04 Oct 2025 Search

It is a truth universally acknowledged, that a state in possession of an honest legislature must be in want of a privacy law with a private right of action. The Attorney General can’t be everywhere, and a typical jury is going to have more common sense about privacy stuff, and redressing privacy harms, than state bureaucrats trapped in a high-CO2 office building. But too often, when people say private right of action what business owners hear is private right of action over bullshit paperwork or private right of action over JavaScript mistakes.

It doesn’t have to be that way. We can have private right of action without statutory damages for bugs, bullshit, or failing to hire the right compliance consultant. State legislators aren’t technically in the antitrust business, but there are some ways that a next-generation state privacy law can avoid doing severe competition harms and avoid making real-world privacy worse. You have to look at the details of the private right of action. Is it a hunting license to go after legit small businesses, or a way to align the interests of lawyers in private practice with the state’s interest in having a thriving business scene, satisfied consumers, and citizens protected from fraud and disinformation?

We really need private right of action in two areas.

  • Concrete injury. This should be an obvious one. The courts are finally getting past the old Section 230 magically makes everything that Big Tech does legal lol doctrine and taking steps to hold companies accountable for the harms that their code does and was written to do. POSIWID Meta’s ad system is designed to work together with fraud operators to do fraud. As Professor Eric Goldman explains, at least one court is no longer letting Meta inflict concrete injuries and get away with it just because third-party content is involved in some way. Lawyers on the plaintiff’s side are finally making some progress in making a connection between some concrete injury that they know about and some policy or coding decision by Big Tech that caused the injury.

    But state privacy law needs to work with this trend, not against it. The victim of a concrete injury that isn’t seen, or can’t be traced back to a Big Tech decision because it’s buried in some incomprehensible ML system, is not going to get justice. So we’re going to need private right of action in one more place.

  • Failure to disclose data or inferences in a Right to Know. For legit companies, Right to Know (RtK) can be a compliance hassle to start with, but by now it shouldn’t be so much of a big deal. Yes, RtK is a pain to deal with on day one of a new privacy law, because customer data can be in a bunch of random places like spreadsheets, SaaS marketing applications, lists of leads from events, and all that kind of thing. But, for a legit company, RtK efficiency is a side effect of finally finishing the CRM project that you knew was a good idea anyway. When the CRM system is shipshape, and any random piles of customer data that fell behind the file cabinet have been entered into CRM or shredded, RtKs are a minor issue.

    For Big Tech, RtKs are another story. Inside the Big Tech companies, people’s personal information tends to pile up in a variety of deliberately complex systems. These systems are designed to obfuscate how people are targeted for ads, because the Big Tech companies learned the lesson of the Facebook (Still) Letting Housing Advertisers Exclude Users by Race saga. At Big Tech’s scale, if targeting data or inferences are available, crimes become evident. (For what it’s worth, this is also the reason why Big Tech is so fired up about privacy-preserving ad schemes such as the attribution cartel—if they bury the discrimination and user-hostile targeting practices under enough math, then the evidence won’t come out within the time and budget available to an investigative reporter or academic research project.)

    Reporters and researchers can do a lot with RtK data once they have it—but getting it, and reliably, will require a strong Right to Know backed up by private right of action.

Those two areas are low-impact for legit businesses, who don’t perpetrate concrete injuries or run big ML systems, the way that Big Tech does. Normal companies will be able to answer most RtKs with a standard reply like, we have conducted a diligent search of our records and have not located any information matching the name and address you provided. You probably know how to do these already. The place where a well-designed RtK+PRA combo will make a difference is in shedding light on Big Tech’s Hydra of targeting inferences, and the various harms that it enables. We can tell that the information is in there somewhere, but we need the option of a private right of action to have a better chance of getting at it.

Discuss on LinkedIn

LinkedIn post by Vermont State Representative Monique Priestley. I’m not sure how we have good faith conversations to settle details if we don’t have honest lobbyists, who are instead paid to muddy the waters and scare the public (read as small-to medium-sized businesses who are members of trade associations).