This week saw the election of former U.S. president Donald Trump to a second non-consecutive term in the White House. Though still early, expected broad changes to regulatory philosophy and specific shifts on issues like trade policy may have wide-ranging implications for digital governance and technology policy.
The 2024 elections also brought other changes to the balance of power in Washington. At the beginning of the next term, the Senate will shift from Democrat to Republican control. Control over the lower chamber is still uncertain, but Republicans appear to have a high probability of controlling both chambers of Congress for the next two years.
Insurmountable uncertainty before the election made policy forecasting almost impossible. Now a different type of uncertainty reigns — about how campaign promises will translate to real-world policymaking — but the results offer some glimpses of what 2025 could bring.
Overall, the U.S. is likely to see major pivots along three axes relevant to privacy, artificial intelligence governance and adjacent digital fields:
- Through executive action, the new administration will attempt to change the direction of travel for those limited areas where the executive branch has direct control. Executive orders and agency leadership will be the first notable changes.
- Regulatory agencies could see major shifts, especially around contested domains of regulatory power. Rulemakings may be stopped or reversed, and enforcement priorities could change. However, the missions of longstanding federal agencies should remain the same.
- Legislative conversations undoubtedly will experience a hard reset. From comprehensive federal privacy law to AI bills, the new balance of power will markedly change the negotiating stakes with potentially dramatic results for digital governance.
Executive actions
President-elect Trump has dozens of promises to keep related to his actions on Day 1 of his presidency, but most tech policy issues will be relegated to later in the first 100 days of the administration.
At the top of that list will be rescinding and replacing President Biden's historic executive order on AI. Given the sweeping scope of Executive Order 14110 across every part of the U.S. government, Trump's promise to revoke it is more likely focused more on specific politically charged areas of the order rather than the entirety of the order itself.
As many have observed, the majority of the executive order set in motion agency activities that cannot be easily unwound. New rules and policies on a wide range of issues have already been finalized across the government. If reversing these is a priority, it is certainly possible, but it will take time.
Far more likely will be a targeted reversal of the anti-bias and anti-discrimination aspects of the executive order. This could include deprioritizing the governance structure put in place by the Office of Management and Budget’s memorandum M-24-10, especially the guardrails for rights-impacting and safety-impacting AI systems. OMB’s more recent memorandum M-24-18 on the responsible acquisition of AI systems by the federal government could also be subject to review, which would have direct implications for the private sector.
Adjusting OMB memoranda takes time and requires consultation with federal agencies, but it is entirely within the power of the executive to revise internal federal government governance structures.
Other targets for modification within the executive order could include the the private sector reporting requirements for dual-use foundation models, the AI Safety Institute, and perhaps other programs at the National Institute of Standards and Technology.
Executive office leadership
Another presidential power to directly shape federal policy comes in the form of nominating and appointing leaders of executive agencies and the hundreds of political appointees who support them. Nominees must be confirmed by the Senate, but with that chamber firmly in Republican control, it will only be the most controversial or unqualified of nominees who are likely to face push-back.
We will learn a lot in the first few months of the administration about how Trump’s mandate will translate to sectoral policy. The candidates whom the incoming president nominates to serve in roles in the White House — including OMB as well as the Office of Science Technology Policy, National Economic Council, National Security Council, and the U.S. Trade Representative — will provide clarity on the policy priorities of the new administration.
Digital trade policy
Speaking of the USTR, digital trade will be another closely watched tech policy domain for the incoming Executive Office of the President.
It is important to think separately about the Trump campaign's protectionist rhetoric around material goods and general trade policy when compared with the specific issues of digital trade and the flow of personal data.
The second Trump administration is unlikely to make drastic changes to existing agreements such as the EU-U.S. Data Privacy Framework, which was negotiated under the first Trump administration. Though the implementing executive order and regulations were put in place by the Biden administration, there is no indication that modifying these policies will be a priority.
The only countervailing argument is a mention in the disavowed Project 2025 memo of the need to reexamine provisions of Executive Order 14086 that "unduly burden intelligence collection." The need for stability in this area is far more likely to win the day as the new administration will have other mechanisms for reassessing its relationship with the European Union.
Meanwhile, changes in leadership at the USTR are likely to re-align the U.S. government on a message supportive of the free flow of personal data and vocally opposed to data localization requirements. That said, this will also take place in the context of ongoing enhanced oversight of data flows from a national security context. The bipartisan support for the expansive new rules for certain foreign sales of sensitive data signals that these limits are likely to stay in place, including those currently being finalized by the Department of Justice.
Other agency leadership
Executive agencies like the Department of Commerce and its many influential sub-departments, including NIST, the International Trade Administration and National Telecommunications and Information Administration, can have an outsized role on tech policy. For these elements of the administrative state, the president can swiftly nominate replacement leaders as those put in place by the outgoing administration step aside.
Independent agencies are a little more complicated, and each has its own set of rules for transitions of leadership. The policy community will be closely watching what happens with the Consumer Financial Protection Bureau and its chair, Rohit Chopra, whose term expires in 2026. However, an important Supreme Court decision in 2020 determined the president may fire a CFPB chair at will.
If Chopra leaves willingly or is removed, the CFPB's numerous ongoing rulemaking activities and even some final rules, including the open banking rule — which is currently being challenged in court — could be deprioritized or reversed. The CFPB may also face legislative threats to its funding or even its existence, if current Republican opposition to the agency is made a legislative priority.
Deep dive: FTC leadership
The Federal Trade Commission is, of course, the most consequential independent agency for privacy matters. Unlike the CFPB, commissioners can only be removed from agencies like the FTC for cause.
But the appointment of a chair of the FTC from among sitting commissioners is up to each president's discretion. Despite leading the agency through what some term major accomplishments and others a historic crusade against Big Tech — one that somewhat aligns with Trump's own priorities — FTC Chair Lina Khan has been constantly criticized by Republican policymakers. Most recently, the House Committee on Oversight and Reform released a censorious report on Chair Khan's term.
Though her term has expired, Khan may continue to occupy her commissioner seat until a replacement is confirmed. Though it is an open question whether she will wish to remain when stripped of her leadership role. Usually, FTC chairs resign before a presidential shift.
As his presidency begins, Trump will be able to immediately select a new chair from among those who are already confirmed. Of course, the two Republican commissioners, Melissa Holyoak and Andrew Ferguson, are the most likely candidates. If Trump would rather hold out for his own nominee to be confirmed by Congress, he could instead name one of these two to serve as an acting chair. This has been the model chosen by the last two incoming administrations.
Trump will also have the opportunity for a second FTC nomination in 2025, as Commissioner Holyoak's term expires next year. He could re-nominate her or select someone else for Senate approval.
Agencies' privacy rulemaking and enforcement
The FTC's long history of bipartisan enforcement reigning in the most egregious business practices, including privacy and cybersecurity matters, will continue, even in a climate of general government constriction.
It is a different story for the Commission's ongoing rulemaking on commercial surveillance and data security. Given Republican opposition to the proposed rule, the process is almost certain to be scuttled by the incoming chair.
Even knowing this, the current FTC may attempt to release the notice of proposed rulemaking before the end of the administration. On the other hand, the pending updates to the Children’s Online Privacy Protection Rule are less controversial, though if not finalized before the end of the administration, the incoming FTC could pause to reconsider comments and final conclusions before finalizing the update.
As minority commissioners, both Holyoak and Ferguson have issued expansive critiques of the FTC’s recent matters in the form of dissenting or concurring statements. Most enlightening on their approach to privacy and AI governance were lengthy statements from the conclusion of the recent industry investigation of social media companies and video streaming services, a process that began under the first Trump administration.
Though both commissioners agree strongly with the privacy goals of the staff report — and the focus on children and teens — both poured cold water on references to algorithmic testing and monitoring to address harmful uses of AI. Reflecting on the report's call to enhance AI governance departments, Ferguson said the report "conveniently fails to mention the stunningly bad decisions made by such AI safety bureaucracies where they already exert their harmful influence."
Ferguson's dissent from the AI parts of the report strikes a stark contrast from his concurrence with the report’s focus on the "online privacy crisis." He hopes the report will "make Americans more aware of the extent of the online commercial surveillance to which they have been subjected."
Holyoak focused her critique on the FTC's concluding recommendations for companies, writing that the FTC has not fully analyzed possible harms to competition or groups like content creators that industry adoption of "sub-regulatory" recommendations could create. She concludes that "putting ideological blinders on does not remove the real-world trade-offs that exist in data privacy."
At the Federal Communications Commission, recent rulemaking and enforcement priorities are also likely to shift as the 5-person agency reshuffles. FCC Commissioner Brendan Carr is favored to take the reigns from outgoing Chairwoman Jessica Rosenworcel. This would likely include another about-face on net neutrality regulations and other recent FCC regulatory activity, but, more relevant to privacy pros, could also signal changes to the prioritization of privacy enforcement at the agency.
Finally, dramatic de-prioritization is also to be expected at Health and Human Services Office of Civil Rights, which enforces HIPAA.
What would a Republican trifecta mean for privacy?
With the change in Senate control comes a change in control of Senate committees, including the Committee on Commerce, Science and Transportation. U.S. Sen. Ted Cruz, R-Texas, will take over the leadership of that committee. In that role, Cruz will play a major role in shaping the conversation on comprehensive federal privacy legislation — where he has indicated he supports a preemptive ceiling of a form that looks more like Texas' state law than any other recent proposals — as well as most private sector AI governance.
Prior single-party trifectas, most recently at the beginning of the Biden administration, have not resulted in the passage of federal privacy law. It is also worth remembering Senate governance requires 60 Senators to agree in order to withstand a filibuster. Though Republicans have cemented their control, they did not reach that number.
The leadership of the Senate overall is less certain, with a showdown setting up between multiple candidates to replace Sen. Mitch McConnell, R-Ky., who is stepping down from the leadership role. Sen. John Thune, R-S.D., is one notable front-runner, not least because of his prior detailed involvement in legislative proposals around privacy and AI governance. Among these was his Filter Bubble Transparency Act, which was incorporated into the still-pending Kids Online Privacy and Safety Act this term.
If Republicans retain the House, as is most probable given current projections, the chairmanship of the Committee on Energy and Commerce will also be up for grabs. Outgoing Energy and Commerce Chair Cathy McMorris Rodgers, R-Wash., used her final term to attempt to finalize the federal privacy law she has been helping to negotiate for years, the American Privacy Rights Act.
One of the voices who pumped the brakes on the updated bill was Rep. Bob Latta, R-Ohio, who aligned himself with House leadership in voicing concerns about APRA’s private right of action and other features.
Latta is one of the front-runners to replace Rodgers as chair of Energy and Commerce, if Republicans retain control. The other front-runner appears to be Rep. Brett Guthrie, R-Ky. Both representatives handily won re-election in their districts.
Whether or not federal privacy bills, AI governance legislation, or other relevant legislative proposals become a priority for Congress in 2025, there is sure to be a lot of activity in the relevant committees of both chambers as Republican lawmakers attempt to reset the conversations on these issues. Democrats will take up the role of the vocal minority, meaning the crucible of policymaking in D.C. will be very hot for the foreseeable future.
Please send feedback, updates and thoughts on the next four years of digital policy to cobun@iapp.org.
Cobun Zweifel-Keegan, CIPP/US, CIPM, is the managing director in Washington, D.C., for the IAPP.
