Privacy concerns have only grown with the rise of social media and explosion of smartphone apps — platforms that, to varying degrees, collect, use, share and monetize meticulous data on our interests, behaviors, friends, locations and more. In some cases, people have consented to this (often without fully understanding or realizing it) and in others, people have not. But Americans’ desire to have more control over their personal information is growing, as is the tech industry’s desire for a legal framework that can help companies avoid privacy missteps while continuing to innovate.

The friction between state and federal laws isn’t new. But it’s escalating as state-level privacy activity grows in the absence of action from Congress — and particularly at a time when big tech companies are starting to write their own digital rules of the road and data breaches are becoming a near-regular occurrence.

Congress has been angling to pass a comprehensive national privacy law for years and, at the outset of the Biden era, seemed well-positioned to do so this session. But halfway through 2021, there’s been little movement on the issue — in part because of higher priorities like battling Covid-19 and countering China — and the prospects of passage in the first two years of a Biden administration are now looking worse by the day.

States, meanwhile, are moving at a rapid clip to cement rules giving people more control over their data. Colorado last week became the third state to pass its own privacy law — joining California and Virginia — and after its third consecutive go through the legislature, Washington’s privacy law recently came the closest it’s ever been to passing, with more consensus between the House and Senate versions of the bill than ever before.

That is emboldening lawmakers there to forge ahead when they reconvene early next year, and if the Washington Privacy Act passes in its current form, experts say it would likely be the strongest state privacy law on the books in the United States. Florida and Connecticut are also getting close to passing general data privacy laws. The state laws, broadly speaking, give consumers the right to see what data companies have collected on them, ask for it to be deleted and prevent it from being sold.

Many members of Congress, and the tech industry itself, have argued that a patchwork of state-by-state privacy rules will confuse consumers, stifle innovation and create a compliance mess that will disproportionately hamstring small businesses. So in their view, the state privacy blitz is making the need for a federal national standard all the more urgent.

Some of the top lawmakers in charge of that work hail from Washington state, a global tech capitol outside Silicon Valley that is home to Amazon and Microsoft. That includes Senate Commerce Committee Chair Maria Cantwell — a Democrat who is arguably the most powerful figure in congressional privacy talks — and the House Energy and Commerce Committee’s top Republican, Rep. Cathy McMorris Rodgers, who has been central to the chamber’s privacy negotiations. Reps. Suzan DelBene and Pramila Jayapal, both Democrats from Washington, have also been outspoken on the topic.

But one of the biggest hurdles to passing a federal privacy law is disagreement over whether it should preempt state rules, like those percolating in Olympia. And it’s an area where federal lawmakers from Washington — even within the same party — are at odds. Cantwell has strongly opposed federal privacy efforts that would override protections put forth by states like her own, while fellow Democrat DelBene is trying to advance legislation that would preempt state laws (a stance more closely aligned with the views of Republican McMorris Rodgers). It remains a divisive sticking point for which there is no clear workaround.

DelBene would not address that dynamic directly. Asked in an interview about her home state’s privacy push, and her move to preempt its privacy work, DelBene said only that “states are moving because the federal government hasn’t.”

Cantwell, whose Senate committee has primary jurisdiction over these issues, has not yet held a hearing this session on the comprehensive national privacy law or publicly discussed the path forward. Her office did not respond to multiple requests for comment for this story.

Same state, different priorities

State and federal lawmakers from Washington are at cross-purposes on several key parts of privacy legislation, in some cases campaigning for opposing standards.

Whether individuals should be able to sue companies over privacy violations is “an area of fundamental disagreement,” Carlyle, the state senator, said in an interview. Cantwell has pushed for this so-called private right of action at the federal level, while Carlyle does not support it at the state level.

“The idea that you’re going to create these new rights and then sort of unleash the legal world to have people suing companies for not implementing those rights perfectly the first time in every single way is a lawyer’s dream,” said Carlyle, whose bill proposes an alternative that would give consumers some recourse while avoiding major legal battles. “How do we take a responsible, incremental step forward in the development of consumer data privacy law that doesn’t try to be all things to all people on day one?”

Washington’s legislators also diverge on how much onus should be on a company, versus an individual, when it comes to the sharing of personal information. Under Cantwell’s Consumer Online Privacy Rights Act — Commerce Democrats’ leading privacy bill from the last Congress — companies would need to get consumers’ permission before collecting and handling their sensitive data. On the contrary, under Carlyle’s proposal and the others that have passed, consumers would need to proactively tell companies not to share their data.

Cantwell’s federal legislation, in that sense, is stronger than the state laws out there, according to Justin Brookman, director of technology policy at Consumer Reports.

“The Democrats [in Congress] have gotten probably more aggressive in response to seeing all the data-sharing going on, but at the state level, where things actually can pass, I think the members have been maybe more scared… about disrupting the internet and doing something wildly out of whack with other states,” Brookman said. “By the same token, legislation has actually moved at the state level.”

Washington state’s most recent House and Senate privacy bills, according to Brookman, better target companies that try to punish consumers — with higher prices or worse service, for example — for not agreeing to share their data.

Finally, there are significant differences when it comes to how Washington lawmakers are addressing civil rights issues like bias in artificial intelligence. Those issues have become more central to the privacy debate over the past year as progressives and civil society groups push for stronger protections. While various federal privacy bills, including Cantwell’s, have incorporated language on civil rights, most of the comprehensive state bills, including Carlyle’s, have not.

Brookman argued that may be more about timing of the state efforts than opposition to the idea. “I think if they started today, they might actually be more inclined to include civil rights language in their bill,” he said. (Washington state passed a separate facial recognition bill last year that addressed some civil rights concerns.)

Despite these disparities, some experts are skeptical that states going it on their own will really move the needle in Congress. Jules Polonetsky, CEO of the Future of Privacy Forum, said tech businesses won’t truly be worried until a state passes legislation allowing private citizens to sue over violations. The industry and some members of Congress, he said, see such a broad private right as “an existential threat.”

“If and when a state passes a bill with a private right,” Polonetsky said this spring, “I think you’ll see the floodgates of every industry [open], lobbyists standing full-time outside the gates of Congress, shouting for action. … But the sky hasn’t fallen in yet.”

Carlyle, the state senator, said that even if the propagation of state consumer data privacy laws were a catalyst for Congress to act, “I don’t think anyone should underestimate the difficulty of getting alignment and agreement in this day and age.”

“Every cliche and stereotype that we have about a lack of productivity in Congress is not exactly a false narrative,” Carlyle said.

What’s next?

Washington’s state legislators have gotten closer to passing a privacy bill than its leaders in Congress, and close observers are confident the state law will pass before the federal law. There’s no filibuster in the state legislature and the gap between Democratic and Republican lawmakers is generally seen as narrower.

House Energy and Commerce in July kicked off a series of bipartisan roundtables on consumer privacy. Some advocates view that effort as a sign of progress. Others see it as a way to delay action on federal legislation and find it problematic that the committee, and Senate Commerce, have yet to hold public hearings or markups this session on the bills already introduced.

DelBene called on her colleagues to pick up the pace. “We need to be moving more quickly,” she said. “Roundtables are a good step, though you have to get to actual bills and moving legislation through the process.”

Carlyle, the state senator, said that because the federal legislation from Cantwell and others has not yet gone through the legislative process, the prospect of it passing anytime soon is “very low,” while his Washington Privacy Act is already near the finish line. “I just don’t think that you can compare bills that are freshly drafted by one or two members with a bill that has gone through the public scrutiny and the rigor of the committee process,” he said.

He added that states offer insight into what’s actually achievable.

“The old adage that ‘states are laboratories of democracy’ — we’re big enough to be impactful, and small enough to get things done — is an important truism,” Carlyle said. “If Congress decided to pass a sweeping comprehensive privacy bill tomorrow, it would take them four years to figure out who gets coffee for the group.”