State privacy laws are being written by tech companies to minimize protections

Some state privacy laws use wording written by tech companies and their lobbyists, says a new report today. A formerly Apple-backed lobbying group has previously been cited as pushing for weaker privacy protection based on this wording.

Tech giants are aiming to push through weak privacy legislation in order to fend off more meaningful requirements, with one state senator admitting that the text of a privacy bill he put forward was supplied by a tech lobbyist …

Background

Surveys show that both citizens and tech giants alike favour a single federal privacy law along the lines of Europe’s GDPR. Citizens because it would ensure that everyone benefits from the same rights. Tech giants because it’s very much easier to comply with one law than 50 different ones.

However, Congress is divided on the issue of how far such legislation should go, with efforts currently stalled. The result is that individual states are passing their own laws, of varying strength.

California led the way with a strong privacy law along the lines of Europe’s GDPR. However, legislation drafted by other states has varied in its effectiveness.

Tech lobbying group State Privacy and Security Coalition (SPSC) – whose members included Apple until it dropped out last month – is promoting weak wording to multiple states.

Tech lobbying on state privacy laws

TNW reports that one state senator unashamedly put forward legislation suggested by a tech lobbyist.

In late 2019, Utah state senator Kirk Cullimore got a phone call from one of his constituents, a lawyer who represented technology companies in California.

“He said, ‘I want to make this easy so consumers can make use of their rights and the compliance is also easy for companies. He actually sent me some suggested language [for a bill] that was not very complex,”  Cullimore told The Markup. “I introduced the bill as that.”

Indeed, even when Cullimore proposed some alternative language after push-back, he worked with the SPSC to redraft it.

When Cullimore introduced substitute language to his bill during a February hearing, he did so with the help of Anton van Seventer, a lobbyist for the State Privacy and Security Coalition.

Tech giants have created a variety of neutral-sounding lobbying groups to promote the weak legislation put forward in Utah.

Not just in Utah, but in Virginia and Washington, and Minnesota, tech companies have provided draft language that led to the introduction of industry-friendly privacy bills, according to legislators The Markup interviewed and previous reporting by Protocol.

Big Tech funded nonprofits like TechNet, the State Privacy and Security Coalition, and the Internet Association have traveled from state to state encouraging legislators to “mirror” those industry-authored bills. TechNet representatives, for example, have testified or supplied written comments on privacy bills in at least 10 states since 2021, more than any other organization, according to our analysis of state legislative records.

And lobbyists have come in droves: We counted 445 lobbyists and lobbying firms that actively represented Amazon, Apple, Google, Meta, Microsoft, TechNet, and the State Privacy and Security Coalition in the 31 states we examined, during the time those states’ legislatures were considering privacy legislation. Many of them registered as lobbyists for the first time in the weeks immediately before or after a privacy bill was introduced

Some have accused Apple of hypocrisy, by simultaneously pushing privacy as a marketing tool while also supporting a group lobbying for very weak privacy legislation.

Updated to reflect that Apple left the SPSC last month.

Photo: Thomas Lefebvre/Unsplash