Targeting Online Privacy, Congress Sets A New Tone With Big Tech

For years, big tech has been given a pretty free rein by Capitol Hill to act as they chose: Congressional oversight of the industry largely focused on whether there was political bias on various platforms.

But in a reversal, Congress is holding oversight hearings this week, and lawmakers are proposing regulations to crack down on how big tech companies use and resell their customers' personal information.

The change is driven in part by the new Democratic majority in the House, along with younger and more tech-savvy lawmakers in both parties.

"They want to know"

The constant stream of reports about how data is being used by companies like Facebook and Google (both of which have been NPR funders) shows that self-regulation hasn't worked, said Rep. Jan Schakowsky, D-Ill.

"In the last two weeks alone, we learned that Facebook exposed individuals' private health information that consumers thought was in a protected closed group," Schakowsky told NPR, "and collected data from third-party apps ... on issues as personal as women's menstrual cycles and cancer treatment."

Legislation is needed "that sets the terms on privacy. And I think what consumers really want is transparency. They want to know what's actually being collected. They want some control and then they want some accountability," said Schakowsky.

There aren't many issues in Congress with bipartisan support these days, but the need for stricter privacy rules for tech companies is one. Republicans agree it's time to set some limits on what big tech companies can do with personal data.

Rep. Greg Walden, R-Ore., the ranking member on the House Energy and Commerce Committee, said he has "not met a single American who has ever fully read the fine print of some sort of agreement when you download an app or get an update."

"You know you're going to update it and you're going to push agree, and you're not reading the privacy policy of that company," he said. "And the question is, did they even follow their own privacy policies or are the privacy policies adequate?"

It's complicated

Across the Capitol, at a Senate Judiciary Committee hearing on Tuesday, freshman Sen. Josh Hawley grilled Google's senior privacy counsel on the company's location tracking policy for its Android mobile operating system, noting that phone users can't turn off the location-tracking function.

"Do you think an average consumer who uses your products fully understands Google builds a profile about her, tracks where she goes to work, tracks where her boyfriend lives, tracks where she goes to church, tracks when she goes to the doctor?" the Missouri Republican asked Will DeVries. "Do you think that an average consumer would anticipate that?"

DeVries responded that Google has a duty "to communicate this information clearly," adding, "I don't believe we track that information at that level without communicating it."

"It's a complicated subject," he said, because some of that data is needed to make the user's phone operate properly.

But Hawley said, "What's complicated is you don't allow consumers to stop your tracking of them. You tell them that you do ... but in fact you're still gathering the information."

Hawley and Sen. Ed Markey, D-Mass., introduced legislation to protect the online privacy of minors. The measure, according to a press release from the senators, would prohibit "internet companies from collecting personal and location information from anyone under 13 without parental consent and from anyone 13- to 15-years old without the user's consent."

It's one of a number of bills expected to be introduced by lawmakers from both parties and chambers in the coming months.

Getting states on the same page

GOP lawmakers and the tech industry want to ensure that whatever steps Congress takes to enact privacy regulations supersede any measures enacted by the states.

California has already approved its own strict privacy legislation. Dave Grimaldi of the Interactive Advertising Bureau, which represents Facebook, Amazon (also an NPR funder) and Google among others, said the tech industry is willing to go along with new privacy regulations. But he told NPR that the industry can't navigate 50 different laws, nor could consumers.

"The Internet is global," Grimaldi said. "It most certainly goes over state lines. And I think that changing or altering the Internet experience state to state would be something that would be a giant turnoff to consumers and just wouldn't help anyone."

More scrutiny to come

The tech companies are facing a challenge on another front: The Federal Trade Commission last week announced a task force to take a look at recent industry mergers. Marc Rotenberg, president of the Electronic Privacy Information Center, said it's long overdue.

"I think they probably should have set up that task force more than a decade ago," Rotenberg said, "around the time they were approving the mergers that allowed for example Google to acquire DoubleClick, the big Internet advertising firm, or Facebook to acquire WhatsApp, which was a competing messaging service. Those deals should have been subject to much more scrutiny than they were at the time."