Data privacy experts predict some wins under Trump 2.0

A new Trump administration may not be as bad for data privacy regulation as many advocates fear it could be, though concerns still abound.

Republican worries over how data brokers threaten national security, for example, will likely inform some policy decisions. Many Trump allies voted in favor of legislation which would make it illegal for federal agencies to buy individuals’ information from data brokers. 

The Federal Trade Commission (FTC) in the first Trump administration proved willing to go after companies violating consumers’ privacy. A GOP-controlled Congress, armed with more votes, also could pass long-stalled federal comprehensive privacy legislation though likely in a weaker form.

Data privacy experts, advocates and a former FTC commissioner shared these and other insights with Recorded Future News in a series of interviews covering what to expect for data privacy under Trump 2.0. Taken in aggregate, these experts’ comments suggest a new Trump administration and Republican-led Congress could treat data privacy issues seriously. But some remain worried given Trump’s industry friendly bent.

Comprehensive federal data privacy legislation

The American Privacy Rights Act (APRA), the latest bipartisan effort at federal privacy legislation, has little momentum and is not widely expected to be enacted before this Congress wraps its work in early January. 

As with prior efforts to pass comprehensive federal privacy legislation, APRA has been stymied by a partisan fight over whether to include a right for individuals to sue companies that break the privacy law and by questions over which existing state laws federal legislation would preempt.

With Republicans in charge of the White House and both houses of Congress, some observers say a version of the bill could pass — though it would likely be weaker.

"There's 85% agreement between Democrats and Republicans about what should be in it, so I expect real movement on privacy legislation, even if what goes through lacks a private right of action, for example," former FTC Chair Jon Leibowitz told Recorded Future News. 

"A privacy law with strong preemption and no private right of action, but that truly protects consumers — an open question — may be better than no privacy law at all," added Leibowitz, who served during the Obama administration.

Many Republicans have sought a bill which preempts existing state laws both because they believe that the current patchwork of disparate regulations is difficult for industry to abide by and because they want to override tough laws like California’s aggressive privacy regime and Illinois’s Biometric Information Privacy Act. Both include a private right of action and have led to a wave of class action lawsuits against businesses.

With House Energy and Commerce Chair Cathy McMorris Rodgers (R-WA) retiring, Rep. Gus Bilirakis (R-FL) — another legislator who has proven committed to passing comprehensive privacy legislation — is seen as likely to take over the committee. Bilirakis was heavily involved in pushing comprehensive privacy legislation forward, so his leadership could be an important factor in keeping the effort alive, observers said.

Others are less sure that Congress will prioritize privacy legislation, however.

“It’s extremely hard to tell how much of a priority privacy will be alongside all of the other issues the GOP has expressed interest in, from immigration to abortion,” said Justin Sherman, a prominent expert on digital privacy and data brokers.

The national security link to data privacy will be a focus for the Trump administration and a Republican Congress focused on the threat posed by China, said Brandon Pugh, a director and resident senior fellow for the right-leaning policy nonprofit R Street Institute.

"While we say it's a data privacy law, we can't forget that it has data security provisions in it and it would actually secure the data we are collecting, which is largely not regulated right now, outside of specific industries,” Pugh said. “It's a huge issue. How adversaries are leveraging this data is an angle we can't forget." 

A data privacy bill passing will be determined by how the perennial debate over a private right of action and preemption are resolved, Pugh said, adding that there is still "steep disagreement" on those issues. He said that in addition to those "hot ticket" issues, there is also debate over how to regulate data minimization.

Prospects for data brokers

Last year Sen. Marco Rubio (R-FL) – Trump’s pick for Secretary of State — reintroduced a bill he first pushed in 2022 that is designed to protect data belonging to members of the military by preventing data brokers from selling it to China, Russia and other adversarial nations.

Sen. Marco Rubio, Trump's pick for Secretary of State, is one of several Republicans who has supported data privacy to protect national security. Image: Gage Skidmore via Wikimedia Commons (CC BY-SA 2.0)

“It is common sense to prevent big data companies and shady brokers from selling information about our military personnel to foreign adversaries who can use that information to harm our nation,” Rubio said at the time. “This bill would protect the privacy of service-members and mitigate this obvious national security risk.”

While the bill did not go anywhere, it is a good example of how many Republicans in Trump’s orbit think about data privacy. (Sherman, who conducted a landmark study on how data brokers sell military members’ sensitive health and financial data for mere pennies, helped craft the bill).

However, the focus only on the military is myopic because it will be impossible to counter national security threats without a sweeping bill protecting consumers too, Sherman said.

“If you only take the national security approach and think you can discard all of the consumer regulation, you’re not actually going to address the problem,” he said.

The former Trump administration was hawkish on China. Pugh said he expects the new administration to drill down on the nexus between national security and data, also with a focus on China.

"It's safe to say that under a Trump administration the national security link to privacy will probably be a priority, especially considering that China is a factor in terms of collecting information on Americans and exploiting it,” he said. “A lot of Republicans have been hyper concerned about these actions by China.”

One question hinges on how ongoing Biden administration efforts to regulate bulk data transfers to China and other adversarial nations fare under Trump.

Members of industry were skeptical of the bulk data transfer proposed rule when it first was announced due to how its provisions could affect legitimate business practices. The Biden administration has recently made some changes to the proposed rule to address those concerns, Pugh said.

However, Trump could rescind the executive order which led to the rulemaking or change it, Pugh said, citing the fact that it is not yet finalized and industry remains concerned about how to implement many of the proposed new measures.

Proponents of regulating data brokers are also watching how the Trump administration will approach a significant piece of legislation known as the Fourth Amendment Is Not For Sale Act, which passed the House with strong bipartisan support, including from 123 Republicans, in April. It was rejected in the Senate — an outcome that backers believe was largely due to intense Biden administration opposition and the fact that it was proposed as an amendment to a bill reauthorizing Section 702 of the controversial Foreign Intelligence Surveillance Act (FISA).

The bill would limit the government’s ability to buy so-called commercially available information about Americans from data brokers without a warrant. The Biden administration sounded alarms about how such a restriction would constrain the intelligence community.

Sponsors of the legislation have argued that the government’s practice of buying sweeping data on Americans from data brokers constitutes an unreasonable search and seizure by the government.

Strong Trump allies like House Judiciary Committee Chair Jim Jordan (R-OH), Sen. Mike Lee (R-UT) and Rep. Matt Gaetz (R-FL) — Trump’s choice for attorney general — are all advocates for the legislation.

The American Civil Liberties Union (ACLU) and other groups which advocate for data privacy also have championed the bill, which they believe will get a new push in the next Congress.

“There is a really strong group of Republicans who are … really good on surveillance issues and have been on the side of reform and a lot of these people are in Trump's orbit,” said Kia Hamadanchy, senior policy counsel at the ACLU.

Another ACLU priority has been the demise of FISA Section 702, which allows the U.S. government to spy on the digital communications of foreigners without a warrant, but also sweeps up the communications of an unknown number of American citizens. Congress recently reauthorized the controversial program to 2026.

During the last reauthorization debate Trump urged Congress to discontinue the program. Writing on his social media platform he said, “KILL FISA, IT WAS ILLEGALLY USED AGAINST ME, AND MANY OTHERS. THEY SPIED ON MY CAMPAIGN!!!”

Despite what the ACLU sees as hopeful signs for reform, Hamadanchy stopped short of claiming victory, saying that Trump is ultimately a “complete wild card … Sometimes he'll just go with whoever he's talked to last.”

A second ACLU expert said he hopes that Trump‘s own expressed suspicion of state use of data to surveill, track and target people could lead to important reform.

“The personal perspective that he has could result in actual policy changes in the future,” said Cody Venzke, a senior policy counsel focused on surveillance, privacy and technology.

A new FTC

The FTC under Chair Lina Khan has shown unprecedented muscle in pursuing companies violating privacy laws. She will most likely be removed as chair since Trump will probably select a Republican for the role, but there is also a sense that anything could happen due to how different people close to Trump view her. 

FTC Chair Lina Khan speaks September 18, 2024, at the Aspen Cyber Summit in Washington, D.C. Image: Aspen Cyber Summit

“We have Elon Musk saying that Lina Khan will be fired soon as chair of the FTC, and yet JD Vance is saying that she was doing a great job so we have mixed messaging,” said Bill Budington, a senior staff technologist at the Electronic Frontier Foundation. “I think that a lot of it will depend on who has Trump's ear at the moment.”

Still, Budington said Trump is a “corporatist through and through,” suggesting he may side with industry’s desire to rein in an aggressive FTC under Khan.

“It's hard to imagine that regulatory power will be as strong as it has been,” he said. “In the last four years, we've seen a huge appetite for protecting consumer data, especially by the FTC.”

Other digital privacy advocates struck a more hopeful tone, noting that digital privacy is a bipartisan issue. In the first Trump administration the FTC issued many tough privacy enforcements, said John Davisson, director of litigation at the Electronic Privacy Information Center.

Among those enforcements were a record-breaking $5 billion penalty against Facebook (now Meta) to settle charges that the company allegedly violated a 2012 FTC order by tricking users about their ability to dictate the privacy of their data and a settlement with the credit ratings giant Equifax Inc. in which the company agreed to pay at least $575 million to resolve allegations that it failed to take reasonable steps to secure its network. 

Equifax’s allegedly shoddy data security practices enabled a breach which exposed the data of 147 million people, the FTC said at the time.

The Trump 1.0 FTC also obtained a $170 million civil penalty from Google stemming from allegations that YouTube illegally gathered children’s personal data without parental consent and settled with Uber over allegations that the ride-sharing company duped customers about how it treated privacy and data security.

While the current FTC is often split across party lines, Davisson said there is also notable agreement between the commissioners, which is sometimes reflected in vote tallies.

“If you look at the areas of alignment and agreement between the commissioners, there's actually quite a lot they agree on, and that I would expect to see carried forward into the next administration,” he said,

The FTC and the Consumer Financial Protection Bureau’s (CFPB)’s work cracking down on data brokers will likely continue in the next Trump administration in some form, Davisson said, citing the bipartisan focus on the issue and the government wide push to rein in data brokers selling to China.

The CFPB is currently working on a sweeping rule that would designate data brokers as consumer reporting agencies, a status that would force them to adhere to tough accuracy and privacy regulations outlined in the Fair Credit Reporting Act and would prevent law enforcement from buying some of their data.

“There's a recognition that the problem of data brokers is not just a left-wing fixation,” Davisson said. “It's something that has major implications for national security. It has major implications for the safety of law enforcement and judicial officers. It has implications for fraud, harassment, stalking, abuse.”

“There's really quite a lot of bipartisan agreement around the consensus that something needs to be done to rein in an industry that is out of control and causing all of these harms and creating all of these risks,” Davisson added.

However, the fate of the current FTC’s effort to implement a commercial surveillance rule is unclear. The agency has been working on a proposed rule, which is said to focus on data minimization, data security and algorithmic accountability, since August 2022. 

There is not enough time for this FTC to get a rule in place before Trump takes over in January. 

Whether the next iteration of the commission will adopt a proposed rule updating how companies treat children’s privacy — a priority for Khan — is also an open question. 

A Republican member of the current commission recently criticized Khan’s approach, and her rulemakings, as too aggressive.

But Leibowitz, the former FTC commissioner, echoed Davisson’s optimistic tone about the future of the agency under Trump. He said that while he expects the commission to do less rulemaking and issue less guidance, privacy enforcement will continue.

"One of the good things about the FTC is there has always been Republican and Democrat consensus to do enforcement in the privacy space,” he said. “There might be some slightly different emphasis, but that consensus and that enforcement will continue no matter who the chair is."

The ACLU’s Venzke was less sanguine about the overall landscape for digital privacy under Trump, notwithstanding his hope that the Fourth Amendment is Not for Sale could pass.

“I'm hopeful that whoever the next chair of the FTC is, whoever the next head of the CFPB is, will recognize the importance of protecting privacy and continue those rulemakings in some fashion, but there's a significant risk that the strides that have been made will be undone,” he said.