Microsoft is pushing privacy bills, modeled on the Washington Privacy Act it failed to get passed twice, in Arizona, Hawaii, Illinois, and Minnesota
Issie Lapowsky / Protocol : Tweets: @aclu_wa and @issielapowsky Tweets: @aclu_wa : “We don't want to see a bill with loopholes, weak enforcement, and preemption becoming a so-called gold standard,” said Jennifer Lee, the ACLU of Washington's technology and liberty project manager. https://www.protocol.com/... Issie Lapowsky / @issielapowsky : “In almost every state where there's a version of the bill that looks like the Washington Privacy Act, that bill was introduced because someone from Microsoft introduced themselves to a lawmaker.” - @joejerome https://www.protocol.com/...
Context & Ripple Effects
Microsoft has been campaigning for a US privacy law since its call on the first GDPR anniversary for American rules that put the burden on data collectors — but its preferred vehicle, the Washington Privacy Act, died twice in its home state. Rather than retreating, the company is now seeding near-identical bills in Arizona, Hawaii, Illinois, and Minnesota, and by one advocate's account every state with a WPA-style bill got it after a Microsoft lobbyist approached a lawmaker directly.
The push lands in contested territory: the ACLU of Washington, which fought the bill in Olympia, warns against a 'gold standard' label for legislation it says carries loopholes, weak enforcement, and preemption — while separate reporting shows industry groups simultaneously lobbying states like Utah for laws weaker than California's. Whichever template wins at state level shapes what a future federal law looks like.
First-order effects
- Lawmakers in Arizona, Hawaii, Illinois, and Minnesota are being handed Microsoft-backed drafts of the twice-failed Washington Privacy Act, shifting the legislative burden from Olympia to four new capitols in one session.
- The ACLU of Washington's Jennifer Lee is explicitly contesting the bill's framing before it passes anywhere, arguing that loopholes, weak enforcement, and preemption disqualify it as a model.
Second-order effects
- Companies and advocates backing stricter frameworks — California's included — must now fight the WPA template state by state, since its preemption clause would override stronger local laws if copied widely.
Third-order effects
- If the pattern holds, the de facto national privacy baseline gets written not in Congress but by whichever coalition — Microsoft's WPA model or stricter state laws — accumulates more statehouse wins, pre-empting the terms of any eventual federal statute.
The trend: With federal privacy legislation stalled, large platforms are moving the drafting battle to state legislatures, where each passed bill hardens into a candidate national template.