Frustrated by failures on Capitol Hill, tech privacy advocates are turning to legislation at state level to bolster online privacy, including in Illinois and NY
Tech privacy advocates frustrated by failures on Capitol Hill are looking to mine state capitals for legislative victories. Mastodon: @alng@journa.host . Tweets: @jduballreports , @kyleschmauch , @alfredwkng , @alfredwkng , and @epicprivacy Mastodon: Alfred / @alng@journa.host : Congress failed to pass a data #privacy bill last year, largely over disputes on states having their own regulations. — Now, states are adopting a modified version of the federal bill that could have killed their privacy regulations: https://www.politico.com/... Tweets: Joe Duball / @jduballreports : Insightful reporting from @alfredwkng on state privacy, but a little wrinkle: Indiana's current Senate privacy bill is more aligned with Virginia than ADPPA. Before the bill passed the Senate two weeks ago, Sen. Yoder's amendment on banning targeted ads to kids was voted down. https://twitter.com/... Kyle Schmauch / @kyleschmauch : Montana is still a national leader in data and tech privacy, thanks in large part to the work of Senators Daniel Zolnikov and @KennethBogner. Both of them have introduced significant bills on these issues again this legislative session. https://www.politico.com/... #mtleg #mtpol Alfred / @alfredwkng : The effort takes a page out of the tech industry's playbook: using Virginia's weak privacy law as model legislation. The ADPPA's bipartisan support and momentum last year gives state lawmakers confidence, @CaitrionaFitz said: https://www.politico.com/... https://twitter.com/... Alfred / @alfredwkng : Congress failed to pass a data privacy bill last year, largely over disputes on states having their own regulations. Now, states are adopting a modified version of the federal bill that could have killed their privacy regulations: https://www.politico.com/... @epicprivacy : From @POLITICO's @alfredwkng: “The Electronic Privacy Information Center, a D.C.-based nonprofit, is at the center of the multi-statehouse push among #privacy advocates.” Learn more about EPIC's work on a state version of the #ADPPA on our blog! https://epic.org/... https://twitter.com/...
Context & Ripple Effects
Congress' failure to pass the [[a:ADPPA|ADPPA]] last year turned on exactly the question now playing out in the statehouses: whether a federal law would preempt state regulations. With that deadlock unresolved, EPIC and allied advocates are taking a modified version of the bill — stripped of the preemption that could have nullified existing state laws — to Illinois and New York.
The pivot extends a pattern years in the making: as state and local governments moved ahead on their own while Congress stalled, industry counter-mobilized in the same arenas, lobbying Utah and other states for laws weaker than California's. Thirteen states now have privacy laws, and the fight has shifted from whether regulation happens to how strong each one is.
First-order effects
- Illinois and New York lawmakers get a new drafting template — a modified ADPPA without preemption — giving EPIC's multi-statehouse push a concrete bill text rather than starting from scratch.
Second-order effects
- Industry lobbyists like Andrew Kingman, who have shaped weak state laws elsewhere, must now contest every capital individually instead of waiting for a single preemptive federal law to settle the field — raising the cost of the water-down strategy documented across 13 state legislatures.
Third-order effects
- If strong-state models like Vermont's strict bill keep passing while weaker ones spread too, companies face a compliance patchwork that functions as a de facto national standard — ironically entrenching the state-fragmentation that helped kill the federal bill.
The trend: US data privacy regulation is migrating from Capitol Hill to state capitols, where advocates and industry now fight bill-by-bill over the strength of each state law rather than over a single federal framework.