Preemption is bonkers from a privacy perspective, and also flies in the face of the basic principle that the states are “the laboratories of democracy.” But from a corporate perspective preemption is wonderful … it keeps pesky pro-privacy states like California and Washington from ever raising the bar above whatever can get through Congress! So historically privacy advocates and organizations have always opposed preemptive federal legislation. But that wall cracked in 2022, where EPIC Privacy joined pro-industry privacy orgs like Future of Privacy Forum to support a preemptive bill (although EFF and ACLU continued to oppose the preemptive aspects).

The argument for supporting a preemptive bill (not that I agree with it, I’m just relaying it) is that the federal bill is stronger than state privacy bills (California unsurprisingly disagreed), and many states won’t pass any privacy bill. Industry hates preemption, industry hates the idea of a private right of action where people can sue companies, most Republicans and corporate Democrats will do what industry wants, so the only way to pass a bill is to include at most one of those. So the only way to get that level of privacy protection for everybody is for people in California, Maine, Illinois, etc, to give up some of their existing protection, and for people in Washington etc to give up the chance of passing stronger consumer privacy laws in the future. California of course didn’t like that (neither did other states but California has a lot of votes in Congress), and Cantwell’s staffers also told us in Washington that she was opposed to any preemptive bill, so things deadlocked in 2022.

With this bill, I’m not sure why Cantwell’s position has changed – we’re trying to set up a meeting with her, if we find out I’ll let you know. I’m also not sure whether the changes in this bill are enough to get California on board. So, we shall see.