTok poses a significant threat to Americans, Drew Harwell reports. A recent wave of bans kicked off after South Dakota Gov. Kristi L. Noem (R) issued an executive order and shared it with the Republican Governors Association. Some of the states’ orders closely resembled other states’ bans, and Oklahoma’s was almost identical to South Dakota’s.
“In any case, the bans suggest officials are trying to pull TikTok into the center of a culture war over what has become one of the most popular and influential social media platforms in America,” Drew writes. “Some tech experts argue that the sudden explosion of the bans, coupled with doubts over TikTok’s actual harm, is more a reflection of government groupthink — and an overreaction to an app they don’t entirely understand.”
Amazon shuts down its AmazonSmile charitable-giving arm
The company says it will suspend its AmazonSmile program on Feb. 20 and give participating charities a donation of around a quarter of what they received last year, Julian Mark and Jeremy B. Merrill report. The program distributed hundreds of millions of dollars to nonprofits over the years by donating around a half-percent from every participating Amazon purchase to customers’ charity of choice.
The announcement that the program would be ending came after Amazon said it planned to cut 18,000 jobs. (Amazon founder Jeff Bezos owns The Washington Post.)
Since it was launched, “the program has not grown to create the impact that we had originally hoped,” Amazon said. The company will still “pursue and invest in other areas where we’ve seen we can make meaningful change” like affordable housing, education and food-assistance programs, it said.
New rules forbid developers from creating third-party Twitter clients
The ban comes nearly a week after Twitter cut off third-party clients’ access to the platform’s data, the Verge’s Mitchell Clark reports. On Tuesday, Twitter said it was “enforcing its long-standing API rules,” which “may result in some apps not working,” but longtime developers said they hadn’t been told which rules they were supposedly breaking.
“Twitter has been struggling financially since [Elon] Musk took over, saddling it with billions in debt, and third-party clients don’t earn it any money,” Clark writes. “The company doesn’t serve ads via its API, and people using third-party clients may not be as interested in the Twitter Blue subscription service, which mainly adds features to the official Twitter app.”
