Big Tech lobbyists and political donations are nixing privacy reforms across the US, reforms aimed to regulate the commercial use of personal data and provide more protection for citizens. Australia, beware. Todd Feathers reports.
A consumer data privacy law in Virginia, originally authored by Amazon with input from Microsoft and passed swiftly last month, is emblematic of an industry-driven, lobbying-fuelled approach taking hold across the US.
The Markup reviewed existing and proposed legislation, committee testimony, and lobbying records in more than 20 states and identified 14 states with privacy bills built upon the same industry-backed framework as Virginia’s, or with weaker models. The bills are backed by a who’s who of Big Tech–funded interest groups and are being shepherded through state houses by waves of company lobbyists.
Meanwhile, the small handful of bills that have not adhered to two key industry demands — that companies can’t be sued for violations and consumers would have to opt out of rather than into tracking — have quickly died in committee or been rewritten.
California’s ‘global opt out’
Experts say Big Tech’s push to pass friendly privacy bills ramped up after California enacted sweeping privacy bills in 2018 and 2020. The ultimate goal is to prompt federal legislation that would potentially override California’s privacy protections.
California’s laws create a “global opt out”. Rather than every website requiring users to go through separate opt-out processes, residents can use internet browsers and extensions that automatically notify every website that a user wishes to opt out of the sale of their personal data or the use of it for targeted advertising — and companies must comply. The laws also allow consumers to sue companies for violations of security requirements.
Amazon did not respond to requests for comment, and Microsoft declined to answer specific questions on the record.
Industry groups, however, were not shy about their support for the Virginia law and copycats around the country.
The Internet Association, an industry group that represents Big Tech, wrote in a statement that the Virginia law is a “business and consumer friendly approach” that other states considering privacy legislation should align with,
While tech lobbyists have criticized the state-by-state approach of making privacy legislation, they are at the same time taking a hands-on approach to shape state legislation.
Mostly, industry has advocated for two provisions:
- an opt-out approach to the sale of personal data or using it for targeted advertising, which means that tracking is on by default unless the customer finds a way to opt out of it. Consumer advocates prefer privacy to be the default setting, with users given the freedom to opt in to certain uses of their data; and
- preventing a private right of action, which would allow consumers to sue for violations of the laws.
The industry claims such privacy protections are too extreme.
Through lobbying records, recordings of public testimony, and interviews with lawmakers, The Markup found direct links between industry lobbying efforts and the proliferation of tech-friendly provisions in Connecticut, Florida, Oklahoma, and Washington. And in Texas, industry pressure has shaped an even weaker bill.
Protocol has previously documented similar efforts in Arizona, Hawaii, Illinois, and Minnesota.
The Markup found a handful of states — particularly North Dakota and Oklahoma — in which tech lobbyists have stepped in to thwart efforts to enact stricter laws.
Well funded, well heeled
The path of Connecticut’s bill is illustrative of how these battles have played out. There, state Senate majority leader Bob Duff introduced a privacy bill in 2020 that contained a private right of action. During the bill’s public hearing last February, Duff said he looked out on a room “literally filled with every single lobbyist I’ve ever known in Hartford, hired by companies to defeat the bill”.
The legislation failed. Duff introduced a new version of it in 2021, and it too died in committee following testimony from interest groups funded by Big Tech, including the Internet Association and The Software Alliance.
“It’s an uphill battle because you’re fighting a lot of forces on many fronts,” Duff said.
“They’re well funded, they’re well heeled, and they just hire a lot of lobbyists to defeat legislation for the simple reason that there’s a lot of money in online data.”
Google has spent $100,000 lobbying in Connecticut since 2019, when Duff first introduced a consumer data privacy bill. Apple and Microsoft have each spent $124,000, Amazon has spent $116,000, and Facebook has spent $155,000, according to the state’s lobbyist reporting database.
Microsoft declined to answer questions and instead emailed links to the testimony its company officials gave in Virginia and Washington.
Google declined to respond to questions about their lobbying. Apple and Amazon did not respond to requests for comment.
Campaigning against tougher bills
In North Dakota, lawmakers in January introduced a consumer data privacy bill that a coalition of advertising organizations called “the most restrictive privacy law in the United States”. It would have included an opt-in framework, a private right of action, and broad definitions of the kind of data and practices subject to the law.
It failed 75–19 shortly after a public hearing in which only AT&T, data broker RELX, and industry groups like The Internet Association, TechNet, and the State Privacy and Security Coalition showed up to testify — all in opposition. And while the big tech companies didn’t directly testify on the bill, lobbying records suggest they exerted influence in other ways.
The 2020–2021 lobbyist filing period in North Dakota marked the first time Amazon has registered a lobbyist in the state since 2018 and the first time Apple and Google have registered lobbyists since the state began publishing lobbying disclosures in 2016, according to state lobbying records.
A Mississippi bill containing a private right of action met a similar fate.
This is an edited version of an article that was first published on The Markup.
Todd Feathers is a reporter based in New York. He writes about surveillance, algorithmic bias, and the intersection of technology and human rights.