State Privacy Updates - 2/24

Welcome to The Patchwork Dispatch, a fortnightly (maybe) newsletter that brings you the top 5 recent developments in consumer privacy legislation, regulation, and enforcement across the U.S. states. Here's what you need to know:

1. Florida Floats 'Digital Bill of Rights'

At a February 15 press conference, Governor Ron DeSantis announced that he will be supporting legislation to create a "digital bill of rights" for Floridians. The text of the bill (or bills) to enact this framework has yet to be released. While the primary focus of the initiative appears to be directed towards perceived "Big Tech" bias against conservative viewpoints, several elements of the proposal implicate privacy.

First, the Governor laid out a right to "control all your personal data" on the "largest and most common platforms" noting that "Google, Facebook, just a handful of these companies, they should really get express authorization from you before they're able to monetize that [data] or use it in any way." While statements in press conferences should never be relied upon to reflect the nuances in actual legislation (regarding privacy or otherwise), the Governor's speech suggests that forthcoming privacy legislation in Florida may lean very heavily on expansive consent requirements and include high coverage thresholds in an attempt to solely capture specific disfavored out-of-state companies.

The proposal also includes a right to have private in-person conversations "without big tech surveillance." The limited focus to offline, "in-person" conversations is notable, and should not be interpreted as support for encrypted communications. Finally, the proposal includes a "right to protect children from online harms" which could mean many things, but such rhetoric is usually connected to legislation that would mandate the implementation privacy-implicating age-verification and parental monitoring systems (see Utah below).

The "digital bill of rights" proposal cements Florida's status as a wild-card on tech policy issues. In each of the past two years, unique CCPA-derived legislation containing a private right of action passed the Florida State House by overwhelming margins (HB 969 (2021); HB 9 (2022)), bucking the trend of more industry-friendly proposals emerging in deep red states. While the primary sponsor of these prior bills recently predicted that comprehensive privacy legislation would not make it over the finish line in Florida in the short term, the Governor's announcement seems to ensure the Sunshine State will remain in the mix for the expanding privacy patchwork.

2. New Round of Proposed California Amendments

Given various amendments, rulemaking processes, and ballot initiatives, the contours of privacy rights and obligations in California have seldom remained stable for more than a few months at a time since the enactment of the CCPA back in 2018. With a new legislative session freshly underway, California lawmakers have, to date, proposed the following tweaks to the CCPA:

• AB 1194: would provide that information concerning an individual accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care is not subject to the CCPA exception for danger of death or serious physical injury.
• AB 1546: would establish a five year statute of limitations for Attorney General enforcement (matching the statute of limitations that exists for California Privacy Protection Agency enforcement).
• AB 1721: contains minor clarifications to the CCPA's notice and service provider contracting requirements.

3. Promising New Hampshire Bill Encounters Committee Setback

The Dispatch has previously covered New Hampshire SB 255, a bipartisan, bicameral bill that is closely aligned with the recently enacted Connecticut privacy law. On February 17, the Senate Judiciary Committee took up the proposal. Testifying as "neutral," a representative of the New Hampshire Attorney General's office raised concerns that as presently drafted it "would be an impossible bill to enforce." The hearing adjourned without further action on this legislation. While there is likely still time for SB 255 to advance this session and amendments may be introduced, the enforcement concerns raised by the AG's office mirror objections raised by Attorneys General in both Washington and Indiana that contributed to the failure of previous privacy proposals in those states.

4. Utah Maintains Two-Track Approach to Social Media Restrictions

Last week's Dispatch covered two related bills in Utah (SB 152?/?HB 311) seeking to impose new restrictions on the use of social media platforms by minors and adolescents. Both bills have continued to progress:

• HB 311 cleared the House by a 68-6 vote and passed a second reading in the Senate by a 22-5 vote.
• SB 152 cleared the Senate by a 23-4 vote and passed a House Judiciary Committee by an 8-0 vote.

While initially containing similar provisions, the text of the two proposals has diverged since they were introduced. HB 311 would now create a private right of action for any addiction, financial, physical, or emotional harm suffered by a Utah minor (under age 18) on account of using a social media platform with a rebuttable presumption for users under age 16 that such harm actually occurred as a result of using the platform. The bill also prohibits the design of social media features that cause addiction.

As currently drafted, SB 152 is more prescriptive. It would:

1. Require social media platforms to obtain parental consent before allowing a minor to open an account
2. Require social media platforms to verify the age of all users based on a process to be established by rulemaking
3. Establish restrictions on minor-held accounts including prohibiting the display of any advertising, only permitting minor-held accounts to message with other accounts that are linked through "friending", and prohibiting the use of "targeted or suggested" groups, services, products, posts, accounts or users
4. Require social media platforms to allow parents and guardians to view all of a minor's posts and messages on a social media account
5. Prohibit access to a minor-held social media account between 10:30pm - 6:30am

While additional substitute amendments are possible, it appears likely that both bills will clear the Utah legislature in some form in the coming weeks. Watch these bills folks...

5. New Bills in Connecticut

Last year Connecticut raised the bar for U.S. state privacy protections with the enactment of Senate Bill 6, an Act Concerning Personal Data Privacy and Online Monitoring (CTDPA)* which will take effect July 1, 2023. As with California and Utah, Connecticut is demonstrating that adopting 'comprehensive' consumer privacy legislation can be just the first step for lawmakers' engagement with privacy issues. This week, Connecticut's General Law Committee introduced SB 1103 which would:

1. Update the CTDPA to: (A) add an entity level carveout for air carriers, and (B) fix an error in the knowledge standard for the provisions on child and adolescent data ('actual knowledge OR willfully disregards' not 'and').
2. Establish an Office of Artificial Intelligence tasked with conducting a review and inventory automated systems used by state agencies, ensuring that such systems meet various standards including compliance civil rights laws.
3. Establish a task force to study artificial intelligence and develop an 'artificial intelligence bill of rights.'

SB 1103 is scheduled for a first hearing on Tuesday, February 28.

Furthermore, during a recent Connecticut Data Privacy Task force meeting, Senator Maroney (chief sponsor of the CTDPA) signaled that additional privacy legislation will be considered in Connecticut this year, including proposals addressing consumer health data and child online privacy and safety.

As always, thanks for stopping by.

Keir Lamont is the Director for U.S. Legislation at the?Future of Privacy Forum

____________________________________________________

*While the Dispatch previously used the more accurate acronym "CACPDPOM" to refer to SB 6, we are transitioning to "CTDPA" due to the CT AG's preference for this term.