Online Privacy Protections Gain Traction With Lawmakers, Tech Industry

And tech companies themselves, after years of resisting privacy legislation in many instances, have begun to push hard for a federal privacy standard—which to many is preferable to a jumble of state laws, and might ease demands for antitrust legislation that could hit the companies even harder.

Kent Walker,

president of global affairs for

Alphabet Inc.’s

Google unit, said Monday that there was an emerging consensus on the need for a comprehensive federal privacy policy.

Important policy hurdles still loom, and if agreement isn’t reached within weeks, the effort could fall apart as partisan differences begin to harden in the run-up to midterm elections this fall.

Even so, Google is “optimistic that Congress will find a compromise that adopts the nationwide privacy protections Americans want,” Mr. Walker said in an address at R Street Institute, a think tank that says it promotes free markets and limited government.

The policy negotiations involve Democratic and Republican leaders on both the Senate Committee on Commerce, Science and Transportation and the House Committee on Energy and Commerce. They are seeking to put guardrails on tech giants’ collection, storage and use of consumers’ personal information, according to people familiar with the discussions.

Under versions being considered, for example, consumers would be able to access their personal information with the option to make changes or deletions, or move the data to a different online platform, the people said.

Enabling consumers to opt out of sharing many types of data with third parties is also part of these deliberations, the people said. Protections against online discrimination—for example, in targeted advertising related to housing or employment—are also likely to be included, they said.

One selling point for the tech industry is that federal legislation is expected to supersede state laws, at least to some extent.

For example, four states have enacted comprehensive privacy laws—California, Colorado, Utah and Virginia. But the states use different standards to set out what kinds of entities and data are exempt, said

Jessica Rich,

a former head of the Federal Trade Commission’s Bureau of Consumer Protection, who is now at law firm Kelley Drye & Warren LLP.

The trade group Technet, which includes

Apple Inc.,

Google,

Amazon.com Inc.

and Meta Platforms Inc., which owns Facebook and Instagram, is now lobbying for a federal privacy law and recently tweeted images of its members meeting with leading lawmakers, including Senate Democratic leader Sen.

Chuck Schumer

(D., N.Y.) and House Speaker

Nancy Pelosi

(D., Calif.).

The group also met with Republicans including Sens.

Steve Daines

(R., Mont.) and

Dan Sullivan

(R., Alaska), as well as Rep. Cathy

McMorris Rodgers

(R., Wash.), the top Republican on the House Energy and Commerce Committee.

Mrs. McMorris Rodgers and Sen.

Roger Wicker

(R., Miss.), the top Republican on the Senate Commerce Committee, are also involved in crafting the privacy legislation. Their Democratic counterparts include Rep.

Frank Pallone

(D., N.J.), the House Energy and Commerce Committee chairman, and Sen.

Maria Cantwell

(D., Wash.), the Senate Commerce Committee chairwoman.

“Maybe we’ll see something soon…. don’t go on vacation,”

John Beezer,

a senior aide to Sen. Cantwell, said at a recent privacy conference.

Congress has been under pressure to act following disclosures by whistleblower

Frances Haugen

about how the Facebook and Instagram sites contribute to harms ranging from teenagers’ mental-health problems to poisoned political debate.

The documents gathered by Ms. Haugen provided the foundation for The Wall Street Journal’s Facebook Files series. Facebook has said that it takes seriously the safety and privacy of all its users, and especially of its younger users.

The Journal also reported last year that TikTok can drive users into rabbit holes of potentially harmful content about depression, sexual abuse, drug use and eating disorders.

TikTok, which is owned by a Chinese company, ByteDance Ltd., said it has taken steps to increase protections for younger users, such as halting push notifications at night for specific age groups.

Even so, the disclosures triggered a series of hearings on Capitol Hill where Republicans and Democrats both said protecting the safety of young people online is a legislative priority.

“The engines are revving on this in a way they haven’t in a long time,” said

Carl Holshouser,

senior vice president of Technet.

Big tech companies also see privacy legislation as forestalling antitrust legislation in Congress that likely would affect them more.

“Polls show Americans want Congress to pass a federal privacy bill instead of ’antitrust’ laws that would limit the products they rely on and benefit foreign competitors,” Technet wrote on Twitter this month.

The antitrust legislation has bogged down in recent weeks amid partisan jockeying and lobbying by tech companies.

While momentum now seems to be building for a privacy bill, key issues are still being debated, including the enforcement mechanisms, according to the people familiar with the talks.

There is potential agreement on allowing individuals to file lawsuits over violations, the people said, but businesses and some conservatives are worried about the potential for judgments based on technical violations instead of actual damages, among other concerns.

Consumer advocates, meanwhile, want to restrict arbitration clauses in service agreements with consumers to preserve their rights to file private lawsuits, another point of contention with business.

“Industry continues to have concern about a private right of action…that could enable abusive class action lawsuits,” said

Jordan Crenshaw,

a U.S. Chamber of Commerce vice president who runs the group’s Technology Engagement Center.

Mr. Crenshaw acknowledged urgency to pass a national privacy law, “but we don’t need to rush if we can’t get it right.”

The idea of a federal privacy bill has been seriously discussed for more than 20 years.

In 2000, as the internet began to emerge as a major stream for commerce and information, the FTC urged Congress to pass a comprehensive privacy bill, saying that “self-regulation alone has not adequately protected consumer online privacy.”

While the European Union and other countries have adopted detailed consumer-privacy standards in recent years, the U.S. has limited its legal protections to particular categories of sensitive personal information, such as health and financial data.

A controversy over how a political-data firm, Cambridge Analytica, accessed millions of Facebook users’ data fueled interest in a far-reaching privacy law in Congress in 2019.

But partisan divides over policy issues scuttled those negotiations. Three years later, the U.S. still lacks a comprehensive privacy law.

Write to John D. McKinnon at [email protected]