U.S. must lead on privacy

Businesses need it, Americans want it, AI accelerates harms

Today, U.S. Senator Maria Cantwell, Chair of the Senate Committee on Commerce, Science and Transportation and author of the bipartisan American Privacy Rights Act, delivered keynote remarks at Forum Global’s 6^th Annual Data Privacy Conference, where she laid out reasons why the need for a federal comprehensive privacy law will continue to grow: 1) the U.S. must assert global leadership on privacy to support U.S. business and innovation; 2) Americans overwhelmingly want Congress to act on privacy protections; and 3) AI will accelerate privacy and data concerns. Sen. Cantwell also made clear that enacting a comprehensive privacy law is something Congress can get done.

First, the United States needs to assert global leadership on privacy. … As many of you know, 70% of countries around the world have enacted a national privacy law. The United States – wanting to be the tech innovator, and home … to the largest tech companies and data centers – you also need to be the leader, not just on innovation, but on rooting out bad actors.

The European approach, the GDPR, [littered] the internet with cookies and banners and created a … structure reliant on a bureaucracy approach [rather] than bright lines. I think the United States of America could do better.

We know that relying on cookies and notices and consent aren't enough to protect consumers. Consumers don't have the time or the resources to do due diligence on every single company that they transact with. According to a recent study, a consumer would need to spend 47 hours a month to read through privacy policies for the most commonly used websites. It's no wonder consumers just hit “accept,” so they can go about their online activity.

We need to shift to a framework from burdening consumers to setting that bright line for companies about the proper collection and use of consumer data.

A U.S. privacy law, in my mind, is a business necessity. Our digital economy is global, it's a global economy. And because we are not setting the standard, the United States that is, there is uncertainty for the U.S. leadership position in innovation and it creates a disadvantage [for businesses] when operating abroad.

In the absence of the law, there have been several efforts to establish cross-border data transfer frameworks that meet the GDPR adequacy requirements, but successful legal challenges in Europe invalidated prior frameworks, creating confusion for American companies about how and when they can participate in this cross-data flow.

The United States leads the world in innovation and technology, so I believe it's time to lead in privacy, too.

…………….

The second reason the demand for the privacy law is going to continue to grow, no matter what happens in a lame duck or happens next year, is that the American people are growing tired of this problem.

In poll after poll, we see overwhelming support for more, not less, privacy protection. In 2024, a survey by U.S. News and World Report said that 84% of respondents said the federal government should implement stricter data privacy laws. This is true across the political spectrum. In 2023, the Pew Research Center found that 68% of Republicans and 78% of [Democrats] … support more privacy regulation.

This is true in my home state, where a recent poll showed that nearly 90% of respondents were concerned that companies were violating their privacy by misusing and selling personal data. Only 7% said they were not worried about that. Makes you wonder, who are those 7%? I think it's safe to say that Americans being fed up is going to continue to grow. … In a recent USA Today poll, 74% of Americans said the government is failing to protect their personal data online.

Consumers … feel very helpless and the demand for Congress to deal with this issue is only growing. Consumers, in fact, want some control over their data. A University of Pennsylvania study found 91% of Americans want to control their data.

…………….

A Seattle man's car insurance went up 21% because his car was collecting and sharing information about his driving. Data brokers are selling women's location data showing Planned Parenthood visits with little regard to how it could be used. Addiction treatment information is being given to advertisers. Data brokers are selling health data about our troops for as little as 12 cents. Emergency room patients are being targeted [with ads for personal injury lawyers] …

The solution to consumers feeling powerless and frustrated is not a patchwork of state laws. Americans should have a strong federal privacy protection, no matter where they live, or no matter where they travel. The solution is not to pass a weak federal bill with no private right action. We need a strong national standard that can weed out the consumer harms that are serious to consumers – and defined in our legislation – and allow for [consumer] enforcement in court. This, I believe, is a much better bright line, less bureaucratic, definitely an improvement … for an information age that is continuing to unfold.

……………

We have two issues, the need for technology leadership on an international basis to set standards by having privacy law, and we have consumer anxiety reaching a high-pitch fever … Those two issues alone, in my opinion, demonstrate enough why we need to move forward on a federal privacy law, but let's just throw another one in, the kicker for really why we are going to have to get legislation. And that is that AI puts all of this on steroids.

AI brings us to an inflection point, whether we can establish the ground rules or really leave consumers defenseless.

As many technology leaders know, we needed to do something when AI continued to move forward.  Artificial intelligence lets companies use that data about online or offline behavior to infer all sorts of behavior about people. Most …  have no idea is even happening. No data point is too insignificant. AI lets companies take the massive troves of collected data and derive sensitive insights about people from information that used to be insignificant and too burdensome to process.

There is a broad consensus though that AI makes privacy even more critical.

……………

We have a unique opportunity for a bipartisan solution to give Americans that greater privacy protection they want, and the bright line that businesses who are operating within an accepted norm can continue to grow these important opportunities for our economy. I was very proud to work with my fellow colleague, Chair Rogers, on the American Privacy Rights Act because I saw the coming together of both the left and the right around this notion that people deserve to have their day in court.

It’s not something I know that the business community always gets comfortable with, but when it comes to substantial harm and bad actors, the community just needs to get together and understand that substantial harm is a very minimal bright line, very minimal. And consumers who have significant harm, significant financial, significant personal harm, should not be subject to binding arbitration with people who may have caused that harm.

………….…

Many of my colleagues on the left have said, well, we don't know if Congress is the right federal privacy standard because we haven’t gotten a lot done lately. I get that complaining. I get and understand that. …

I personally have been involved with four COVID bills, an aviation transportation safety bill in the aftermath of the MAX crashes, a massive investment in infrastructure, the IRA, the CHIPS and Science Act, and an FAA bill – all of those just in the last six years. So, the notion that Congress can’t act is not true.

Chair Cantwell has been a leading advocate for stronger privacy protections for American consumers. As Congress has worked to develop privacy legislation, she has repeatedly called for privacy rights that are both strong and enforceable by consumers. In April, Chair Cantwell and U.S. Representative Cathy McMorris Rodgers, Chair of the House Committee on Energy and Commerce, unveiled the American Privacy Rights Act, comprehensive draft legislation that sets clear, national data privacy rights and protections for Americans, eliminates the existing patchwork of state comprehensive data privacy laws and establishes robust enforcement mechanisms to hold violators accountable, including a private right of action for individuals. As Committee Chair, she held multiple hearings over the revelations of how Facebook’s unrestrained data practices harm children and teens, including testimony from Facebook whistleblower Frances Haugen. Chair Cantwell shepherded the overwhelming Senate passage of kids privacy legislation, after she passed the legislation out of the Senate Commerce Committee two years in a row.