The shifting sands of data privacy law

Politico

25-06-2025

With help from Aaron Mak
In the long absence of any federal rules on data privacy, state after state has stepped into the gap. First was California, whose groundbreaking privacy law went into force in 2020 — followed by 18 other states that passed their own versions.
The laws protect online consumers, giving them varying rights to their data and limiting how companies can use it. The tech industry and a host of other businesses have long complained that this is a frustrating patchwork — a hard-to-follow set of rules that make doing business more expensive and less predictable.
And now a twist is emerging: Right now, in one capital after another, the patchwork is changing.
In recent months, states have been tweaking their privacy laws. Some are trying to catch up with other states in expanding their laws' applicability, while others are scaling back regulations to reduce the headache for businesses.
The optimistic argument is that they're all aiming at a 'Goldilocks' zone — a sweet spot reached by trial and error, where consumers are protected and businesses aren't too limited in what they can do with customer data.
'People make better bills than me after I've passed mine, and I want that. I want ours to get stronger from other states,' Montana state Sen. Daniel Zolnikov (R), the lawmaker behind the state's 2023 privacy law, told Digital Future Daily.
But to critics, it's just another example of why the state-level approach is so problematic — and it adds fuel to their argument that Washington needs to pass some kind of law that overrides the others and creates a consistent standard.
'The Goldilocks comparison is very accurate,' the tech industry group NetChoice's director of state and federal affairs, Amy Bos, said in a statement. 'But if anything, it emphasizes the serious need to pass a federal law that preempts this massive patchwork for consumers.'
The quick pace of technology's advances means state lawmakers have felt the need to amend even new laws. Less than a year after Montana's privacy law went into effect, state legislators amended its regulations to provide stronger protections for teens online.
Already, in the 2025 legislative session, six out of 19 states have passed amendments to their data privacy laws. In March, Utah updated its law to allow people to correct inaccurate information collected and sold by companies, and added stronger enforcement capabilities. Oregon also tightened its rules in May, outlawing the sale of precise location data and children's data. (Not all of them have been successful: Virginia lawmakers proposed five bills to amend the state's privacy law, all of which were shot down.)
'It's not about legislating for the sake of legislating, but the reality is that technology is evolving so quickly that we have to stay adaptable,' said Republican state Rep. Doug Fiefia, a lawmaker behind Utah's update.
California went the other way. The largest state has the most experience as the earliest adopter of data privacy regulations — and has gotten the most attention, as both a huge market and the tech industry's home turf. Complaints from businesses and a warning from California Gov. Gavin Newsom (D) led the California Privacy Protection Agency to narrow the rules it proposed for automated decision-making technology.
'At recent Board meetings, several Board Members emphasized the importance of balancing strong privacy protections with practical implementation,' the CPPA's Executive Director Tom Kemp said in a statement. 'That's why public comment remains such a critical part of the rulemaking process.'
For an industry worried about the challenges of a shifting landscape, there's an obvious solution: A federal data privacy law that preempts the state versions. Such a law would have many advantages for the industry: It would create a single national standard for companies to follow, and given the slow pace of change in Congress, it would be unlikely to get constant updates. (It also would create a single point of influence for lobbyists.)
So far, the most recent attempts at a federal law have died — first in 2022 when Democrats controlled the House, and then in 2024 with a Republican House majority. While privacy legislation is a bipartisan effort, both attempts fell apart after Democrats opposed preempting state laws and Republicans balked at civil rights protections for automated decisionmaking tools.
But the patchwork scenario has created some optimism for the long-frustrated proponents of a federal privacy law, who now see at least a partly open window to go back at the issue in late 2025.
Meanwhile, experts anticipate that states will keep tweaking their data privacy laws, whether it's to align with what's working in other states or to address new harms from developing technology.
Cobun Zweifel-Keegan, the International Association of Privacy Professionals' managing director in D.C., summed up the state of play: 'Will the privacy Goldilocks ever be satisfied? Probably not, but I think that's by design.'
AI chatbots promote China's talking points
Some of the most popular AI chatbots may be biased toward China, according to a report published Wednesday by the American Security Project. The group found that ChatGPT, Copilot, Gemini, and Grok produced information biased toward the Chinese Communist Party on topics Beijing finds controversial, particularly when delivering responses in simplified Chinese.
Multiple models seemed to offer sanitized summaries of the 1989 Tiananmen Square massacre, omitting the fact that the Chinese military killed civilians and referring to the event merely as an 'incident' or 'clash.' The models showed varying levels of bias on issues like human rights in Hong Kong and Xinjiang, COVID-19's early circulation in Wuhan, and China's territorial disputes over Taiwan and other nearby islands.
The American Security Project suggests that these responses may be the result of China's concerted efforts to proliferate its narratives on the internet. The report asserts that CCP agents impersonate foreign citizens to disseminate content in dozens of languages online, which state-controlled media, databases, and propaganda agencies then boost to maximize visibility and up their chances of getting into the datasets used for training AI models.
Microsoft did not reply to a POLITICO request for comment. OpenAI, Google and xAI did not immediately respond to a request for comment.
Anthropic scores a copyright win
A San Francisco federal court ruled on Tuesday that Anthropic didn't infringe on copyrights by training its AI models on published books, even without the authors' consent.
U.S. District Judge William Alsup in the Northern District of California determined that using the books to train its Claude chatbot fell within the fair use exception, a defense allowing for limited portions of copyrighted works to be used in certain contexts. Importantly, Alsup found that Anthropic's use of the books was transformative, meaning that the derivative product has a new meaning or expression from the original work. He wrote that the purpose of Claude was not to replicate the books, but rather to 'turn a hard corner and create something different.'
As POLITICO's Morning Tech reported, White House AI and crypto czar David Sacks and the Chamber of Progress were delighted by the ruling. However, Anthropic will still face a trial over allegations in the suit that it knowingly acquired and used pirated books.
This is one of the first major rulings finding that training AI on copyrighted works is considered fair use. In February, a Delaware federal court determined that the fair use defense did not apply to AI models trained on Thomson Reuters content. Similar cases have been brought against OpenAI and Microsoft.
post of the day
THE FUTURE IN 5 LINKS
Stay in touch with the whole team: Aaron Mak ([e-mail]); Mohar Chatterjee ([e-mail]); Steve Heuser ([e-mail]); Nate Robson ([e-mail]); and Daniella Cheslow ([e-mail]).