As Feds Strip Internet Privacy Laws, States Enact Their Own

If anything good has come out of incoming U.S. President Donald Trump’s unsettling attack on Obama-era legislation, it’s the incentive his actions give states to step up to the plate and address those issues within their borders.

This month, one of many hot topics in Washington is Internet privacy laws, which American voters once fought long and hard to ensure the White House would protect. With Congress’ recent vote to strip new (and not yet in effect) privacy rules that would have limited Internet companies from mining your personal information for commercial purposes, states across the nation are now taking action.

Illinois is only the most recent state to consider legislation that would affect providers' efforts to silently collect your personal information and sell it to advertisers. Under the proposed bill called the Right to Know Act, consumers would have the right to know what information online companies like Facebook, Twitter and Google collect, as well as the kind of businesses that buy their information.

The state is also considering two other measures, one which would limit geolocation tracking of consumers without their consent. At the present time, Web browsers are not required by law to ask you for permission to reveal your location. This law would change that.

The Microphone Enabled Device Act would require companies to get your written permission before they could enable the microphone your device. It also paves the way for damages when the law is broken.

Other states already have such legislation on the books. Laws in California and Connecticut restrict government access to users’ emails, while West Virginia and Nebraska adopted new laws that define if and when companies can look at their employees' social media accounts. New Mexico, Hawaii and Missouri are just a few of the other states considering similar personal Internet protections.

The proposed bills relating to employers are likely in response to a spike in companies that use the social media accounts of workers and renters to determine whether they are a good fit for their client’s professional ideals.

Not everyone is sold on the idea of more consumer legislation. Omri Ben-Shahar, who is the Kearney director of the Coase-Sandor Institute for Law and Economics at the University of Chicago Law School, noted in a recent Forbes op-ed piece that Illinois already champions state privacy legislation and wondered whether a new law that essentially legislates something Internet companies are already doing is really necessary.

“Apps like GoogleMaps already request people’s permission to store and use their geo-locations, thus precluding a tsunami of 'gotcha' litigation,” wrote Ben-Shahar, who argued that laws like this are really meant to “blaze a new trail of class-action activity. Illinois, in other words, is solidifying its stature as the Mecca for privacy litigation pilgrimage.”

But to the consumer who is grateful that GoogleMaps does ask for permission each time it wants to broadcast his or her location, it isn’t that simple. New aggressive federal roll-backs of privacy legislation has a tendency to change the perceived topography and limits of where a company can go. That is the purpose, it would seem, to repealing legislation the White House views as over-restrictive.

And just because a company asks politely doesn’t mean the next guy will do the same. Privacy legislation doesn’t just protect current consumers, but future Internet users who may not receive that same courteous request from the next online startup.

Whether or not Illinois is proposing privacy legislation because “[their legislative battles] can be easily won,” as Ben-Shahar suggested, other states are likely to follow suit. The federal government’s roll-back of environmental and immigration legislation has prompted states to adopt their own rules and, in some cases, to set up declared boundaries for what federal authorities can do within the state’s borders. The issue of privacy rights may well follow suit.

And as Connor Dougherty of the New York Times pointed out this week, that means more onerous responsibilities for companies that want you as a customer. It means hiring more lawyers to write privacy policies that meet the state’s expectations. And it means more costs to ensure privacy is protected

That poses an ironic twist for the Trump administration that has lobbied its legislative repeals as a way to decrease the number of business regulations affecting companies today. It begs the question whether standardizing expectations at the federal level doesn’t lessen the cost and the burden of compliance for everyone in the long run.

Wikimedia/Matthew Bowden