State Officials and Privacy Lobbyist Debate Private Right of Action

The 20 states with comprehensive privacy laws tasked their attorneys general with enforcement, though California additionally has a privacy agency that handles enforcement and a narrow PRA for data breaches. Vermont is currently weighing whether to let individuals sue in a pending privacy bill (see 2503180046).

The more widespread a framework, the easier it is for companies to comply and create a "corporate culture of privacy,” argued Kingman, who has lobbied for industry on privacy bills in many states over the years. He noted that Texas and California have vigorously enforced their laws despite lacking broad PRAs.

However, Clark said letting individuals sue over privacy violations is important, especially considering Vermont’s consumer protection law includes a PRA. “Carving out data privacy in contrast to other consumer issues doesn't make a lot of logical sense to me."

But Kingman said trying to include a PRA in privacy bills often stops them from passing. Washington state could have been first to have a privacy law, but comprehensive bills were derailed several times when the House tried adding a PRA, he said. Meanwhile, the Vermont legislature’s determination to include a PRA drove much of the opposition to last year’s bill, he said. While the legislature passed a bill with a PRA, Gov. Phil Scott (R) vetoed it and the Senate couldn’t muster enough votes to override him.

Kingman added that PRAs tend to benefit trial lawyers more than consumers. Daniel's Law, in New Jersey, has prompted nine-figure class action lawsuits, he said. In the first six months of the California Consumer Protection Act, there were 50 class action lawsuits "trying to find some kind of backdoor private right of action,” he added. And now the trial lawyers there have turned to filing complaints under California’s wiretapping statute, he said. "It's not hypothetical or hyperbolic to say that businesses are concerned that when there is a PRA, that they are going to end up dealing with … frivolous litigation."

Clark disagreed that there would be a problem in Vermont because she said the PRA proposed in its 2025 bill only provides actual damages and is limited to biometric and sensitive data. But Kingman replied, “For now.”

Encouraged to weigh in by the Vermont AG, Maroney said he falls somewhere in the middle. "Slippery slope is the argument I feel you have when you don't have a real argument,” he said. But the real problem with a PRA is "lack of clarity for businesses,” he said. It can take years to settle all the litigation and, in the meantime, companies don’t know the rules of the road, the Democrat said.

Maroney is sympathetic to the argument that state AGs don’t always have enough resources for privacy enforcement, he said. With Texas, "even though it's seen as a weaker privacy law, they've put a lot of money into enforcement,” he noted.

But in the end, getting a privacy bill enacted is better than getting it perfect, and PRAs have killed many bills in other states, Maroney argued. The reality, he said, is that “I could not have passed a bill with that in Connecticut."

Meanwhile, it’s "highly unlikely" Congress will pass a privacy bill soon, said Maroney. Kingman noted that it “feels like there's more work being done” since the House Commerce Committee has a working group for crafting a national law (see 2502240055). “Does that result in a law? You know, probably not.” He predicted greater focus on kids privacy for the next 12-18 months.

Clark indicated that she’s not anxious to see President Donald Trump enact a privacy law. Trump has a "boy crush on Silicon Valley" and his administration seems to lack the appetite to put guardrails on anything related to the data that fuels AI, the AG said.