As the pandemic has shifted our daily lives, we are relying on the internet, smartphones and other digital tools more than ever. Many workers have more flexibility to work where they want and some tech companies are relocating to Florida.
Florida could now play a key role to play in checking the power of big tech companies and protecting the privacy of people across the state. California has paved the way for online privacy laws at the state level. Policymakers in Tallahassee are working on privacy legislation that is rapidly advancing through the state legislature.
It’s important that any privacy legislation puts consumers first. An ideal privacy law would set strong limits on the data that companies can collect and share. Consumers should be able to use a website or app safely without having to take any action to protect their privacy, such as opting in or opting out of information sharing — as described in our model bill. A privacy bill should not place the burden on the individual to opt out of hundreds, or thousands, of different companies. Consumer Reports has found that opting out of information sharing can be incredibly complicated, but there are ways to make it simpler for people.
So, while we would recommend a privacy bill that doesn’t rely on people opting out, we do believe even an opt-out-based bill could help consumers. It needs to provide a comprehensive opt-out that allows consumers to stop all data disclosures for advertising purposes; strong enforcement, with no right to cure and a private right of action; and a global opt-out, so that consumers can stop the disclosure of their information in a single step.
For example, California’s privacy law allows people to send a universal message, like a signal from their internet browser, to opt out of information sharing, and companies are required to accept it. Plus, the California law lets people use an “authorized agent” — a third party, like an app provider, that will perform data requests on their behalf. CR looked at how authorized agents are performing in California and found that in any emerging privacy law like Florida’s, it would make it much easier for people to manage their data and personal information.
These lessons we are learning in California should be applied in Florida. Any bill that advances in Florida should include provisions for global opt-outs and authorized agents, so consumers can stop the sale of their information with a single step. Otherwise, Floridians will have to opt out of every website one by one, which is not workable.
Florida should also take heed of the playbook that companies used after Europe’s General Data Protection Regulation went into effect in 2018. The new rule hasn’t been adequately enforced, so companies operating in Europe have in many cases avoided meaningful compliance. That’s why lawmakers in Florida should avoid a troublesome “right to cure” provision, because it could allow companies to avoid any punishment for breaking the law. And they should include a measure to allow consumers to hold companies legally accountable for violating their privacy rights.
Finally, policymakers in Tallahassee should ensure that opt-out rights include all data sharing, and ensure targeted advertising is adequately covered. In California, many companies have sought to avoid the state law by claiming that most online data sharing is not technically a “sale.” To address this problem, California voters recently approved a ballot initiative that expands the scope of California’s opt-out to include data sharing, and it clarifies that targeted ads are clearly covered when you opt out.
Without an opt-out that adequately covers targeted advertising, internet giants like Google, Facebook and Amazon could serve targeted ads on other websites based on their own vast data stores, with no way for consumers to opt out. This loophole would undermine privacy interests and further entrench dominant players in the online advertising ecosystem.
While more remains to be done to strengthen the existing legislation, Florida has a prime opportunity to not only protect the privacy rights of its citizens but also to become a model for other states and the U.S. Congress to follow.
Maureen Mahoney is a senior policy analyst for Consumer Reports, focused on consumer tech and privacy.
Morning Consult welcomes op-ed submissions on policy, politics and business strategy in our coverage areas. Updated submission guidelines can be found here.