Privacy Law Enforcement Enhanced By States’ Tech Hiring Push

State regulators are recruiting a new pool of talent to investigate under-the-hood corporate data privacy practices and level the playing field with tech-savvy industry.

At least six states—California, Texas, Oregon, Connecticut, Minnesota and Delaware—are bringing on experts steeped in a wide range of technologies to help them pursue a new wave of privacy investigations and corporate settlement agreements. States have already hit titans including Meta Platforms Inc. and General Motors with more than $1 billion dollars in fines for alleged privacy violations.

The bipartisan hiring spree also reflects the desire of state regulators to prepare for a wave of privacy laws going into effect this year at a time when the prospects of a federal privacy law remain poor and the future of federal enforcement is unclear. Some states have earmarked funding for the task; others are pulling from budgets already stretched thin by other enforcement and litigation priorities, and squeezed—in Democratic states—by Trump administration lawsuits.

The hires will also bolster regulators’ ability to face corporate in-house teams stacked with expert litigators, engineers, and product teams.

“Without technologists they’re at a disadvantage compared to the companies they’re talking to in terms of figuring out the details and how they relate to the law,” said Cobun Zweifel-Keegan, managing director of International Association of Privacy Professionals Washington office.

The technologist hires are already fueling more technically sophisticated actions and will bolster a spike in activity against companies across industries.

“We are on the cusp, in my view, of a new era of privacy enforcement, especially as all these state laws go online,” said Michael Macko, deputy director of enforcement at the California Privacy Protection Agency.

Getting Technical

States have been inspired in part by federal agencies’ use of tech-savvy employees.

Oregon, for instance, says that it has modeled its approach after seeing first-hand how agencies like the Federal Trade Commission, which opened an Office of Technology in 2023, and the US Consumer Financial Protection Bureau, benefited from in-house technical talent.

“The issues have been technical for a while—they’re getting even more technical,” said Kirsten Hilton, assistant attorney-in-charge at the Oregon Department of Justice.

The impact of technologists on enforcement is already visible in some states.

The CPPA’s last two enforcement actions against American Honda Motor Co. Inc. and Todd Snyder Inc., for instance, showed a shift from enforcement focused on reviewing privacy policies and online documentation to more granular, technical investigations.

“In our recent public actions, you’ll see evidence of that in terms of what companies were doing behind the scenes and how the infrastructure was set up at companies, for example, to implement privacy requests,” Macko said. “We’re getting into all of that at a very detailed, deep level, and the best way to do that is with a team of attorneys and technologists. And you’re seeing this across the country.”

Technologists will help regulators pursue more complex investigations and more enforcement actions, but they will also shape more detailed settlements, summary judgments, and assurances of voluntary compliance, regulators said.

“I’m really curious to see how technologists can contribute to that,” said Michele Lucan, deputy associate attorney general and chief of the privacy and data security section at Connecticut’s Office of the Attorney General. “We’re getting there on a few cases.”

Closing the Tech Gap

Technology staff on both sides of the table may also help facilitate conversations and negotiations between industry and regulators—especially in matters that involve emerging technologies such as generative AI.

Having an expert set of eyes review compliance documentation and investigative requests, for instance, can help enforcers think through whether their requests are “really technically feasible to ask a company to do,” said Hilton.

For companies, the addition of technical staff may bring more targeted demands and make it easier to respond to regulators.

“Having regulators that truly understand technology, that truly understand how privacy controls should be implemented, is going to make our lives easier to an extent,” said Ron De Jesus, field chief privacy officer at Transcend, a compliance vendor. “We’re going to be able to respond to those pointed, well-researched and thorough questions versus trying to figure out what the regulator really wants.”

‘More Cops on the Beat’

State attorneys general have long sought to defend consumer privacy under existing consumer protection laws, but resources have been disparate and stretched thinly between competing issues.

Regulators are staffing up with talent from the federal government, Big Tech, and other former in-house counsel, including chief privacy officers.

“We’re focused on building the team that will be able to best implement and enforce the law,” said Caitlin Micko, Assistant Attorney General at Minnesota Attorney General’s Office.

In addition to technologists, attorneys general offices are hiring investigators, litigators, privacy analysts, and auditors.

“It’s literally more cops on the beat,” Zweifel-Keegan said.

The attorneys general of California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon, as well as the CPPA, in April announced an agreement of formal collaboration and information sharing. That collaboration will include the sharing of resources and staff to purse coordinated enforcement.

That ramped up enforcement will likely lead to more multi-state privacy investigations like those seen in the data security space, said Michael Yaghi, partner at Troutman Pepper Locke. Yaghi, who works with clients on state and federal investigations, said he’s seen more aggressive privacy enforcement lately from attorneys general.

Even if their laws may differ slightly, states with privacy laws are eager to fill the gaps left by a lack of a comprehensive federal privacy law, Micko of Minnesota’s AG office noted.

“The states have taken the position,” she said, “that until there is a federal law it’s really up to the states to protect consumers and advance their data security rights.”