The private sector is making a calculated move here after reckoning with the fact that there’s popular momentum for federal privacy legislation following revelations of Cambridge Analytica’s misuse of Facebook data. Companies know that many states have mustered the political will to pass strong privacy protections that address consumer concerns. And they know that Congress is so paralyzed by gridlock that it has been unable to act even where there is overwhelming bipartisan agreement. So many see here an opportunity to try to enact weak federal protections and kneecap state privacy efforts in the process.
This doesn’t mean we should give up on strong federal privacy legislation; we need it now more than ever. But any such legislation must put consumers in control of their own data. It must require companies to clearly inform consumers about their data practices and get consent to retain, share or otherwise use consumer data. It must address coercive practices that condition services on consumers’ consent to unnecessary data collection, and put in place limits on how data can be retained and used. And, perhaps most importantly, it must give the government a large stick for enforcement and consumers a way to take companies to court that violate privacy.
Critically, this federal legislation should act as a floor, not a ceiling, for privacy interests. We should be highly skeptical of any proposal that would wipe out existing privacy laws that protect consumers or foreclose states from acting to address future privacy threats. Such preemption from Congress would be a win for business interests at the expense of the public.
A must-read for internet privacy advocates.