As Congress Dithers, States Step In to Set Rules for the Internet

By David McCabe and Cecilia Kang

Virginia, Florida, Arkansas and Maryland are among dozens of states that have introduced bills to curtail the power of Amazon, Google, Facebook and Twitter.

Credit...Photo illustration by Doug Chayka; Photo, via iStock

WASHINGTON — News outlets in Florida may soon be able to sue Facebook and Twitter if the social media companies take down their content.

Arkansans shopping on Amazon will be able to see contact information for third-party merchants, which the site won’t be required to show people outside the state.

Residents of Virginia can ask Google and Facebook not to sell their personal data, and the state can sue the companies if they don’t comply.

The moves are the result of an extraordinary legislative blitz by states to take on the power of the biggest tech companies. Over the past six months, Virginia, Arkansas, Florida and Maryland have been among at least 38 states that have introduced more than 100 bills to protect people’s data privacy, regulate speech policies and encourage tech competition, according to a tally by The New York Times.

That is a drastic escalation from past years. For online privacy alone, states proposed 27 bills in 2021, up from two in 2018, according to the International Association of Privacy Professionals.

Only a handful of the bills have been signed into law, but the push signals that states are no longer content to sit on the sidelines of setting the rules for the internet — especially as Washington has moved slowly. While Congress has ramped up hearings and reports to curtail the power of Google, Amazon, Apple and Facebook in recent years, lawmakers have passed only one bill, which opened social media giants to more legal liability if they facilitate sex trafficking.

Tom Wheeler, a former chair of the Federal Communications Commission, said the recent barrage of state actions “proves once again nature abhors a vacuum.”

“The failure of policymakers at the national level to act has invited both state and foreign regulators to act,” he said.

The states’ legislative push is set to lead to uneven online experiences across the country. Internet users are beginning to have different rights depending on where they live. That creates complications for the tech companies, which are navigating a geographical legal thicket. Facebook, Google, Amazon and others may have to revise their products to comply with the laws and decide whether to implement the changes even in places where they aren’t legally required to.

Critics of the state regulations warned that tech companies weren’t the only ones that would have to maneuver through the patchwork of rules. “For consumers, this means confusion,” said Daniel Castro, a vice president of the Information Technology & Innovation Foundation, a think tank sponsored by tech companies.

Apple and Google declined to comment. Jodi Seth, a spokeswoman for Amazon, pointed to an April blog post from the company’s policy executive Brian Huseman, who said the state laws risked creating a hodgepodge of regulations that wouldn’t serve users well.

Will Castleberry, Facebook’s vice president of state and local public policy, said that instead, the social network largely backed more federal legislation. “While we support state efforts to address specific challenges,” he said in a statement, “there are some issues, like privacy, where it’s time for updated federal rules for the internet — and those need to come from Congress.”

To fight against the splintering rules, the tech companies have gone on the offensive. While data on state lobbying is inconsistent and often underreported, Google, Amazon and Facebook funneled a combined $5 million into those efforts in 2019, according to the National Institute on Money in Politics, a nonprofit. The companies also increased their lobbying ranks to dozens in state legislatures compared with skeletal forces five years ago.

Some of the companies have also recently sent top engineers to kill state proposals. In February, Apple’s chief privacy engineer, Erik Neuenschwander, testified in a North Dakota Senate hearing to oppose a bill that would let app developers use their own payment systems and bypass Apple’s App Store rules. The bill died a week later in a 36-to-11 vote.

Even so, states have barreled forward.

Maryland lawmakers in February overrode their governor’s veto of a new tax on sites like Facebook and Google. The tax, the first aimed at the business of behavioral advertising, takes a cut of the money that the companies make from the sale of ads shown in Maryland. One analysis projected that it would raise up to $250 million in its first year, a fraction of Facebook and Google’s combined $267 billion in annual revenue, but a real threat if replicated across states.

Trade groups for Google, Amazon and Facebook tried to stop the tax. They hired a well-connected political consultant to argue that it would hurt small businesses. When that failed, the trade groups sued to block it. The litigation is pending.

In March, Virginia also passed a data privacy bill that gives residents the right to opt out of the sale of their data and see what information companies have collected about them. Virginia was the second state to pass a sweeping privacy law, after California did so in 2018.

The Virginia law was something of a victory for the tech industry because it doesn’t allow consumers to bring their own lawsuits against the tech companies. It also covers only personal data linked to someone’s identity, rather than the unique, anonymous numerical identifiers used by many web targeting systems. But it highlighted the inaction in Washington, where a federal privacy law has stalled because of partisan gridlock and tech lobbying.

“There is no federal legislation that comprehensively protects our consumers,” said Cliff Hayes, a Democratic Virginia delegate who helped craft the privacy bill. “We have this big void.”

Republicans, who have full control of more than 20 state governments, have been especially active in drawing up bills to rein in tech power, reversing their traditionally hands-off approach. Some have proposed laws to regulate how the platforms moderate content for the first time, motivated by perceptions that tech companies censor conservative personalities.

Last month, Florida’s Legislature passed a law making it illegal for social media companies to permanently bar political candidates from their services. The law also makes it illegal to take down content from certain news outlets. Social media users can sue the companies if they feel a platform has unfairly applied its rules in taking down their posts.

Gov. Ron DeSantis of Florida, a Republican, is expected to sign the bill soon.

The Florida bill was one of dozens introduced in statehouses this year targeting the way that the companies moderate content. Other bills proposed restricting tax incentives that states can give to the companies, according to the National Conference of State Legislatures, a nonprofit organization that represents the interests of state legislative bodies in Washington.

The nimbleness of states compared with that of Washington has been most evident in an Arkansas bill that its supporters said was intended to improve transparency in e-commerce.

Last year, Amazon’s competitors started lobbying for a federal law to require online marketplaces like Amazon and Etsy to disclose more information about the outside merchants who use their sites. Such a law would cut down on the sale of stolen goods online, they argued.

But the federal effort went nowhere.

In Arkansas, it was a different story. Jonathan Dismang, a Republican state senator, was frustrated after he paid $70 in an online marketplace for three canisters of Clorox disinfectant wipes at the start of the pandemic. He said it made him think about how people were hoarding vital supplies and reselling them online.

Mr. Dismang said that after he learned about the federal transparency proposal for online retailers, he introduced his own state measure in March. Under the law, Amazon and Etsy have to display phone numbers, emails and physical addresses for many of the third-party merchants that sell goods on their platforms. (Amazon currently discloses a business address for each seller but not an email or phone number.)

Arkansas lawmakers quickly passed the bill with large majorities in both chambers of the state legislature. By early April, it had become law — less than a month after it was introduced.