EPIC Gives Some States' Consumer Privacy Laws Failing Grades

“Many of these ‘privacy laws’ protect privacy in name only,” said Caitriona Fitzgerald, deputy director of EPIC. “In effect, they allow companies to continue hoarding our personal data and using it for whatever purposes they want. Big Tech should not be allowed to write the rules.”

The scorecard was created in partnership with the U.S. PIRG Education Fund. The states that received a failing grade were: Texas, Kentucky, Nebraska, Indiana, Virginia, Utah, Tennessee and Iowa; barely passing, at D, were: Rhode Island, Montana, New Hampshire and Connecticut; Delaware, Oregon and Minnesota did slightly better, receiving C-; New Jersey got a C, Colorado a C+ and the two best states, California and Maryland, received a B+ and B-, respectively.

There were common problems among the states that failed, EPIC said. For example, none had data minimization frameworks, required businesses to honor universal opt-out signals, or included a private right of action. “At best, these laws enshrine the status quo,” the scorecard said. “At worst, they allow Big Tech to give the illusion of privacy while at the same time lobbying in states all across the country to strip away consumer protections and weaken privacy laws.”

California’s privacy law, which went into effect in 2020, is one of the strongest but is missing several features, including private right of action for violations other than data breaches, detailed restrictions on data minimization framework and default limits on cross-site browser tracking. Maryland, whose law is set to take effect Oct. 1 and got the second-highest score, is missing a private right of action and rulemaking authority for the attorney general.

“Grading these laws really makes it clear that they’re almost all copy-and-paste versions of a bill [that] industry originally wrote,” said Kara Williams, law fellow at EPIC and report co-author.