In late 2019, Utah state senator Kirk Cullimore got a phone call from one of his constituents, a lawyer who represented technology companies in California.
“He said, ‘I think the businesses I represent would like to have some bright lines about what they can do in Utah,’ ” Cullimore told The Markup.
At the time, tech companies in California were struggling with how they could comply with a new state law that gave individual Californians control over the data that corporations routinely gather and sell about their online activities. The lawyer, whom Cullimore and his office wouldn’t identify, recounted how burdensome his corporate clients found the rules, Cullimore remembered, and suggested that Utah proactively pass its own, business-friendly consumer privacy law.
“He said, ‘I want to make this easy so consumers can make use of their rights and the compliance is also easy for companies. He actually sent me some suggested language [for a bill] that was not very complex,” Cullimore told The Markup. “I introduced the bill as that.”
What followed over the next two years was a multipronged influence campaign straight out of a playbook Big Tech is deploying around the country in response to consumer privacy legislation.
It’s common for industries to lobby lawmakers on issues affecting their business. But there is a massive disparity in the state-by-state battle over privacy legislation between well-funded, well-organized tech lobbyists and their opposition of relatively scattered consumer advocates and privacy-minded politicians, The Markup has found.
During the 2021 and 2022 Utah legislative sessions—when Cullimore’s bill made its way through the legislature—Amazon, Apple, Facebook, Google, and Microsoft collectively registered 23 active lobbyists in the state, according to their lobbying disclosures. Thirteen of those lobbyists had never previously registered to work in the state, and some of them were influential in shaping Cullimore’s legislation.
For example, when Cullimore introduced substitute language to his bill during a February hearing, he did so with the help of Anton van Seventer, a lobbyist for the State Privacy and Security Coalition, a nonprofit created by a handful of the nation’s biggest tech, retail, and advertising companies.
The only advocacy group that called for stronger consumer protections during public hearings for Utah’s privacy law was Consumer Reports.
In March, Utah governor Spencer Cox signed Cullimore’s bill into law—a clear victory for Big Tech and the strategy the industry has developed for confronting a growing threat to its business model.
We reviewed public hearing testimony, public comments, and lobbying records in all 31 states that have considered consumer data privacy legislation since 2021 and found a coordinated, nationwide campaign by Big Tech to mold the rules to its will—a demonstration of how powerful tech companies can be when they coalesce around a common agenda.
Not just in Utah, but in Virginia and Washington, and Minnesota, tech companies have provided draft language that led to the introduction of industry-friendly privacy bills, according to legislators The Markup interviewed and previous reporting by Protocol.
Big Tech funded nonprofits like TechNet, the State Privacy and Security Coalition, and the Internet Association have traveled from state to state encouraging legislators to “mirror” those industry-authored bills. TechNet representatives, for example, have testified or supplied written comments on privacy bills in at least 10 states since 2021, more than any other organization, according to our analysis of state legislative records.
And lobbyists have come in droves: We counted 445 lobbyists and lobbying firms that actively represented Amazon, Apple, Google, Meta, Microsoft, TechNet, and the State Privacy and Security Coalition in the 31 states we examined, during the time those states’ legislatures were considering privacy legislation. Many of them registered as lobbyists for the first time in the weeks immediately before or after a privacy bill was introduced
Up-to-date lobbying information wasn’t available in several states, so that tally is likely an undercount.
The companies aren’t just employing similar tactics, they’re employing the same people—75 of the lobbyists we identified are affiliated with a single Sausalito, California–based firm, Politicom Law. We found Politicom-affiliated lobbyists working on behalf of Apple, Google, Meta, and Microsoft in 21 states that have considered privacy legislation.
“For a while, a lot of companies were hoping for a federal law that preempted everything,” said Justin Brookman, the director of privacy and technology policy for Consumer Reports, which has lobbied in favor of stronger consumer privacy protections in many states. “But given how things don’t move
