Mississippi AG Defends Increased State Interest in Tech Enforcement

NetChoice Vice President Carl Szabo questioned whether state AGs are pursuing national cases to score political points via cases the FTC is better suited to address. Szabo asked whether Racine’s lawsuit is the best use of taxpayer dollars when there are more pressing local issues. A Racine spokesperson cited a previous statement from the AG, saying the suit is about making Facebook “live up to its promise to protect its users’ privacy.” Friday, Facebook didn’t comment.

State AGs need to guard against online platforms that are shrouded in “mystery” allowed by immunity under Section 230 of the Communications Decency Act, Hood told us. Google sued Hood in 2014, claiming he was illegally probing the company over allegations it supported music piracy and illegal drug sales. The suit was ultimately dismissed. Hood then sued Google in a separate case in 2017, claiming the platform violates student privacy by selling targeted ads with data collected from services it provides schools. That case is ongoing. Google didn’t comment.

Hood participated in DOJ’s tech-focused meeting with state enforcers in September (see 1809250033), which was called after President Donald Trump accused Silicon Valley of bias against conservatives and threatened antitrust action. State interest in online privacy, Hood said, dates back to 2013. That's when then-Maryland AG Doug Gansler (D) spearheaded the creation of an Internet Privacy Committee at the National Association of Attorneys General, where Gansler was president.

The FTC does a “fair” job enforcing privacy standards but depends on the administration, Hood said. He's skeptical Congress would pass federal privacy legislation within several years, saying it’s going to take another Cambridge Analytica-like scandal for lawmakers to find the motivation. Or a court will determine that personal data is intellectual property, making consumers realize what they’re giving away, he said. He urged industry to formulate a set of best business practices to improve data collection.

​​​​​​​The FTC has expertise that Racine and AG offices don’t, Szabo argued. Because most state AGs are elected, it’s difficult to know whether these tech-related lawsuits are based on principle or politics, he said. The meeting between AG Jeff Sessions and state AGs, for example, had political undertones, he added.

​​​​​​​State enforcers have been active on privacy and tech issues for quite a while, Berkeley Center for Law & Technology Executive Director Jim Dempsey emailed. In recent years, privacy and data security enforcement has increased, he added, saying to expect the trend to continue to grow and to broaden. Some state AGs have more “explicit authority” than the FTC over privacy and cybersecurity, he said. “That too is likely to increase, as more and more states adopt privacy and data security laws going beyond breach notification,” he said, citing state enforcement of federal laws.

​​​​​​​Racine is within his authority to sue Facebook​​​​​​​, said Common Cause Media & Democracy Program Director Yosef Getachew, arguing the FTC doesn’t have sufficient resources to police all tech-related cases. Outside the agency’s 2011 consent decree with Facebook, no major action has been taken against the industry at the federal level, he said. Offices for AGs Doug Peterson, R-Neb.; Josh Stein, D-N.C.; and Ken Paxton, R-Texas, as well as former Missouri AG and newly sworn-in Sen. Josh Hawley (R) didn’t comment.