Big Tech’s Data Privacy War Moves to New York to Weaken Bills

Amazon.com Inc., Google, Meta Platforms Inc., and other tech companies are lobbying to keep New York from joining the growing list of states regulating how businesses use consumers’ data—at least until Albany lawmakers adopt a proposal to Big Tech’s liking.

New York gained importance this year when it became the largest state in terms of population without a comprehensive data privacy law. That could change in 2024 if the Assembly approves a version of the New York Privacy Act (S.B. 365B) that passed the state Senate days before lawmakers adjourned in early June.

The tech industry has kept the heat on elected officials on privacy issues ever since, including by directly lobbying Gov. Kathy Hochul (D), state Senate Democratic majority staff, and key legislators, lobbying records show. Amazon alone disclosed contacts in July and August with more than a dozen lawmakers regarding a “state bill” affecting “job opportunities” in their districts.

Their efforts are geared towards keeping New York from adopting restrictions like those privacy advocates have praised in California that allows people to sue over data breaches per a 2018 law.

Three other states—Virginia, Connecticut and Colorado—also have broad privacy laws in effect, but only California has its own enforcement agency. Illinois residents can sue for privacy violations related to biometric data like fingerprints and face scans, while the bulk of a Washington law allowing lawsuits over consumer health data goes into effect next year—neither state has comprehensive data protections in place yet.

The California Consumer Privacy Act also requires companies to disclose what data they collect from users and delete it upon request with some exceptions.

“We have seen a trend of these laws getting more and more watered down as we’ve moved farther away from the original California law,” said Evan Enzer, an attorney with the Surveillance Technology Oversight Program.

Billions of dollars in economic activity are tied to data collection in New York. “It would be political malpractice” for the tech industry to not maintain a robust lobbying operation on that front during the legislative off-season, said Julie Samuels, president of the advocacy group, Tech:NYC, which represents large tech companies and small startups.

“We’ve had some objections to that bill because it would make New York’s data-privacy regime very different than any other state,” said Samuels of the Senate-passed measure.

State lawmakers and privacy advocates see other motives behind Big Tech’s presence in Albany.

Their plan is “to water down the bill so much that it doesn’t really interfere with their business or straight up kill it” before the Assembly has a chance to approve a version next year, said state Sen. Kevin Thomas (D), who sponsored the state Senate-approved bill. Assembly sponsor Nily Rozic (D) declined to comment.

The tech industry successfully pushed lawmakers in other states to incorporate ideas they favored, like charging state attorneys general with enforcing data privacy laws rather than empowering individual citizens to file civil suits of their own.

Thomas showed his own willingness to move his bill forward by acceding to industry demands when he dropped such a private-right-of-action provision from his own proposal. The next day, Microsoft Corp. released a memo touting the “strong enforcement” within the bill, over which it had broken with other companies by supporting.

The move outraged civil rights groups who argued state attorneys general lack the resources to effectively enforce data privacy laws by themselves.

“They have succeeded in watering it down pretty dramatically,” said Justin Harrison, senior policy counsel at the New York Civil Liberties Union, in an interview.

He acknowledged an uncompromising position on matters like enforcement means no data protections for New Yorkers in the near future. “Are we letting the perfect be the enemy of the good? Maybe, but, you know, we’re privacy advocates. We’re pushing for the strongest protections possible,” Harrison said.

‘Pretty Plain Vanilla’

More than a dozen states have approved comprehensive data privacy legislation that will take effect in upcoming years—but they are hardly all the same, according to a September study by the National Conference of State Legislatures. About 30 more states considered proposals but didn’t complete work on them.

Lobbyists have succeeded in keeping the right to private legal action out of state bills. They have also successfully stopped provisions that would require companies to ask consumers to opt-in for any data collection, rather than the EU model where people must proactively allow data collection. Tech companies are also fighting efforts to crack down on targeted advertising by narrowing its definition.

If Thomas’ bill were to pass, it would be a “pretty plain vanilla” addition to current consumer protection laws, said Syracuse Law School Professor Shubha Ghosh in an interview.

Uncertain Future in New York

Disagreements between the bill sponsors—whose proposals don’t even share the same name—add to the uncertainty surrounding data privacy legislation in New York.

The state Senate bill has to pass the Assembly before the end of 2024, or a data privacy bill will have to go through the whole legislative process again without Thomas, who is leaving the state Senate at the end of next year.

Some privacy advocates are already looking towards another measure, the Digital Fairness Act, (S. 2277) as their preferred data privacy bill. It didn’t advance out of committee after its introduction in January.

The tech lobby is focusing now on the New York Privacy Act, and industry leaders say a balance must be struck between consumer protections and businesses’ ability to comply with them. The Thomas and Rozic bills fall short of that standard, so the industry has no choice but to resist them, said Samuels, the leader of Tech:NYC.

“If there’s not a federal solution, what we want to see is that the states are streamlined and that complying with one state also means you’re complying with other states,” said Samuels. “Everyone in tech understands that a data privacy regime is not just coming but it’s also good for the world that there are rules of the road.”