US State Privacy Legislation Tracker | Hacker News Reader

US State Privacy Legislation Tracker

iapp.org

79 pointsmooreds18 comments

One extra column for “effective” as in whether its in force yet would be good

Having footnotes won’t scale well as more states make progress

Agreed. Even better would be a machine consumable format (JSON, XML, CSV).

For this kind of regulation, you look to see what kinds of enforcement mechanisms exist. You need either (or ideally, both):

- a private right of action (IE, I get to sue you if you violate the privacy rights that this bill spells out)

- well funded and dedicated "white colar" unit under the attorneys general that has authority to investigate and punish wrongdoing

Getting the government to spend a whoooooole bunch of money on a dedicated white collar enforcement unit is generally not very popular, and while a private right of action is generally cheaper for the state, its also really unpopular with industry types who hate getting sued by jo jack and jane.

The EFF has a great rundown of what makes a good privacy bill here: https://www.eff.org/deeplinks/2020/03/tech-lobbyists-are-pus...

IAPP (which hosts this tracker) is ironically not as strong on privacy issues as the EFF is so I'm kind of glad they are not including a "effective" column, to be honest.

One of the columns in the linked table is "Private Right of Action" (under Rights of Consumer). I absolutely agree this is the single most important aspect of any privacy bill.

The IAPP is a licensing and education organization, not an advocacy organization like EFF. They are on the side of practitioners and organizations, trying to help them continue to do their work in ways that respect privacy. IAPP is the carrot, EFF is the stick.

I run a startup that is working on some of these specific issues, and how to make data privacy rights in general more actionable in the real world - if you (or anybody else) is interested in chatting, please reach out.

I feel like this should be federal legislation rather than having every state adopt their own privacy regulations. With every state, there comes the possibility of fragmentation and all of a sudden you have to be in compliance with GDPR, CCPA, WPA, and a host of other state privacy legislation.

Hopefully it won't come to this and even if we don't get federal legislation, hopefully the rules will be setup in a way where there is a "gold standard" (ie. if you're compliant with GDPR, you're defacto compliant with all the other policies).

If someone here is more of an expert on this topic I'd love to hear what I got right and wrong in my assumptions.

These privacy laws are regulating interstate commerce and as such should be subject to only Federal jurisdiction.

They're regulating commerce within their state.

If I'm in Indiana, and something California does prevents me selling from Indiana to California, it is clearly regulating interstate commerce.

You are correct, and that's the main reason why some tech companies lobby in favor of Federal privacy legislation.

This also brings up an important issue: Local Pre-emption. A federal law may, if Congress chooses, say that "states cannot make local laws on this topic." But it also may not, and states could still choose to implement stricter laws.[1] This aspect, along with Private Right of Action, are considered by the privacy community to be at least as important as what tracking is actually allowed.

[1] This is already the case for e.g. wiretapping laws: Federal law requires at least one party consent to recording a phone conversation. Some states have stricter requirements and require all parties consent.

Exactly right. The tech and advertising industries and their allies want weak federal regulations (with no private right of action, and lots of exemptions) that pre-empt stronger state laws. One way to get there is to get multiple states to pass roughly-similar weak regulations and then argue that there's "consensus" so might as well make it a federal standard.

So, an Amazon lobbyist gave the version they were trying to get passed in Washington to a Virgnia state legislator who introduced it there and (since Amazon had just invested a zillion dollars in Virgina) they whisked it through. Then they used that as the basis for Colorado's law. This year when they tried to pass it again in Washington one of the arguments was "it aligns with other states". Sigh.

https://www.reuters.com/investigates/special-report/amazon-p...

States are useful little laboratories of democracy in situations like this. California's CCPA was conceived and funded by a lone real estate developer with enormous personal conviction in privacy. Consensus was that his personal crusade would fail until the voters unexpectedly passed the measure in 2018. That kick started data privacy legislation in the US. It would have taken another decade at least for the Feds to be first movers.

Note proposition 24 passed in 2020 to amend CCPA. Not all of the changes were all that great [1] [2]:

> Prop 24 expands current law by exempting loyalty clubs and rewards programs from existing limits and allows businesses to withhold discounts unless they can harvest data about shopping habits.

[1] https://ballotpedia.org/California_Proposition_24,_Consumer_...

[2] https://www.ballot.fyi/prop-24

IAPP also have a global comparison chart (PDF): https://iapp.org/media/pdf/resource_center/global_comprehens...

Not allowing zoom on brave mobile browser, this site is functionally unreadable.

I'm willing to bet it reads fine for the 99.99998% of people who aren't using Brave Mobile

Thanks to whoever posted this, and even moreso to whoever maintains it! I've been looking for something like this for a few months now. Much appreciated!

just going based off of when the IAPP map was last updated vs how often I get email notifications of new posts, the byte back law blog is more up to date (although I strongly disagree with some of their analysis, they are on top of these things so kodus for that I guess)

https://www.bytebacklaw.com/

https://www.huschblackwell.com/2022-state-privacy-law-tracke...

Reply on news.ycombinator.com