SCOTT SIMON, HOST:
California lawmakers unanimously passed a landmark data privacy law last year in response to concerns over how online companies are using people's personal information. But as Marisa Lagos from member station KQED in San Francisco reports, the issue's far from settled.
MARISA LAGOS, BYLINE: The California Consumer Privacy Act was hailed as the most sweeping data privacy law in the U.S. But even here, lawmakers don't think their work is done. Republican Assemblyman Jordan Cunningham says it's an issue that transcends partisan differences.
JORDAN CUNNINGHAM: And, you know, when I talked to my constituents about it, they're overwhelmingly supportive of the notion of individual privacy and the importance of passing laws that make sure that the individual consumer doesn't get lost in this rush to new technologies.
LAGOS: This focus on privacy picked up steam after a spate of scandals at Facebook, including last year's revelation that a political research firm improperly captured information about tens of millions of Facebook users. California's law is the first of its kind in the U.S., allowing Californians to ask a business what personal information has been collected by a company about them and to tell the company to erase that information. The thing is the law hasn't even taken effect yet. It kicks in next January.
But there are already more than 40 new bills in Sacramento that run the gamut from tweaking technical language to more sweeping changes, like allowing consumers to sue companies for violating the law. And at least eight other states are now considering legislation with some going even further. In Massachusetts, for example, a proposed bill lets the public sue companies directly. Vermont has enacted a law that will force companies that buy and sell personal data to register with the state. All that state action has spurred Congress to at least start talking about whether tech companies are too big and powerful. Connecticut Senator Richard Blumenthal grilled tech lobbyists at a recent hearing.
(SOUNDBITE OF ARCHIVED RECORDING)
RICHARD BLUMENTHAL: Let me begin by asking how many of you believe that Americans deserve the same level of privacy now as a floor that California provides for its people.
LAGOS: There's one Senate bill with broad Democratic support to require websites and apps to protect personal data. And Senators Elizabeth Warren and Amy Klobuchar, both presidential candidates, are campaigning on getting tough on big tech. Could all this movement lead to a rare bipartisan agreement in Congress? Terrell McSweeny is a former federal trade commissioner.
TERRELL MCSWEENY: I would say there are a lot of efforts that are bipartisan. I think we can reasonably assume that there's going to be a lot of focus and energy around this discussion at the federal level.
LAGOS: But getting anything done in D.C. is difficult, McSweeny says.
MCSWEENY: So we might see more action at the state level in the next year than we will at the federal level.
LAGOS: All these moves could even be influencing the big tech companies. Earlier this week, Facebook CEO Mark Zuckerberg announced plans to transform the social media company into a privacy-focused platform that is more centered around private messages than public posts. Mary Stone Ross, a former CIA analyst who helped craft the California law, says Zuckerberg's move is clearly a response to pressure from states like California.
MARY STONE ROSS: I think that they're trying to get ahead of all these proposed regulations by saying, look; like, we realize that we have had mistakes around privacy in the past. But we're changing. This is a play to look better when they go walk through the halls of Congress.
LAGOS: In the meantime, California lawmakers are pushing ahead to make its data privacy laws stronger. And in other states around the country, lawmakers are just getting started. For NPR News, I'm Marisa Lagos in San Francisco. Transcript provided by NPR, Copyright NPR.