Stephen Cobb

Welcome to the fourth season of State AG Pulse. In this season, we’re diving into the state and federal political landscape in the run-up to the  general election. We’re talking with our colleagues at Cozen Public Strategies to uncover information and insights to help business leaders make better decisions.

Meghan Stoppel

Welcome to another episode of State AG Pulse. My name is Meghan Stoppel and I’m a partner here in Cozen O’Connor’s State Attorneys General Group. Joining me today from our group and also from the great state of Oregon is my colleague Keturah Taylor. Welcome Keturah.

Keturah Taylor

Thanks, Meghan. It’s great to be back on the podcast.

Meghan Stoppel

Great to have you with us. Keturah and I are joined today by our colleague, Madison Smith, from Cozen Public Strategies in our D.C. office. Madison is a longtime former Capitol Hill staffer. We’re thrilled to have Madison here to share his experience and expertise on the topic of privacy. Madison, welcome to the podcast.

Madison Smith

Yeah, thanks to you both, it’s exciting to be on.

Meghan Stoppel

Yeah. So Madison, as I mentioned just a second ago, as you know, the topic for discussion today is privacy and more specifically privacy legislation at both the state and federal levels. I know you’ve been actively tracking activity in this area at Congress’s level on behalf of your clients, and I can’t wait to get in the weeds along with you and Keturah on that topic.

But I think before we dive into what Congress is, or as I think detractors may like to say, what Congress is NOT doing on the topic of privacy legislation, I wanted to take a step back and talk about what we’re seeing at the state level since I think all of us will probably agree that there’s been sort of a hotbed of activity in the last couple of years. Maryland signed its legislation into law on May th. That’s going to be the most recent state governor that signed its legislation into law. And we’ve got a couple other states, Vermont and Minnesota, that have since passed legislation and those bills are awaiting signature by their respective governors. But I think what’s really fascinating here is that five of those laws to date have been passed in this calendar year alone. And operationally some of those are going to be more challenging than others, sort of from a compliance perspective. Not every state privacy law has the same exemptions, some exempt certain types of data, some exempt certain types of entities that are regulated by federal privacy laws like HIPAA. Some exempt nonprofits, others don’t. And of course, depending upon when they’re passed, they all have varying effective dates. There are a number of these laws that are already in effect. Some are coming into effect this July, like the one in Texas. I think Indiana and Kentucky are going to be in effect January  of . Those folks there have a little bit more time, but we’re starting to see a little bit of a deviation in some of the models. Keturah, is there anything else with respect to what we’re seeing at the state level just at a very high level that you would want to call out for our listeners before we bring Madison into the conversation?

Keturah Taylor

Sure. As you mentioned at this point, almost a third of the states have passed their own comprehensive privacy laws. About five of those are currently in effect. We’re going to see effective dates for the rest of them rolling out over the next few years. Something that I found interesting about the law recently passed in Vermont is that it particularly includes protections for children online and when using social media. So that’s not something that we saw in the laws that were passed on the earlier side, but I think we’re going to see that more and more as states focus on those issues.

Meghan Stoppel

Yeah, as I mentioned, we are starting to sort of see that deviation, I think, from what we originally saw as sort of the California and Virginia models; deviation in either data minimization requirements, deviation in language related to sensitive data or children. But Madison, I want to bring you into this conversation. And before we turn to sort of a discussion of legislation that Congress is actually considering, I am curious from a practical perspective, how closely is Congress or even their staff tracking these state law developments from one state to another? Are these nuances relevant from their perspective? What are the issues that they’re watching, if any, at the state level?

Madison Smith

Yeah, I would say historically up until the last few years, they hadn’t tracked super closely. I think Congress was concerned about what needed to be done federally and was looking for ways and exploring the possibility of passing something that was a preemptive federal framework. But I think frankly, as both of you have outlined, the sheer volume of states now that are passing their own privacy measures and are creating this patchwork of compliance nightmares for industry has all of a sudden gotten Congress to say, okay, this isn’t one or two states anymore.

This is now in the high, almost , and pretty soon could be more than half of the states in the US that have their own privacy framework. So the extent to which federal lawmakers in DC are tracking, I would say certainly their staffs are. And they’re well aware that the longer this goes on and the longer that they’re unable to put together something that is agreeable and send it to the president’s desk is only going to create more and more headaches for industry and consumers.

Meghan Stoppel

Yeah. I mean, great point. And certainly those headaches are not going away any time soon because, Keturah, as you and I have talked about offline before, I mean even in those states where they’ve passed the legislation, it’s gone into effect, some of those states have rulemaking authority like California, Colorado, so they have that ability to put even a little bit more nuance into the regulatory scheme than what even the state legislature did when passing the law.

But we’re also seeing with some of these laws that are getting passed, appropriations passed with the state legislation. I mean, Texas is a great example. I think the Texas legislature gave the AG’s office down there $ million to basically stand up a new privacy unit to enforce that law later this year. So this is not going away. Even in those states that have sort of closed the book on the policy debate and passed their laws, they’re now turning their attention to enforcement.

So that regulatory headache is becoming very real in some of these states. Luckily in some states we’re getting reports coming out of the AG’s office about what they’re seeing, what they’re doing, but other states are more of a black box. So Keturah, you mentioned at the top of the conversation really recently passed legislation in Vermont and in Minnesota. Let’s talk about those two bills specifically for a minute because I do think this might feed into the conversation about what Congress is doing. It’s my understanding both of those bills are still making their way through the legislative process. Is that your understanding as well?

Keturah Taylor

Yeah. So both of those have been passed by the respective state legislatures, but as of the date of this recording, they have not yet been signed by the governors. Who knows, by the time this podcast comes out, maybe they will have been. So these laws are moving quickly and I’m sure we’ll see both of them enacted very soon.

Meghan Stoppel

Yeah, I agree. And I think if I was a betting person, I would bet that they’re both going to become law. Though from reading some of the commentary, it sounds like the Vermont governor’s being lobbied pretty hard by industry and even small businesses in the state of Vermont to come out against the law. But I think to your point, Madison, a minute ago, I assume developments like this, especially in states like Vermont, where we really are seeing language that deviates from some of those pre-existing models, I’m assuming that only adds fuel to the conversation in Congress about the need for a federal standard. Is that sort of your take on it?

Madison Smith

Yeah, no question. I think what you’ve seen at the beginning and the outset of the first few states was that they were applying a template of sorts and that was being deviated from slightly in certain areas to fit what they wanted to do in their various states and local jurisdictions. But now that you’re seeing all of these additional patchworks come through, some of which are wildly different than what you’ve seen in other states, I think, yes, that absolutely adds fuel to the fire and is making Congress feel like they need to work even harder and more diligently to produce something.

Meghan Stoppel

Yeah. It is probably also worth noting that, I mean, we’re not even out of the legislative season in some of these states. I think Pennsylvania still very much is in session. They have legislation that’s in cross-committee, so they could successfully get something passed this year. And then I would certainly expect more states to successfully pass this legislation next year.

Madison, let’s turn to sort of a discussion of what we are seeing at the federal level and how that discussion is informed by what’s happening at the state level. I think the most recent piece of legislation that’s gotten a lot of attention in the headlines is the American Privacy Rights Act, although that certainly wasn’t… It’s not been the first piece of legislation introduced on this topic and may not be the last. What do you think our listeners need to know about the APRA and sort of what came before it and what are the odds of Congress actually doing something on this topic?

Madison Smith

So a lot to unpack there. And I think the best way to learn about the future is to understand the history. And quite frankly, the history on this isn’t pretty. The FTC, going back to , has been spinning its wheels and saying we should probably be taking a look at a federal privacy framework. The calls for that have gotten greater, not only from the FTC but from other regulatory entities in the federal government and also from Congress. And I think as our economy has become increasingly digital and consumers have so much of a stake and so much data tied up in our economy these days, the need for this to be done is growing by the day. I think as far as how we got here, APRA was somewhat groundbreaking in Washington inside the Beltway because quite frankly, it took everybody by surprise a little bit.

Its predecessor that was introduced last Congress that had a lot of momentum right after it was filed and then kind of collapsed under its own weight, that was called the ADPPA. APRA is essentially much of the same bill with a few minor tweaks that we can talk about here in a little bit. But you’re seeing a renewed push under APRA to try to get Congress to get its act together, pass something. But unfortunately, a lot of the same political impediments and dynamic that existed last Congress still exist now.

The House is operating under the slimmest of majorities. Some even call it a phantom Republican majority because it’s a very difficult time for House leadership to try to coalesce its Republican majority together. And you also have the fact that it’s not only an election year, but it’s also a presidential election year. So there are a lot of members that are posturing on this and potentially taking into consideration “I may have a better shot at actually writing this bill and not being in the minority party next year, so should I actually do this now or should I put my ball on the roulette wheel and see what comes out in November?”

So all of those things are kind of factoring in to APRA’s viability. I will say there are some important procedural steps actually happening this week related to that bill. There is a subcommittee hearing in the House, which is the first legislative procedure necessary to consider that legislation. There is talk in DC about the full committee hearing being in early June, and then at that point where it goes from here is anybody’s best guess. The procedural next step that would be most likely would be it would go to the full House floor. But we don’t have any indication that that’s in fact going to happen yet. And there’s still a lot of consensus building around that bill that needs to happen because industry has already expressed some pretty severe concerns around some of the provisions.

Meghan Stoppel

Oh, that’s really interesting. So the provisions that industry is expressing concern about in APRA, are those the same provisions that they would’ve seen in ADPPA or is this new language that’s coming to the fore for the first time?

Madison Smith

They are. By and large, they’re the same concerns. I think there are nuanced and niche concerns, I would call them, in both bills that are a little bit different. But if we really want to boil down this debate at the federal level, it really comes down to two things private right of action and preemption. And at the end of the day, those are the two hurdles that [inaudible] side has been unable to bridge a compromise on. On the private right of action side, I would say you generally have Republicans who are opposed to that. You have Democrats who have been more willing to entertain it.

The one caveat there, is I will say, you started to see a few Republicans who’ve broken loose on that position. And then on the preemption issue, you generally have Republicans who think that whatever bill we pass, if we’re going through this exercise, it should preempt every single state law on the books from now and into the future. And there are some Democrats who think that various state laws such as California’s need to be carved out from those exemptions. So until those two issues seem to have a viable solution, I think it’s going to put a stake in the ground on the progress.

Meghan Stoppel

Yeah, no, I absolutely agree. And that’s definitely the recurring theme, if you will, that we’ve seen in the discussions around proposed federal legislation on this topic for, gosh, going back at least probably three years now, is the private right of action and the preemption issue. I mean, I know the California Attorney General, Rob Bonta, and a number of other AGs, I think it was thirteen AGs, actually sent a letter to Congress recently again on this issue of preemption, basically saying, look, it’s fine if you want to pass federal privacy protections, but whatever that framework is, it needs to not preempt more rigorous state laws on this topic.

So I think that’s going to continue and certainly has always been, regardless of the topic that we’re talking about, sort of a major red flag for the state AGs. And Keturah, I think you would agree with me on that, that those two issues are going to be a huge hurdle when it comes to getting the AGs’ support on federal legislation.

Keturah Taylor

Yes, absolutely. And I think the letter writing and advocacy we’ve seen from the AG offices so far is just the tip of the iceberg on how much they’ll feel compelled to weigh in on any kind of federal legislation. And we’ll see. It remains to be seen what impact that will have, but they’ll certainly have lots to say about it as it progresses.

Meghan Stoppel

Yeah, absolutely. So Madison, you made a comment about, again, the nuances and the similarities between prior federal legislation and this bill, the APRA. I’m curious, is your experience and your gut telling you that this bill’s going to go the same way as the ADPPA and sort of, as you said, collapse under its own weight? Or based on what you’re seeing on the ground, is this version of legislation, does it have a greater likelihood of success?

Madison Smith

So I’ll say at the outset, if there’s one thing that I’ve become, I hate doing now in Washington, especially over the last four to eight years is making predictions. Because things always seem to go the unexpected route. But with that caveat in place, look, I think on the pro side of this deal, you have… the two chairs of the committees that matter the most are the bill sponsors. You have Cathy McMorris Rogers in the house who’s the chairwoman of House Energy and Commerce, and then you have Maria Cantwell in the Senate who’s the Chairwoman of Commerce, Science and Transportation.

They are the two key lawmakers to sponsor a federal privacy bill. And in any Congress where you’re going to get something done, you need the leaders of those committees to be behind it. So that in and of itself is an accomplishment. It’s a bipartisan effort. I will say I do think that given the fact that we are almost to June now, ahead of a November election, and we are at the phase in an election cycle where Congress usually slows down on its legislating and we are already in a Congress that has been historically lowly productive, I think the political climate does not yield a very high likelihood to both sides feeling like they need to give and take on this issue.

And quite frankly, I don’t know that I’ve seen a ton of pressure back home. I think given a lot of the other macro political issues that are out there right now that are fueling the presidential campaign and some of these national races, if you took a poll, consumer privacy is probably pretty low on the list compared to some of the economic and geopolitical issues we’re seeing.

So all of those factors together I think probably make it more likely than not that we will not see a comprehensive agreement this year at the federal level. Having said that, never say never. And I think both sides are still trying, and it’s clear that this isn’t just an effort in messaging. There is a true effort going on behind the scenes to get this done.

Meghan Stoppel

Yeah, no. And it’s a great point about sort of where this issue lies in the list of priorities both for voters and constituents, but also their representatives in Congress and regulators. Because I feel like I can’t turn on the morning news anymore without hearing a story about AI or artificial intelligence and how it’s affecting children or the business community. So I feel like we’re getting more attention around the technology issues on a day to day basis, but I’m not seeing then that translate to an increased focus or attention on privacy generally. Unless you’re talking about things like social media or children online.

Madison Smith

Well, and that’s an interesting point because you have seen quite a bit of Beltway fodder about KOSA and COPPA and specifically focused on children’s privacy online. But I think that is also another factor that plays into this a little bit, which is that because consumer privacy and data are so ubiquitous now, and it touches nearly every sector, you have these other piecemeal laws that have already been enacted that are governing their sector-specific privacy rights.

HIPAA, Gramm-Leach-Bliley, all of these other statutes that are already in existence. Whether or not they need reform, you have a jurisdictional problem a little bit in Congress because each of the respective committees that oversees their fiefdom or sandbox, so to speak, only wants to touch that. And as a result, you’ve now got all of these sector-specific industries coming into play, and they all have very different views on how these things should be regulated or not regulated. And I think that’s just another complicating factor that is really driving the insanity here.

Meghan Stoppel

Yeah, no. It’s a great point. We haven’t talked about the number of congressmen and women that have actually come from state AG offices. We have had a number of state AGs move onto higher office, whether that’s the governor’s mansion in a state or a senator seat or a Congress, whatever it is, House of Representatives. We’re up to seven now, current Congressmen and women that have been former AGs, is that where we’re at?

Keturah Taylor

I think that’s right, currently. As you mentioned, I mean the AG’s office is often a launch pad to other political offices, whether it’s the governor’s office or Congress. To the extent someone’s previously been in an AG office where they were responsible for enforcing privacy laws or other consumer protection laws, antitrust, things like that, of course they’re going to bring that experience and knowledge with them to their new federal positions. It may be helpful to an extent, but considering how relatively new these privacy considerations are, some of those current sitting senators weren’t necessarily grappling with this when they were in the AG office.

Meghan Stoppel

Yeah, no, you’re absolutely right. We’re talking about folks like Josh Hawley.

Madison Smith

I know who one of them is because he’s my former boss.

Meghan Stoppel

John Cornyn. Which I think was your former boss. Catherine Cortez Masto. And of course the illustrious Richard Blumenthal, which I think, out of this group we’re talking about, he probably has the longest track record of sort of being a consumer protection advocate. Certainly had an illustrious career in the Connecticut AG’s office and quite a reputation in that office as a consumer protection leader in the AG space. He was the AG in Connecticut back when I started in this world as a lowly recent graduate of law school. So I would assume he’s plugged in on these conversations, but as Madison was alluding to, this is a consensus building exercise. No one’s really winning. We’re just trying to build consensus.

But it is important. I think it’s important for our listeners and for anyone trying to engage with policymakers at the federal level to understand who these people are, where they came from, the fact that as attorneys general, they would’ve had ability to have these consumer protection and privacy related conversations with both their constituents and their staffs.

Madison, you’ve talked a little bit about how the  election cycle may impact what we see with APRA at the federal level, but I do want to spend a few minutes talking about the  elections. Again, both at the state and the federal levels and how that could impact the privacy conversation, both in Congress and in the states. Because we also do have state AG elections coming up in  states this year where the results of those elections could impact how some of these laws actually get enforced.

But if I understand your position, Madison, I think the closer we get to November, the less likely it is that anything’s going to get done on privacy legislation. I mean, is that a fair statement?

Madison Smith

Yes, it is. I think it gets harder and harder. And if you look at the legislative calendar, both the House and the Senate and what’s planned between now and November, after the middle of, really, July, once you hit August, they’re here for about three weeks between August and November. So they’re probably going to be… And it’s possible that some of that time gets cut off, quite frankly. They come back, they’ll probably pass a continuing resolution to keep the government funded at flat levels and then break until the election. And the election will have some bearing on whether the lame duck is active or not. But we’re really already at the point now where time is at a premium for floor consideration of any bill really.

Meghan Stoppel

And I take it from your comments as well today that this is probably not an issue people are out there campaigning on. I mean, are there certain races, states, individual candidates from your perspective that maybe… I mean, other than the sponsors obviously, of the legislation that may be campaigning on this issue in particular?

Madison Smith

So campaigning per se, I don’t think so. I would say though that this is a layered and complicated issue in terms of the external political factors that affect it. Because obviously first and foremost, which party wins the White House and which party wins the two houses of Congress, is going to be very important. It is hard at this point in time, I think, for anybody to see where either party has unified control of the government.

I think we’re probably looking at a situation where Congress is split one way or the other, and then what happens in the White House is still up in the air. But if you’re in a situation where Democrats take over the House and Republicans take control of the Senate, which I think is probably the most likely outcome in both circumstances, then we’re in a divided government again, just the other way around. Sometimes divided government means that you produce compromise. Other times it means that you’re woefully inefficient. We’ll see what happens there.

So I think that’s kind of the first political factor to take into account is what happens in November generally. I think other than that, you take into account that the two sponsors I mentioned of that Bill, one of them being Cathy McMorris Rogers, she’s retiring. So for her, this is a legacy issue. She is trying very hard to get this done before she retires and wants to hang her hat on this bill as a kind of monumental achievement. And I think there is going to be another Republican leader on the Energy and Commerce Committee. There are a few members that have already thrown their hat in the ring publicly for that position. And they’re likely to have very different approaches to these issues and probably will have a base starting point that is quite different than what Chair McMorris Rogers had.

You also have Senator Cruz up for reelection. I think his seat is probably pretty safe, Republican, but at the same time, he could be in a position where instead of being the ranking member on Congress committee, he’s the chair. And if that happens, then he’s going to be writing the bill on his side. So you’ve got a lot of races that are going to have an effect on privacy legislation.

Meghan Stoppel

We’ve got races happening in Pennsylvania, in Utah, in Oregon, in Vermont. Some of these really critical states that have either already passed legislation or are sort of on the precipice of passing legislation. And I mentioned Pennsylvania specifically, because while I don’t know that there’s going to be an upset, it’s a seat that’s been traditionally held by a Democratic AG going back decades. I think there is a possibility that a Republican could win that seat, or at least some commentators are speculating on that possibility.

I think a turn in that office at the highest level could result in some fairly significant effects on how comprehensive privacy legislation would get enforced by that office, which is certainly sort of a debate that we’ve seen play out somewhat publicly in other states like Virginia, who have not been given appropriations specifically for enforcement purposes. So we are definitely keeping our eye on some of those races. I mean, some of them are in more safe, traditionally Democratic strongholds Oregon, Washington, Vermont. So I think regardless of who the officeholder is, we suspect privacy is going to continue to be a priority, but we shall see.

Katurah, any thoughts before we wrap up, on how the elections at the state level might impact either legislation in  or enforcement of laws that are already on the books?

Keturah Taylor

Yeah, I mean, one thing to add to your point is that I don’t think it’s necessarily a foregone conclusion that if you have a new Democratic AG that they necessarily will focus particularly on robust privacy enforcement, because like you said, it comes down to the resources available. So some offices aren’t going to have appropriations for that enforcement, and they have to make tough decisions about which enforcement divisions to staff up. So we’ll see how that all plays out once those new AGs take office next year. I also think it’ll be interesting to see how many of those candidates campaigning right now focus on privacy issues as compared to those more hot button issues like AI or protecting children online.

Meghan Stoppel

Yeah, and certainly this is a topic that’s competing with other hot topics, right? Whether it’s women’s reproductive health, state rights generally and pushing back on overreach by the federal government. I mean, some of those other common themes that we see come out in state AG election cycles.

Well, I hope this conversation has been helpful for our audience. I know it’s been enlightening for me. Madison, Keturah, thank you again for taking the time to join us on today’s podcast, and Madison especially for sharing your insights. I really appreciate it. Hope I can have you back sometime on another episode. And thank you to our listeners.

Stephen Cobb

You’ve been listening to State AG Pulse, brought to you by Cozen O’Connor’s State AG Group and the State AG Report. Please leave us a five-star rating and of course, tune in again in two weeks for our next episode.