How To Protect Users' Privacy from Tech Corporations

Newsweek

5 hours ago

The concept of privacy is foundational to our constitutional democracy. The Fourth Amendment prevents unlawful searches and seizures. The Fifth Amendment prevents self-incrimination. The First Amendment prevents the government from compelling Americans to make disclosures. Some states, like Montana, explicitly list the right to privacy in their constitutions.
Although our right to privacy is well established when it comes to government interference in our lives, that is unfortunately not the case when it comes to the companies that know every intimate detail about us. With the allure of free services, we routinely provide our most intimate selves to multi-billion-dollar tech firms that, in turn, make an enormous profit off the data they pilfer.
They know everything about us. What we like to eat. When we sleep. Where we live. Where we are. Our beliefs. Our fears. Curiously, they claim our age confounds them, but let's set that aside.
A recent Pew survey shows that 73 percent of Americans feel they have little or no control over how companies utilize their personal information. They're right. We sign privacy policies that are filled with so much legal jargon that they may as well be unintelligible to the average person, and presto! Our data is now the company's data, along with our digital selves.
The problem is that companies sell our data, not just to third-party advertisers, but also to those who use our data to create fake images, curate biased newsfeeds, conduct elaborate scams, and even engage in espionage.
BATH, UNITED KINGDOM - FEBRUARY 09: In this photo illustration 12-year-boy looks at his phone on February 9, 2025 in Bath, England.
BATH, UNITED KINGDOM - FEBRUARY 09: In this photo illustration 12-year-boy looks at his phone on February 9, 2025 in Bath, England.In short, we are not in control. Americans are right to be concerned. And with the advent of AI, this problem will only get worse.
Our current system is unsustainable. We need to address it through a national privacy framework. Even though many states, like California and Texas, have passed comprehensive privacy laws, we still need federal action to ensure we hold these companies accountable.
Currently, tech behemoths view privacy violations as a mere cost of doing business, with penalties akin to a parking violation relative to their bottomless coffers. To demonstrate how little help some privacy laws have been to consumers, let's get specific. Consumers sued Apple earlier this year under California's privacy law for sharing recorded conversations of personal health information with their physicians to ad companies. Apple's surveillance and recordings covered conversations spanning a little over a decade. The case settled. So, what was the total cost of Apple giving advertisers an inside perspective on doctor-patient relationships? A meager $95 million, which accounts for about nine hours' worth of Apple's annual profit. And consumers won't see about a third of that, as it's reserved for the lawyers.
The reality is that if Big Tech companies cared about user privacy, they would protect it. For instance, Google, Amazon, and Apple can stop lowering their privacy protocols to cater to autocratic regimes, such as the Chinese Communist Party, that seek to use their platforms to spy on consumers. Even better, companies can stop manipulating the privacy settings on users' devices and third-party services, which is already illegal. Apple describes user privacy as a "human right," but it treats user privacy less as a fundamental human right and more as a license to collude with its fellow Big Tech firms to monetize every facet of its users' data, lives, and privacy.
It's no wonder 85 percent of people want more to be done to protect user privacy. We need government intervention here.
The good news is that the desire to pass a privacy law is widely bipartisan. Indeed, 20 states across the political spectrum have passed comprehensive privacy laws.
A national privacy framework should do the following:
First, define goals and stay targeted at accomplishing those goals. One of the primary problems with previous attempts at passing meaningful privacy laws has been that bills attempt to do too much all at once. We have seen the most success in legislation that has clearly articulated goals with targeted solutions to both pass through both houses and be an effective law.
Overly sweeping privacy laws have the unintended consequence of entrenching incumbents. That's what we've seen in the E.U.'s General Data Protection Regulation (GDPR). The GDPR should be a cautionary tale for the U.S. because, as the European Centre of Economic Policy Research found, privacy regulations without market guardrails can seriously exacerbate Big Tech's competition issues.
Second, enforcement matters, and attorney general enforcement is preferred. As indicated earlier in the case involving Apple, private right of actions don't do much to deter Big Tech companies, given their seemingly endless teams of lawyers and budgets. Agency actions or AG enforcement are far more effective. For instance, the Texas attorney general recently secured a nearly $1.4 billion settlement against Google for violating Texas's privacy law. As should be obvious, that $1.4 billion only covers the people of Texas. Contrast that with the Apple case, where only $95 million covered the entire state of California.
Third, the broader the federal statute, the more important preemption will become. That's because targeted legislation is less likely to run into differing state regimes, whereas 20 states have now passed some form of comprehensive privacy legislation. A privacy framework should be clear on what it is preempting and should reserve rights for state attorney general enforcement. That means developing basic definitions (e.g., "personal information"), creating data rights, and specifying what specific data management practices are to be prohibited.
In sum, we need Congress to act now more than ever to preserve what's left of our digital selves.
Joel Thayer is president of the Digital Progress Institute and an attorney based in Washington, D.C.
The views expressed in this article are the writer's own.