Starting in 2018, the U.S. states have been passing consumer privacy laws. Roughly half the states have now passed these laws. While there was promise earlier on that these laws might improve privacy protection in the U.S., the verdict is now becoming clear—the laws are overall quite poor. I’d give most of them Ds or Fs.
When California began the trend in 2018, industry lobbyists sprang into action and descended to states trying to weaken and rewrite their laws. The battle began in Washington, which crafted an anemic law heavily influenced by industry. That law never passed. The fight then shifted to Virginia, where a weak law passed based on a similar recipe. Virginia’s law became a blueprint for many other states, many of which copied and pasted much of it. Even those that didn’t largely followed the same model.
A few years ago, I critiqued the state consumer privacy laws as lacking in imagination: “[W]hile I applaud the sentiment about the states passing privacy laws, I don’t think most really move the needle on privacy.”
