Indiana, other states readying privacy bills as Washington stalls

As efforts to pass a federal data privacy law languish on Capitol Hill, state policymakers are forging ahead, with at least 15 states already introducing legislation in 2023 to expand protections for children’s privacy, biometric information and other types of data.

If passed, the measures could up the pressure on lawmakers in Washington who business leaders and consumer advocates have called on for years to step in and set a national standard.

Here is where things stand in state privacy efforts:

– At least nine states have introduced so-called comprehensive privacy bills, which broadly seek to set limits around what consumer data companies can collect and how they use it. They include Massachusetts, Iowa, Mississippi, Indiana, Oklahoma, Oregon, Tennessee, New York and Kentucky. Most of the bills have been reintroduced from prior sessions, but the new Oregon bill, which boasts sweeping consumer protections including a so-called private right of action, is poised to be a key litmus test.

– At least five states are considering proposals to increase protections for children’s data, including Connecticut, Oregon, West Virginia, Virginia and New Jersey. The Oregon and New Jersey bills mirror a recent California law that not only sets new privacy standards but requires that companies vet whether products may pose harm to kids. Children’s privacy advocates are hoping the proposals, modeled after rules in the United Kingdom, serve as a road map for legislators nationwide.

– At least seven states are weighing legislation targeting other subsets of data, such as the collection and use of health or biometric information or seeking to put limits on third-party data brokers. They include New York, Mississippi, Maryland, Oregon, New Jersey, Virginia and Washington. Some of the bills resemble Illinois’ biometric data law, while others appear aimed at addressing privacy concerns raised by the Supreme Court decision to overturn federal abortion rights under Roe v. Wade.

While states have beaten Congress to the punch in setting new consumer privacy standards, a vast majority of the country still lacks comprehensive protections.

Only five states to date have passed privacy laws covering a broad range of consumer data: California, Colorado, Connecticut, Utah and Virginia. Their combined estimated population, 60.5 million, accounts for less than 20 percent of the total estimated U.S. population.

A number of other states, however, have passed protections dealing more narrowly with biometric data or data brokers, including Maine, Nevada and Illinois.

“Each year we see comprehensive privacy bills run in 25 to 30 states, and ultimately, one or two of those state bills will make it over the finish line,” said Keir Lamont, senior counsel at the Future of Privacy Forum, a think tank that receives funding from companies including Apple, Microsoft and Amazon. (Amazon founder Jeff Bezos owns The Washington Post.)

Lamont said that so far, the number of introductions in 2023 is “pretty consistent with what we’ve seen in past legislative cycles,” but that it could still be a big year for state legislation on privacy.

Lamont argued that with some congressional leaders, particularly in the House, focusing on efforts to pass a comprehensive privacy bill, states might focus on more tailored proposals that may not directly conflict with a federal law down the line.

“We could see an upswing in proposals around specific privacy concerns, specific uses of data, specific technologies that wouldn’t necessarily be considered comprehensive privacy laws but would still have a major impact for consumer rights and the obligations for businesses,” he said.

Two likely areas of focus, he said, are around children’s privacy and concerns about access to reproductive health data, issues that have gained significant traction over the past year.

As states move ahead on privacy, Congress is facing fresh calls to act from the Biden administration.

In a rare op-ed last week in the Wall Street Journal, President Joe Biden urged Republican and Democratic lawmakers to “unite” to set “serious federal protections for Americans’ privacy,” including “clear limits on how companies can collect, use and share highly personal data,” heightened protections for “younger people,” and limits on targeted advertising.

Alan Davidson, Biden’s top adviser on telecommunications and information policy, voiced support for harmonizing privacy standards nationwide at an event Wednesday.

“Though some states have taken the lead on privacy protections, far too many in America lack baseline protections for their privacy and personal information,” he said. “A national standard is a much better way to operate. … Privacy rights shouldn’t change when you cross state lines.”