The State of Affairs: What Happened in Tech Policy During 2023 State Legislative Sessions?
Since 2018, there has been a growing trend across the 50 states – a greater number of legislative proposals aimed at technology policy. In 2023 alone, state legislators introduced hundreds of bills focused on tech, ranging from consumer data privacy, content moderation, competition, and children’s online safety. Furthermore, prominent proposals in states including California, Florida, Tennessee, Minnesota, New York, Massachusetts, Texas, and Utah are rapidly advancing through the legislative process.
When it comes to tech policy at the state level, proposed regulations on digital services that operate across state and national borders can have significant impacts, including on smaller businesses and startups. While recognizing that policymakers are appropriately interested in such services that make a growing contribution to the U.S. economy, it is important to consider potential adverse impacts to both consumers and businesses alike, along with the legal implications – many proposals raise serious constitutional questions and conflict with federal law, including Section 230.
So what exactly happened in state legislatures in 2023, and what can we expect in 2024?
Consumer Data Privacy
In the ongoing absence of federal baseline privacy protections, the 2023 state legislative sessions saw several states successfully enact their own data privacy frameworks, adding to a growing patchwork of laws. At the start of 2023 just five states – California, Colorado, Connecticut, Utah, and Virginia – had comprehensive state privacy laws on the books. And now that number has more than doubled with Florida, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas joining the pack. Florida’s law takes a particularly different approach, limiting the law’s applicability to businesses that exceed $1 billion in global gross annual revenues and either derive at least 50% of that revenue from online ad sales, operate a smart speaker and voice-activated virtual assistant, or operate an app store with at least 250,000 different applications. Interestingly, this scope exempts data brokers who may pose the greatest concern when it comes to consumer privacy. Delaware lawmakers also passed legislation that is still pending action by Governor John Carney (D).
State legislators also focused on other facets of data privacy, largely a result of last year’s Dobbs decision and now-heightened concerns surrounding health and biometric data privacy. Washington enacted the My Health, My Data Act, which, while branded as a health data privacy bill, is akin to a comprehensive bill given its broad scope and definitions. Nevada passed SB 370 to create certain data privacy protections surrounding health data. Connecticut established stronger privacy protections for younger users with amendments to the Connecticut Data Privacy Act, which just went into effect on July 1 of this year.
Content Moderation
Legislation aimed at regulating online businesses and content on their platforms took on several different iterations in 2023. CCIA tracked over 200 pieces of legislation this session that focused on regulating online content. States such as Kansas, California, New York, Arizona, Montana, Tennessee, Georgia, and Minnesota, among others, are considering, or have enacted, content moderation legislation. Many of these bills are unconstitutional, conflict with federal law including Section 230 (often regarded as “the most important law in tech”), and would place major barriers on digital services’ abilities to restrict dangerous content on their platforms.
With the increased focus on AI technologies in 2023, legislators introduced proposals regulating the use of algorithmically informed decision-making, including for online content moderation. Many proposals were aimed at studying these technologies or creating oversight commissions or offices to manage how AI is used and where regulation may be needed. However, as many online businesses continue to use such decision-making tools to make content moderation decisions, it has become an increasingly important question as to how, or whether, states can regulate social media and speech online.
It is also important to note the unique circumstances surrounding how legislators are approaching content moderation proposals this session in comparison to 2021 and 2022. This year was the first session in which pending litigation surrounding whether and how the government can dictate how online businesses moderate content and speech on their platforms is awaiting a decision from the Supreme Court of the United States on whether to grant a writ of certiorari. The outcome of NetChoice & CCIA v. Paxton and NetChoice & CCIA v. Moody will impact how user-generated content is treated moving forward. Many proposals introduced this session, specifically on limiting “censorship” on platforms, were put on pause due to the nature of these current cases. Many legislators made the measured decision to pause the advancement of this type of legislation while this litigation is pending before the Supreme Court.
Children’s Online Safety
Addressing the potential impacts online activities may have on younger users and preventing harms is an important policy consideration, but the means to achieve that goal are just as important as the goal itself. Many proposals aimed at providing additional online protections for children actually risk introducing additional privacy concerns, or barriers to accessing communities of support and information online.
Last year, California passed the Age-Appropriate Design Code (AADC), a law modeled from a United Kingdom framework that creates data privacy and constitutional concerns, and that is now facing a legal challenge. But that challenge did not deter other states like Maryland, Minnesota, New Mexico, and New Jersey from introducing their own similar proposals. However, no other state legislature to date has passed a law akin to California’s AADC.
In other states, lawmakers considered even more extreme measures. For example, recently-passed laws in Arkansas and Utah would implement provisions such as mandatory age verification of users on certain platforms and limiting use of such services during specific hours. These laws, unfortunately, present additional challenges and issues surrounding data privacy, open access to information on the internet, and government overreach. Arkansas’ law is also facing a legal challenge, contending that it violates the First Amendment.
Still other proposals, like those introduced in states like Alabama, Idaho, Montana, and Tennessee, would establish technically infeasible requirements for default “content filters” to be automatically enabled when a smartphone or tablet is activated within that state’s borders. Branded as a way to prevent children from accessing pornographic material, these proposals would again create barriers to open online information access, particularly through providing child-specific controls on devices purchased by adults. The market also already has solutions to prevent younger users from accessing material parents deem as inappropriate, such as device settings, parental controls, and other mechanisms via internet service providers.
Antitrust
In 2023, seven state legislatures introduced competition-related legislation, continuing the trend of states attempting to tackle policy areas typically addressed at the federal level. This activity at the state level could create significant issues as an increasing patchwork of laws would force businesses to navigate conflicting and disparate requirements, which could ultimately result in significant barriers to innovation and investment.
New York and Minnesota re-introduced antitrust-focused bills that had previously failed to pass in prior legislative sessions. Additionally, this year saw Maryland, Maine, Montana, New Jersey, and Oregon introduce new pieces of competition-related legislation. The majority of these bills dealt with abuse of dominance and attempts to establish a monopoly or monopsony. Several of them also would have created duplicative merger notification requirements. Broadly, these bills would harm competition and stymie innovation by penalizing legitimate business practices and the results of competition on the merits.
Notably, of the over two dozen bills introduced this year, only one bill, Oregon’s SB 310, made it through the legislative process and was enacted into law. With the exception of New Jersey, which has a year-round legislative session, the rest of the state bills will have to restart the legislative process in 2024.
Takeaways from 2023 Legislative Sessions
If recent state legislative sessions have shown us anything, it is that state lawmakers will continue to be focused on technology policy, introducing and advancing bills that have broad impacts on consumers and businesses alike. In this dynamic space, it is increasingly important to understand when and where these conversations are taking place and that relevant stakeholders have a seat at the table. Such open discussions help to promote measured, informed, and targeted proposals, while sidelining or improving those that would otherwise create unintended consequences and adverse impacts.
