Catalyzing Privacy Law

By Anupam Chander, Margot E. Kaminski, and William McGeveran. Full Text. 

The United States famously lacks a comprehensive federal data privacy law. In the past year, however, over half the states have considered broad privacy bills or have established task forces to propose possible privacy legislation. Meanwhile, congressional committees are holding hearings on multiple privacy bills. What is catalyzing this burst of legislative momentum? Some believe that Europe’s General Data Protection Regulation (GDPR), which came into force in 2018, is the driving factor. But with the California Consumer Privacy Act (CCPA), which took effect in January 2020, California has emerged as an alternate contender in the race to set the new standard for privacy.

Our close comparison of the GDPR and CCPA reveals that the California law is not GDPR-lite: it retains a fundamentally American approach to information privacy. Reviewing the literature on regulatory competition, we argue that California, not Brussels, is catalyzing privacy law across the United States. And what is happening is not a simple story of powerful state actors; it is more accurately characterized as the result of individual networked norm entrepreneurs, influenced and even empowered by data globalization. Our study helps explain the puzzle of why Europe’s data privacy approach failed to spur U.S. legislation for over two decades. Finally, our study answers critical questions of practical interest to individuals—who will protect my privacy?—and to businesses—whose rules should I follow?