The Illusion of Agreement
One could assume that in the era of Facebook data leakage of 533M people and deepfakes by AI being used to rig elections, a congress would make a hurry to realize digital privacy legislation. The polls indicate that 90 percent of the Americans are demanding better protection. However, whenever there has been a rare bipartisanship on the necessity of regulation, it fails. Meanwhile, there is a shadow war taking place – lobbyists cash in on lawmakers, the Democrats and Republicans squabble about enforcement, and states leap frog ahead with their own legislation. How is it that nothing works that both sides of the aisle deems to be broken and yet nothing gets done?
The Stalemate: Where Talks Keep Breaking Down
What is the greatest impediment? The power of the states. The CPRA of California and the CDPA of Virginia will establish excellent standards, although the GOP leaders contend that business is harmed by a patchwork of laws. Democrats, in turn, are afraid that federal preemption will undermine the protection-just consider the Texas HB 4, aka a privacy law in name only.
Then there is the debate on the issue of the existence of the private right of action. Does the people have a right to sue business enterprises when their information is used improperly? That is what Illinois Biometric Privacy Act enabled, forcing Meta to pay out more than a half-billion dollars in settlements. Corporations say that it would open the doors to frivolous litigation and defenders of privacy say it is the only means of keeping Big Tech in line.
and not to mention the 124 million dollars the tech giants had to do the lobbying in 2023 (OpenSecrets). In one case, leaked emails show how Amazon and Google strategically worked behind the scenes to create loopholes in draft bills, so that they are enforced weakly.
Illustration: The Almost Bill That Did
The closest the Congress got to a breakthrough was the American Data Privacy and Protection Act (ADPPA). In 2022, it won in the House Energy & Commerce Committee by a rare bipartisan margin, 53-2. Then it was thwarted on a brick wall in the Senate.
Why? Sen. It was blocked by Maria Cantwell (D-WA) who wanted it to be enforced better. In the meantime, Sen. Ted Cruz (R-TX) snuck in an amendment last-minute to get data constraints diluted. The result? Another flop that shows that no matter how close to an agreement the congress stands, there are factors that kill it off.
Who’s Really Calling the Shots?
- The shadow play of Big Tech: Lobbyists write bills as congress members argue. In June 2023, a report by Tech Transparency Project discovered Amazon had co-written some sections of a weak federal privacy proposal.
- Small Businesses in the Cross Fire: The NFIB cautions that we at in the government are risking small companies to incur more than 200K in additional costs per year. However, according to privacy lawyer Alan Butler (EPIC): “If GDPR in Europe did not destroy businesses then why should it be a U.S. law?”
- The States vs. Congress Standoff: Companies have a nightmare on their hands since only 15 states will now have their own privacy policies. Paradoxically, it could take this turmoil to get Congress to move, much as state marijuana laws put pressure on federal liberalisation.
Expert Insight: “Perfect Is the Enemy of Good”
I talked to Jennifer King, a privacy scholar at Stanford and she was more caustic about it:
Congress is still pursuing a perfect bill as technology is moving at the speed of light. The GDPR of the EU was not perfect but it established a norm. The U.S is in analysis paralysis.”
She’s right. Each year lacking the federal rules implies:
Unless we do anything about it, more and more unchecked data brokers, selling your location history.
More facial recognition scanning your social media with AI.
More loopholes through which companies can run.
Conclusion: Will It Take a Disaster to Force Action?
History reveals that congress just acts in the wake of a crisis. It took