• by Wendy Davis , Staff Writer @wendyndavis, February 1, 2024

While more than a dozen states have recently passed sweeping laws regarding consumer data, most don't go far enough to actually protect privacy. That's according to the advocacy group Electronic Privacy Information Center, which Thursday released a report examining the state laws.

“Weak, industry-friendly laws allow companies to continue collecting data about consumers without meaningful limits,” the group writes in the new report, “The State of Privacy,” which explores laws in 14 states -- California, Colorado, New Jersey, Oregon, Delware, Connecticut, New Hampshire, Montana, Texas, Virginia, Indiana, Tennessee, Utah and Iowa.

The report, written in conjunction with the U.S. Public Interest Research Group, concludes that current state laws “largely fail to adequately protect consumers.”

“Consumers are granted rights that are difficult to exercise, and they cannot hold companies that violate their rights accountable in court,” the authors write.

The state laws broadly follow a notice-and-choice approach -- meaning the statutes allow businesses to collect a host of information, but require them to let consumers wield some control over the data. Within that general framework, specifics vary widely. For example, some state laws now give residents the right to opt out of online behavioral advertising, but also allow companies to ignore opt-out requests sent through universal mechanisms like the Global Privacy Control. Instead, businesses in those states can require consumers to opt out on a company-by-company basis.

The Electronic Privacy Information Center, like many other advocates, favors laws that would restrict businesses from amassing information about consumers in the first place.

“The excessive data collection and processing that fuels commercial surveillance systems is inconsistent with the expectations of consumers, who reasonably expect that their data will be collected and used for the limited purpose to provide the goods or services that they requested,” the group writes.

It's worth noting that advocacy groups aren't the only ones proposing data minimization. Some Federal Trade Commissioners have also indicated they would like companies to cut back data gathering efforts.

“Over collection encourages leveraging huge amounts of data as a surveillance business model and then turning those data into products, some of which have: reproduced patterns of discrimination against protected classes in areas of key economic opportunities; increased the severity of data breaches; and fueled misinformation campaigns,” FTC commissioner Rebecca Kelly Slaughter said in a 2021 speech.

FTC chair Lina Khan similarly suggested in 2022 that officials should consider “substantive” rules that would prohibit companies from collecting certain kinds of data.