The Federal privacy bill might be a sheep in wolf’s clothing

The preemption battle

The Federal privacy bill has a preemption problem. Namely, the American Data Privacy and Protection Act aims to set a national standard for privacy by superseding the existing patchwork of state laws.

• The latest draft of the ADPPA says in no uncertain terms that no state can adopt, maintain or enforce any topics that are covered under the potential federal legislation.
• The bill makes a few explicit carve-outs for existing state legislation, including the Biometric Information Privacy Act, the Genetic Information Privacy Act and the California private right of action for a negligent privacy breach.
• Everything else from the states would be voided, including any potential future laws that aim to build on the ADPPA.
• So the federal privacy law could effectively cap the strength of online privacy laws across the U.S. until and unless Congress decides to direct its attention to privacy again — and that seems to occur every few decades, if we’re lucky.

By overriding state laws, the ADPPA could end up weakening online privacy overall. States have consistently offered the most dynamic legislative privacy protections in response to emerging technologies. California in particular has been a leader since the early ‘00s. In 2018 it passed the landmark Consumer Privacy Act , which gave residents privacy protections far exceeding those offered at the federal level. Colorado, Connecticut, Virginia, Utah and Nevada have all passed similar privacy laws since then. California then strengthened its privacy laws with the California Privacy Rights Act, which is set to go into effect in 2023 (that is, if it isn’t preempted by the ADPPA).

• The effects of these state privacy laws can be felt across the U.S., since companies such as Microsoft elected to comply across the board with the strongest standards rather than tailoring products for states with weaker regulations.

The future-looking preemption is particularly dangerous. Privacy laws need to keep up with technological innovations, and preemption shifts legislative duties from more dynamic state legislatures to the decidedly more sluggish Congress.

• In July, a group of 10 state attorneys general representing the likes of California, Massachusetts and New York sent a letter to Congressional leaders expressing their concerns over the ADPPA. The AGs warned, “a federal legal framework for privacy protections must allow flexibility to keep pace with technology; this is best accomplished by federal legislation that respects — and does not preempt — more rigorous and protective state laws.”
• “I’m worried that if a law passes, then the law will be frozen in time, effectively, if it broadly preempts the states from responding to new threats,” Justin Brookman, director of technology policy at Consumer Reports, told Protocol.

A federal standard has merits: Simplicity is the most obvious benefit. Patchwork regulation can also disproportionately burden smaller companies, as they often lack compliance resources. And if companies continue to adopt the most rigorous state privacy regulations and apply them nationwide, then a handful of the most progressive states will effectively decide the rules for everyone else. Texans probably don’t want their de facto privacy laws being written by Californians.

• Brookman pointed out that only a handful of states have passed online privacy bills — and they’re of varying quality. “It would be a big win for consumers if there was a strong federal privacy law that offered real protections,” he said.
• “There’s some willingness among consumer groups to stomach preemption if the underlying bill is actually strong enough,” Brookman added. The first few versions of the federal bill contained loopholes and vague language, but the version that came out of the Energy and Commerce committee was stronger, he added.

The preemption process isn’t simple. More progressive states would likely push back against preemption rules that try to overwrite their laws. This is especially true if the overlap isn’t obvious, as might be the case with the California Age Appropriate Design Code , which tackles user interface design as much as privacy.

• “Those issues will take a long time to resolve, because they’ll require a court process,” Matt Perault, Facebook’s former director of public policy and a professor at UNC's School of Information and Library Science, told Protocol.
• That resolution period will create uncertainty about individual privacy rights and corporate compliance requirements, Perault added.

And we still don’t even know if the ADPPA will pass. As recently as Aug. 11, Big Tech-backed NetChoice issued a statement professing enthusiastic support for “a comprehensive national standard for both privacy and data security.” That support may hinge in part on the preemption clause. Some California Democrats oppose preemption , while some House Republicans suggested any attempts to further exempt California privacy law would result in a “no” vote.

— Hirsh Chitkara ( email | twitter )

In Washington

A congressional committee is joining in on the crypto pile-on. In a series of letters sent yesterday, the House Committee on Oversight and Reform asked Coinbase, FTX, Binance.US and Kraken to provide information on the steps they take to protect users from fraud. The committee indicated the responses could help craft legislation.

Fight for the Future wants Big Tech out of our cars. The privacy group asked the Federal Trade Commission to put in place “a structural separation that prevents the ‘big four’ tech platforms from entering the auto industry and requires them to sell off their existing assets in the sector.” FTTF is particularly worried about privacy concerns that come with tech companies accessing all the data available from our cars.

In the states

California’s child privacy bill is up to Gov. Gavin Newsom now. The state legislature on Tuesday unanimously passed the California Age Appropriate Design Code , which requires online platforms to prioritize child well-being over profits. It includes stipulations such as requiring that children can opt out of algorithmic recommendations. Tech groups lobbied against the bill and are urging Newsom to not sign it into law.

Gov. Newsom will also need to decide on crypto licensing . The Digital Financial Assets Law , which the state legislature approved earlier this week, proposes that any companies involved in lending or trading cryptocurrencies must register with the California Department of Financial Protection and Innovation. The Blockchain Association said the bill would be “detrimental to California’s efforts to support innovation in the crypto and Web3 ecosystem throughout the state.”

Google isn’t letting Truth Social on Android. The tech giant says Truth Social violated the store’s standard policies and needs more effective content moderation before it can be distributed through Google Play. In an interview last week, Truth Social CEO Devin Nunes said Google “could approve it tomorrow and it would be live.”

Peter Thiel is reportedly negotiating with Sen. Mitch McConnell over campaign funding. Thiel and McConnell have been engaged in months-long negotiations over where the funding will come from for the Senate campaigns of Thiel-backed Republicans JD Vance and Blake Masters, Puck reports .

Sponsored content from DataRobot

DataRobot's AI Cloud for Financial Services Unlocks the Art of the Possible: DataRobot continues to attract clients in financial services who want to de-risk their AI investments and rapidly scale AI to almost every part of their operations, resulting in improved productivity and higher customer satisfaction.

Read more from DataRobot

In the courts

Elon Musk wants to amend his legal argument for terminating the Twitter deal in the wake of Peiter “Mudge” Zatko’s whistleblower claims . Musk’s lawyers asked the judge overseeing the case for permission to do so. Zatko is already set to be deposed on Sept. 9.

The FTC is suing rental platform Roomster. The lawsuit alleges Roomster paid for fake reviews and charged for access to fake listings. The attorneys general of New York, California, Colorado, Florida, Illinois and Massachusetts joined in the lawsuit.

In data

20%: That’s how much of its workforce Snapchat is laying off , as the company’s revenue growth has slowed amid changes to the mobile advertising landscape ( ahem, Apple ). Snapchat will discontinue projects such as original content and multiplayer games as part of its effort to cut costs by $500 million per year.

Sponsored content from DataRobot

DataRobot's AI Cloud for Financial Services Unlocks the Art of the Possible: Banks need to secure a competitive advantage in an increasingly tight race to harness best-in-breed technology. Decision makers need to not just plan a future-ready strategy, but also recognize the value of AI that could boost not just their performance in-house but also their reputation among their global customers.

Read more from DataRobot

How do you roll?

General Mills has been wrestling with the supply chain crisis, a problem made all the more complex by the fact that it uses around 13,000 ingredients for its assortment of food products, per The New York Times. One innovation to deal with the problem? Alternate recipes. So for Totino’s pizza rolls, for example, General Mills food scientists came up with 25 different recipes that allow for more flexibility in ingredients and sourcing.