2021 saw a record number of comprehensive privacy bills introduced at the state level. While the majority of state privacy bills failed, they reveal trends and common sticking points through multiple proposals.

Across U.S. state legislatures this session, we saw a total of 29 comprehensive state privacy bills introduced. Of these:

• Two bills passed (Virginia’s and Colorado’s).
• Two bills stalled after introduction (one being Ohio’s, which could still move).
• Twenty-two bills got stuck in committee.
• Three bills died in cross-committee.

Virginia and Colorado

Virginia was the first to pass its law, the Virginia Consumer Data Protection Act, back in February. The bill drew heavily from the Washington Privacy Act, which failed to pass for the third session in a row. The IAPP broke down the substance of the CDPA and the legislative discussion leading up to its passage.

Colorado followed Virginia with its own bill in June that drew inspiration from both the CDPA and the failed WPA. Additionally, the IAPP analyzed the substance of the law and recapped the legislative discussion prior to passage.  

Models for state legislation: CCPA/CPRA and WPA

While there is widespread and legitimate concern about the patchwork of privacy laws that could emerge as more states pass comprehensive legislation, these bills aren’t completely dissimilar from one another. Notwithstanding some significant differences, the structure of new state bills is almost always modeled after previous bills from other states. The bills states most often model their legislation after are the California Consumer Privacy Act/California Privacy Rights Act and the Washington Privacy Act.

For example, the recently enacted Virginia and Colorado bills are clearly modeled after the WPA. While each contains variations, the drafters borrowed explicit definitions and language. Similarly, almost every state borrows at least some of California’s language regarding notice requirements for consumers. However, despite the similarities in the actual notice requirements, the bills vary significantly regarding how that notice must be provided. While many state bills mandate the notice be included in an online privacy policy, another interesting trend is for bills to merely state a consumer must be provided notice and then fail to dictate how that notice must be given. In such states, the businesses are permitted to make that determination for themselves.

Another area in which states clearly drew structural inspiration from previous laws but incorporated substantive differences is the scope. Almost all states follow a similar format but set forth different thresholds for determining whether the bill would be applicable to a particular organization. For example, many bills include a CCPA-like revenue threshold that imposes obligations when an organization’s gross revenue exceeds that number, but the amount varies from $10 million to $50 million. Similarly, most bills follow the CCPA/WPA model and impose obligations where a business processes the personal data of a certain number of individuals, which can range from 25,000 to 100,000. Thus, the scope of bills can vary greatly and is certainly a point of contention among legislators.

Another point of divergence among the bills is the definition of “sale.” Again, most follow the CCPA/CPRA, but the bills differ on whether a sale necessitates “monetary consideration” or merely “valuable consideration.” Most states’ bills lean toward the California definition and require only “valuable consideration,” but there is a significant minority (including Virginia) that takes the other approach. Operationally, this difference has a significant impact because by limiting the definition of sale to “monetary consideration,” the scope of the definition is severely narrowed.

The model of consent is also extremely contentious and impactful. Historically, state bills have followed an opt-out consent model where the consumer is automatically assumed to have given consent but may revoke it if they choose to. However, this session saw a wave of bills that either abandoned the opt-out model altogether in favor of an opt-in approach or adopted a hybrid approach. For a more in-depth discussion of consent in state privacy legislation, please see here.

The most recent development at the state level is the Uniform Law Commission releasing a model privacy law in July. The ULC hopes their law will mitigate the patchwork problem and serve as a model for other states to either adopt or adapt moving forward. The model bill is business-friendly and introduces new, substantive terminology. It will be interesting to see whether legislators, who have become so familiar with the terminology used in the CCPA/CPRA and WPA, will accept the ULC’s new model. Furthermore, even if the model is utilized, it does nothing to mitigate the ideological sticking points — such as scope and consent — found in other bills. IAPP Staff Writer Joe Duball delved further into the ULC pitch and spoke with privacy professionals for the latest issue of The Privacy Advisor.

Sticking points

Perhaps one of the largest obstacles to passing legislation for many states was the decision to include a private right of action. While legislators were able to compromise on other controversial provisions, they have struggled to find middle ground on a private right of action. Though some creative compromises have been suggested, the private right of action question was at the center of nearly every debate.

On the one hand, proponents of the private right of action argue such a right is essential to protecting consumers. Without this right, consumers would be left to hope the enforcement body (the state attorney general in most cases) would enforce their rights on their behalf. Consumer advocates have argued this is insufficient and would do no more than pay lip service to protecting consumers’ privacy.

The other side of the table argued that including a private right of action would give rise to endless and expensive litigation, and the imposition on businesses would be too high. Thus, in several states, including Florida, the disagreement over the private right of action was a significant factor in the bill’s failure to pass.

While there were other points of contention, the private right of action was far and away the largest. This is what we have seen in previous years and it will likely serve as a source of conflict well into the future.

Conclusion

If we have learned anything this legislative session, it is that interest in privacy is growing. The question is less of whether additional states will introduce legislation next session and more a question how the legislatures will compromise on the controversial points listed above. Be sure to keep an eye on the IAPP’s state tracker, as we will be closely following those developments.

Photo by Hans Isaacson on Unsplash