The tech industry is lobbying statehouses across the country to pass privacy bills that critics call weak.
Why it matters: Most tech firms would prefer a nationwide law, but since Congress hasn't budged on the issue, the industry now seeks to preempt states from approving tougher privacy rules like California's.
- "The states are where this conversation has happened," Tom Foulkes, senior director of state advocacy for software industry trade group BSA, told Axios. "Absent action by Congress, the states will act and that's being proven every single day, especially here in 2022."
What's happening: Utah lawmakers considered and passed a state privacy bill in less than two weeks, and it's now awaiting the governor's signature.
- Utah would become the fourth state with a privacy law, following Colorado, Virginia and California.
- A bill similar to the Utah measure is under consideration in Iowa, and other states, including Tennessee and Maryland, are also weighing privacy bills.
The intrigue: Consumer advocates say industry groups TechNet and the State Privacy and Security Coalition (SPSC) are pushing weak privacy bills in states while Congress dithers.
- SPSC describes itself as a coalition of leading tech, telecom, media and retail companies. Members include AT&T, Apple, Google, Amazon and Meta.
- "I really want to be upfront about this and my hope that a Utah model could be copied in other states," Anton van Seventer, counsel to SPSC and a DLAPiper attorney, said during a Utah hearing on the bill.
- "It could serve as the most updated and streamlined model for state privacy legislation in the U.S. today."
In a statement to Axios, SPSC said, "Our multi-sector coalition provides substantive expertise to state policymakers, including context on the operational implications of policy proposals and how to help align state privacy laws given the absence of federal law.”
Details: The Utah bill is meant to give consumers greater control over their data, such as allowing them to delete the information or opt-out of some data collection.
Yes, but: Consumer groups say it's unclear how much control consumers would have over whether their information is used for targeted advertising, and the enforcement mechanism is weak.
- "It's not as strong as some of the consumer advocates would like, but I think getting something on the books is better than where they were," Republican state Sen. Kirk Cullimore told Axios, adding that while SPSC offered suggestions to his bill this year, it was in the works for two years.
Between the lines: Advocates say the industry groups are targeting red states where national consumer groups, such as Common Sense Media, don't have the relationships with lawmakers.
- "They know they can get these bills through without too much trouble because there's not as many advocates on the ground there to be able to really make some noise to try to argue against it," Common Sense policy counsel Irene Ly told Axios.
What they're saying: "What we’re seeing is this race to the bottom where industry is having a major influence on these bills," Consumer Reports senior policy analyst Maureen Mahoney told Axios.
- "They’re getting weaker and weaker to pass legislation over consumer groups' objections."
The other side: TechNet argues the Utah bill gives clear protections for consumers and gives Utah's businesses the clarity they need.
- More broadly, David Edmonson, TechNet vice president for state policy and government relations, said state laws should be interoperable and share key definitions to reduce compliance costs for companies.
- "In the absence of a federal standard, we're going to urge states debating their own legislation to really consider interoperability with existing statutes and models as the default position," Edmonson told Axios.
