Skip to Main Content
Resource · Blog

The Rise of ‘Opt-in’ Provisions in State Consumer Data Privacy Bills

by Floyd Buford, FiscalNote

Consumer data privacy is relatively new in the American legislative system but interest is rising as new provisions emerge. Here's a look at the state of data privacy legislation in the United States in 2022.

woman holding phone

Back to resources listing

If you have ever made an online purchase and been asked to “check this box if you want to receive future promotions,” you weren’t just deciding how much spam you wanted to keep out of your inbox, you were actually wading into one of the hottest topics in consumer data privacy legislation today. “Opt-in” and “opt-out” notices have become a central part of legislative efforts in the United States designed to enhance data privacy protections and curtail the influence big tech companies have over individual consumers — and they are sure to play an even larger role in the years ahead.

How are you staying on top of the 150,000+ bills introduced in the states this year?

FiscalNote State allows organizations to monitor state legislation and regulations. Learn how FiscalNote can help you manage your state-level issues.

The Journey to Consumer Data Privacy Legislation in the US

Requiring that tech platforms give consumers the choice of opting in or out to the collection of their personal data is a relatively new idea in the U.S. The California state legislature was the first to pass legislation around this topic with the California Consumer Privacy Act of 2018, which was hailed by many at the time as a landmark achievement in the world of consumer data privacy rights. Among its many provisions was the requirement that businesses give consumers the chance to opt out of the collection of their personal data before it could be sold to a third party.  

At the same time, Congressman Ro Khanna, D-CA, who represents Silicon Valley in Congress, was crafting his own “Internet Bill of Rights” which stipulated that consumers must opt-in (give affirmative permission) to the collection and sale of their personal data by a business or platform. Even though Democrats took control of Congress, an Internet Bill of Rights was never formally introduced and the burden fell to the states to enact their own protections.

Besides California, New Jersey was the only other state to introduce a consumer data privacy bill in 2018. Just one year later that number increased to 15 before jumping to 25 in 2020. Last year, 29 states introduced consumer data privacy bills, and almost all contained either an “opt-in” or “opt-out” requirement. 

How to Keep Up With Consumer Data Privacy Policy Around the Globe

Learn about the strategies and tools you need to get ahead of the consumer data privacy legislative discussions and protect your organization's interests.

The ‘Opt-In’ Battle in 2022

“Opt-in” requirements are generally viewed as being more consumer-oriented than “opt-out,” but also more burdensome and costly for businesses. For example, one study found that “opt-in” policies would cost a small hospital over $1.3 million more than an “opt-out” requirement would; while another study found that businesses would be forced to spend billions more in advertising costs under an “opt-in” system. Additionally, some of the biggest opponents of “opt-in” laws have been the big tech companies that profit from the sale of consumer data. 

Having the business industry and big tech companies aligned in opposition to “opt-in” policies puts both Republicans and Democrats in somewhat of an awkward political position. While Republicans say they want to be tough on big tech companies, they also want to appear friendly to business interests. And while Democrats say they want to strengthen regulations and reduce corporate loopholes, they also do not want to crack down too hard on an industry that is a reliable source of donors during every election cycle. 

Regardless, five of the state bills with “opt-in” requirements last year came from Republican legislatures — North Dakota, Oklahoma, Minnesota, Texas, and Utah – and seven came from states controlled by Democrats — Massachusetts, New York, Connecticut, Virginia, Colorado and two in Washington.

As the rest of the 2022 sessions play out, “opt-in” and “opt-out” requirements will remain at the center of the push within state legislatures to reform consumer data privacy laws and halt the influence of big tech companies. As “opt-in” provisions become more popular and representatives are forced to choose between competing priorities and constituent groups, many will run the risk of having voters “opt-out” at the ballot box in November.

Ready to see for yourself?

In 2020 the states introduced more than 130,000 bills. Are you sure you didn't miss something important? Learn how you can easily track legislation and regulations in all 50 states, DC and Puerto Rico.

Back to resources listing