The State of Privacy: How state “privacy” laws fail to protect privacy and what they can do better

Today, much of our lives are lived online. How we work, learn, and play is often mediated by screens with companies on the other side gathering data about us. Often, these practices are out of line with what consumers expect, and they put consumer security and privacy at risk. Despite data collection and sales being a multi-billion-dollar industry propagated by some of the most powerful companies in the world, the U.S. has no federal privacy law. Therefore, an increasing number of states are passing laws that purportedly aim to protect people’s privacy and security. However, these laws largely fail to adequately protect consumers. In our evaluation of the 14 states that have passed consumer privacy legislation, nearly half received failing grades, and none received an A. Big Tech has played a big role in the passage of weak state privacy bills. Of the 14 laws states have passed so far, all but California’s closely follow a model that was initially drafted by industry giants such as Amazon. In an analysis of lobbying records in the 31 states that heard privacy bills in 2021 and 2022, the Markup identified 445 active lobbyists and firms representing Amazon, Meta, Microsoft, Google, Apple, and industry front groups. This number is likely an undercount. No laws should be written by the companies they are meant to regulate. Allowing Big Tech to heavily shape our privacy rules allows them to consolidate their already outsized power in the economy and in our lives. Privacy rules should balance the scale in favor of the billions of people who rely on the internet in their day-to-day lives.