The Rise of ‘Opt-in’ Provisions in State Consumer Data Privacy Bills

If you have ever made an online purchase and been asked to “check this box if you want to receive future promotions,” you weren’t just deciding how much spam you wanted to keep out of your inbox, you were actually wading into one of the hottest topics in consumer data privacy legislation today. “Opt-in” and “opt-out” notices have become a central part of legislative efforts in the United States designed to enhance data privacy protections and curtail the influence big tech companies have over individual consumers — and they are sure to play an even larger role in the years ahead.

The Journey to Consumer Data Privacy Legislation in the US

Requiring that tech platforms give consumers the choice of opting in or out to the collection of their personal data is a relatively new idea in the U.S. The California state legislature was the first to pass legislation around this topic with the California Consumer Privacy Act of 2018, which was hailed by many at the time as a landmark achievement in the world of consumer data privacy rights. Among its many provisions was the requirement that businesses give consumers the chance to opt out of the collection of their personal data before it could be sold to a third party.  

At the same time, Congressman Ro Khanna, D-CA, who represents Silicon Valley in Congress, was crafting his own “Internet Bill of Rights” which stipulated that consumers must opt-in (give affirmative permission) to the collection and sale of their personal data by a business or platform. Even though Democrats took control of Congress, an Internet Bill of Rights was never formally introduced and the burden fell to the states to enact their own protections.

Besides California, New Jersey was the only other state to introduce a consumer data privacy bill in 2018. Just one year later that number increased to 15 before jumping to 25 in 2020. Last year, 29 states introduced consumer data privacy bills, and almost all contained either an “opt-in” or “opt-out” requirement. 

The ‘Opt-In’ Battle in 2022

“Opt-in” requirements are generally viewed as being more consumer-oriented than “opt-out,” but also more burdensome and costly for businesses. For example, one study found that “opt-in” policies would cost a small hospital over $1.3 million more than an “opt-out” requirement would; while another study found that businesses would be forced to spend billions more in advertising costs under an “opt-in” system. Additionally, some of the biggest opponents of “opt-in” laws have been the big tech companies that profit from the sale of consumer data. 

Having the business industry and big tech companies aligned in opposition to “opt-in” policies puts both Republicans and Democrats in somewhat of an awkward political position. While Republicans say they want to be tough on big tech companies, they also want to appear friendly to business interests. And while Democrats say they want to strengthen regulations and reduce corporate loopholes, they also do not want to crack down too hard on an industry that is a reliable source of donors during every election cycle. 

Regardless, five of the state bills with “opt-in” requirements last year came from Republican legislatures — North Dakota, Oklahoma, Minnesota, Texas, and Utah – and seven came from states controlled by Democrats — Massachusetts, New York, Connecticut, Virginia, Colorado and two in Washington.

As the rest of the 2022 sessions play out, “opt-in” and “opt-out” requirements will remain at the center of the push within state legislatures to reform consumer data privacy laws and halt the influence of big tech companies. As “opt-in” provisions become more popular and representatives are forced to choose between competing priorities and constituent groups, many will run the risk of having voters “opt-out” at the ballot box in November.