“We’re not waiting for federal leadership in privacy,” said Colorado Attorney General Phil Weiser (D) during a Silicon Flatirons event Wednesday. Amid congressional inaction, Colorado was the third state to enact a comprehensive privacy bill, after California and Virginia. The AG office has sought to be transparent as it’s worked on rules for implementing the Colorado Privacy Act, said Weiser, quipping that the FCC is a “poster child [for] how not to do rulemaking.” Colorado plans to watch how state government manages data at the same time as it oversees the private sector, he said. The AG office will take the same approach with AI, he added. Also, as the AG office moves toward enforcement, it is focused on educating businesses. Weiser's “memo” for businesses: “Stop collecting so much data … Stop storing it for so long. Stop giving so many people access to it.” The AG said the recent U.S. Supreme Court decision on Chevron deference doesn’t formally affect states. “Informally, it’s possible that some state supreme courts will look at it.” However, Weiser finds the decision “entirely unpersuasive,” he said. “I am confident that [Colorado’s] supreme court will continue to provide agency deference.” The Colorado AG office recently set a Nov. 7 hearing on the latest proposed amendments to the Colorado Privacy Act (see 2409160036).
Minnesota Gov. Tim Walz, Vice President Kamala Harris’ running mate on the Democrats’ 2024 presidential ticket, enters the national stage with a record of pro-rural broadband action but is largely a blank slate on other tech and telecom matters, observers said in interviews. Harris announced Walz as her pick Tuesday after a two-week vetting process in which other governors with stronger broadband policy backgrounds were in contention (see 2407260001). Sen. JD Vance of Ohio, the Republicans’ vice presidential nominee, has been a leading congressional advocate for injecting funding into the FCC’s lapsed affordable connectivity program (see 2407150062).
House Speaker Mike Johnson, R-La., should bring up kids’ online safety legislation in September, Republican senators told us in interviews after the Senate's overwhelming passage of the measures last week.
The Senate voted 91-3 on Tuesday to approve a pair of kids’ online safety bills, shifting attention to the House, where the legislation awaits committee consideration.
Maine and Vermont legislators will reintroduce comprehensive privacy bills next session, lead sponsors told us in interviews. Republican Gov. Phil Scott’s veto of Vermont’s privacy bill hasn’t discouraged supporters from seeking a private right of action (PRA) that Scott and industry opposed, Rep. Monique Priestley (D), the comprehensive measure’s sponsor, said. Meanwhile, in Maine, a veto threat from Gov. Janet Mills (D) means neither party will pursue a PRA in the upcoming session, Sen. Lisa Keim (R) told us. Mills' opposition to a PRA made it a nonstarter this session.
Rhode Island’s comprehensive privacy bill will become law without the state's governor’s signature. It will become the 20th state with a privacy law. Gov. Dan McKee (D) sent H-7787 to the secretary of state with no signature earlier this week, meaning it will become law under state rules. H-7787 is based on Connecticut’s privacy law. Industry groups, including TechNet, supported it. The legislature approved the measure earlier this month, despite some consumer privacy advocates saying the bill is too weak, including because it doesn’t require companies to honor browser-based privacy signals as global opt-outs and exempts pseudonymous data (see 2406140017 and 2406120012). Rhode Island’s law will take effect Jan. 1.
A Pennsylvania Senate panel delayed the effective date of a comprehensive privacy bill to one year after it’s enacted. That would be six months later than proposed in a previous version of HB-1201, which unanimously cleared the Communications Committee with the amendment at a livestreamed hearing Wednesday. The change would “give businesses enough time to make the appropriate process changes to comply,” said Chair Tracy Pennycuick (R). “Additionally, the amendment clarifies that a private right of action is not open in conjunction with any other law.” The bill had already said that nothing in it “shall be construed as providing the basis for a private right of action for a violation of the provisions of this act,” with enforcement to be conducted solely by the Pennsylvania attorney general. Sponsor Rep. Ed Neilson (D) said Pennsylvania should pass the “bipartisan” measure to join nearly 20 other states with privacy bills. "We are falling behind the other states that are doing it all across the country." The bill will likely need approval from the Appropriations Committee before it can go to the Senate floor, a Pennycuick spokesperson said. The House voted 139-62 last March to pass HB-1201 (see 2403190009). Microsoft supported Pennsylvania’s privacy bill last year (see 2309060060).
Sen. Ted Cruz, R-Texas, told us Thursday he supports allowing victims of deepfake porn to sue violators, as Senate Judiciary Committee Chairman Dick Durbin, D-Ill., proposed.
Vermont legislators failed to override a veto of the state's comprehensive privacy bill. Last week Gov. Phil Scott (R) vetoed H-121, which controversially included a private right of action and a kids code section similar to a California law that was temporarily enjoined. The tech industry lauded Scott's veto, while consumer advocates and the bill’s sponsor urged a legislative override (see 2406140017). Overrides require a two-thirds majority from each chamber. On Monday, the House met that threshold with a 128-17 vote, but the effort died in the Senate, where members voted 14-15. “Industry feared this legislation and worked so hard to kill it because it had real teeth to prevent their harmful data practices,” Consumer Reports Policy Analyst Matt Schwartz said. But the fight for strong Vermont privacy protections will continue, he added. The failure also disappointed Design It For Us, said co-Chair Zamaan Qureshi: The bill “would have been a much-needed step toward protecting youth from the sustained exploitation and undue harms that we experience from social media.”
Vermont’s comprehensive data privacy bill “creates an unnecessary and avoidable level of risk,” said Gov. Phil Scott (R) Thursday as he vetoed H-121. It was a win for tech industry opponents (see 2405300038) and a setback for consumer group supporters of the bill that would have made Vermont the first state with a broad private right of action (PRA). It's possible, however, for lawmakers to override Scott’s veto with a two-thirds vote in each chamber. Also Thursday, the Rhode Island legislature approved a privacy bill that consumer groups say is too weak.