Hacker News Reader

Comment by _fat_santa | Hacker News Reader

I feel like this should be federal legislation rather than having every state adopt their own privacy regulations. With every state, there comes the possibility of fragmentation and all of a sudden you have to be in compliance with GDPR, CCPA, WPA, and a host of other state privacy legislation.

Hopefully it won't come to this and even if we don't get federal legislation, hopefully the rules will be setup in a way where there is a "gold standard" (ie. if you're compliant with GDPR, you're defacto compliant with all the other policies).

If someone here is more of an expert on this topic I'd love to hear what I got right and wrong in my assumptions.

View on HN

States are useful little laboratories of democracy in situations like this. California's CCPA was conceived and funded by a lone real estate developer with enormous personal conviction in privacy. Consensus was that his personal crusade would fail until the voters unexpectedly passed the measure in 2018. That kick started data privacy legislation in the US. It would have taken another decade at least for the Feds to be first movers.

Note proposition 24 passed in 2020 to amend CCPA. Not all of the changes were all that great [1] [2]:

> Prop 24 expands current law by exempting loyalty clubs and rewards programs from existing limits and allows businesses to withhold discounts unless they can harvest data about shopping habits.

[1] https://ballotpedia.org/California_Proposition_24,_Consumer_...

[2] https://www.ballot.fyi/prop-24

You are correct, and that's the main reason why some tech companies lobby in favor of Federal privacy legislation.

This also brings up an important issue: Local Pre-emption. A federal law may, if Congress chooses, say that "states cannot make local laws on this topic." But it also may not, and states could still choose to implement stricter laws.[1] This aspect, along with Private Right of Action, are considered by the privacy community to be at least as important as what tracking is actually allowed.

[1] This is already the case for e.g. wiretapping laws: Federal law requires at least one party consent to recording a phone conversation. Some states have stricter requirements and require all parties consent.

Exactly right. The tech and advertising industries and their allies want weak federal regulations (with no private right of action, and lots of exemptions) that pre-empt stronger state laws. One way to get there is to get multiple states to pass roughly-similar weak regulations and then argue that there's "consensus" so might as well make it a federal standard.

So, an Amazon lobbyist gave the version they were trying to get passed in Washington to a Virgnia state legislator who introduced it there and (since Amazon had just invested a zillion dollars in Virgina) they whisked it through. Then they used that as the basis for Colorado's law. This year when they tried to pass it again in Washington one of the arguments was "it aligns with other states". Sigh.

https://www.reuters.com/investigates/special-report/amazon-p...

These privacy laws are regulating interstate commerce and as such should be subject to only Federal jurisdiction.

They're regulating commerce within their state.

If I'm in Indiana, and something California does prevents me selling from Indiana to California, it is clearly regulating interstate commerce.

Reply on news.ycombinator.com