According to the Pew Research Center, the majority of Americans believe that it is not possible to go through day-to-day life without their data being collected. Similarly, privacy concerns also rate as “very important” amongst most Americans. Lawmakers at the state level have begun to take action. First, California passed the California Consumer Privacy Act in 2018 and now on their heels is Virginia whose data privacy legislation was just signed into law on March 3. Other states may soon follow and contribute to a patchwork of data privacy laws that will only serve to make it more difficult for online businesses to operate. NTU Foundation pointed out on how California’s data privacy regulation would complicate the online ecosystem and come at staggering costs. It’s time for Congress to step up and create a federal data privacy standard.
While this may seem like an increase in federal regulation, a federal data privacy standard would actually make it simpler for online companies to operate. Congress is best situated Constitutionally through the power to regulate interstate commerce to create a national standard and can take into account a larger array of viewpoints that come into play at the state level. The internet should not be subject to state jurisdiction, and while it would likely be extremely difficult for large technology companies to comply with 50 different privacy laws, it would be nearly impossible for smaller businesses to do so. Congress has acted in the past to ensure access to the internet with legislation like the Permanent Internet Tax Freedom Act, and creating a reasonable privacy standard would ensure small and large businesses alike are able to bring their services to consumers without costly regulatory barriers.
There have also been numerous private-sector efforts to strengthen data privacy standards, but an educational gap remains. State-level legislation could threaten this innovation by being overly prescriptive and with less input from the companies that would be affected by these policies. Online innovation and competitiveness depend on a basic knowledge of the rules of the road. If a state-based solution is adopted, the regulations that these companies are supposed to follow could be upended at any point a state decides to change their regulations, and online companies would constantly be forced to default to the state with the most stringent rules. This would not be a recipe for success for companies and would come at the expense of innovation for the consumer.
However, there must be a thorough and sober process to ensure that the anti-Big Tech fervor doesn’t latch onto this issue. A light-touch framework could address the underlying concerns about data privacy, especially now when Americans are increasingly reliant on the internet for health care, education, and employment. Additionally, one of the difficulties with data privacy is nearly all online companies collect user information and in many cases for a benign purpose. For example, among others, restaurants that provide online reservations routinely collect email addresses and other personal information. In crafting a federal standard, Congress should avoid heaping regulations on similar industries that consumers by and large consent to giving their information to for a well-known purpose.
While large technology companies have dominated the headlines in Congress, there are numerous smaller companies that could be impacted if Congress increases burdensome regulations. Large and small technology companies must have a seat at the table to ensure a federal standard is crafted correctly without poison pill provisions. Certainly, some lawmakers who are advocating for harsh antitrust action or drastic Section 230 reform will eye this as an opportunity to punish “Big Tech.” Doing so will undoubtedly cause harm to consumers and leave the online marketplace in worse condition.
As other states are already considering data privacy legislation, Congress needs to step in and set the bar. The uncertainty that will come from differing standards across states will make smaller companies less able to enter and compete in the market and decrease innovation for consumers. A light-touch approach will create a more sustainable playing field for companies and address concerns from consumers. Internet regulation is complex, and even seemingly innocuous regulations could have far-reaching and negative impacts. Congress is far better situated to enact a data privacy standard that protects consumers without creating more barriers to entry for smaller online businesses.