Americans Need a Data Protection Agency

You and your family have a right to privacy. But right now, your children’s data is being used as a commodity that’s hawked and traded. Companies will mine your intimate, personal purchases or conversations heard by smart devices for profit with little to no accountability. Our democracy is up for sale to the highest bidder.

There are now an estimated 25 billion connected devices worldwide, and many of those are in the hands of children. Children are spending unprecedented amounts of time on devices that track their locations, relationships, and even emotions. Pre-pandemic, on average, US children ages 8–12 in were spending 4–6 hours a day using screens, and teens were spending up to 9 hours. A recent report found that kids aged 4–15 now spend an average of 85 minutes per day watching YouTube videos, and 80 minutes per day on TikTok, notwithstanding other screen activity. Kids are now watching twice as many videos per day as they did just four years ago. Despite the 13-and-up “age-gate” that the FTC is responsible for enforcing, 69% of U.S. kids bypass controls and use YouTube, while only 7% used YouTube Kids, its version intended for children.

I have seen firsthand how my children’s online activities have been driven by the powerful recommendations and algorithms that run these platforms. I have observed how the “dark patterns” companies deploy to lure children into more feed scrolling, more “loot rolling,” and more profiteering from their private lives and interests.

I know I have basic questions I want answers to: When is Facebook allowed to share my teenage son Theo’s data from his Instagram page with advertisers? What are the limits on how and why they collect his information? And if Henry decided to download TikTok to his phone would that app company then have backdoor access to all of the phone’s data?

It is not just our children that stand to suffer privacy and civil rights harms without action, however, and we must meet the rising power of Big Tech with the urgency and scale it deserves. Congressional inaction has allowed tech companies to take on a bloated role as decision-makers in our greater society — and their decisions are failing to protect consumers, competition, and our democracy. The COVID-19 pandemic has brought our lives evermore online which has brought online dangers more directly into our everyday reality. Americans have, willingly or unwillingly, ceded their personal lives to Big Tech companies that have little interest in protecting it and every incentive to parse, analyze, and sell it. Everyone wants privacy, but how do we practically achieve it?

For years we have watched Silicon Valley and the tech giants “move fast and break things,” like our ability to regulate them and hold them accountable. Existing federal regulatory structure is limited, and while the FTC also has authority over unfair and deceptive acts, many abuses in the digital marketplace are not considered harmful, unfair, or deceptive enough to warrant more than one-off penalties against individual companies. There is no set of strong, clear “rules of the road” across a digital ecosystem that at times has grown four times faster than the rest of the overall economy.

Misinformation is rampant online and has led to major real-life consequences, from “Pizzagate” to the horrific events of January 6th that I witnessed firsthand. We the people are bearing the brunt of the cost to the tech giants’ business — and soon the cost will be too great. But how do we account for the individual harms as well as the group harms? Who will stand up for each and every one of us?

I believe that that you deserve to be in control of your own data. You have the right to know how companies are using your personal information. You need a way to protect yourself and your family. But you cannot do this alone. That’s why I’m introducing legislation to bring the protection of your privacy and freedom into the digital age. The Data Protection Act of 2021 would create the Data Protection Agency (DPA), a new federal agency that would protect Americans’ data, safeguard their privacy, and ensure data practices are fair and transparent.

First introduced in 2020, my updated legislation has undergone significant improvements, including updated provisions to protect against privacy harms and discrimination; to oversee the use of high-risk data practices; and to assess and propose remedies to the social, ethical, and economic impacts of data collection. Additionally, the DPA would have the broad rulemaking authority and resources to effectively enforce data protection rules — created either by itself or Congress — and would be equipped with strong enforcement tools including civil penalties, injunctive relief, and equitable remedies. The DPA’s research unit would analyze and report on data protection and privacy innovation across sectors, and would also develop and provide resources that assess unfair outcomes that result from the use of automated decision systems, like algorithms. The DPA would also represent the United States at international forums regarding data privacy and inform future treaty agreements regarding data, since the U.S. is one of the only democracies, and the only member of the Organization for Economic Cooperation and Development (OECD), without a federal data protection agency.

Lawlessness in the data privacy space has given rise to new, unexpected forms of injustice. Tristan Harris, a former design ethicist at Google and the current president of the Center for Humane Technology, testified before the US House Subcommittee on Consumer Protection and Commerce during a hearing called “Americans at Risk: Manipulation and Deception in the Digital Age,” and claimed, “Technology companies manipulate our sense of identity, self-worth, relationships, beliefs, actions, attention, memory, physiology and even habit-formation processes, without proper responsibility.” Mr. Harris continued to say that “…technology has directly led to the many failures and problems that we are all seeing: fake news, addiction, polarization, social isolation, declining teen mental health, conspiracy thinking, erosion of trust, [and] breakdown of truth.”

Imagine if a tech company had a way to determine if a person is low-income or has a poor credit score. Maybe they go ahead and sell that data to a third party — and, before you know it, the next time that person opens their browser, they’re being served ads for predatory payday lending schemes. We know this discrimination is happening, but currently, there is nowhere in our government to turn to for help.

The tech giants — Google and Facebook among them — have been the clear winners of our transition to the digital age. These companies have built major empires of data with information about our private lives. They’re processing that information with increasingly complex and sophisticated algorithms. And they’re making a whole lot of money off of it.

Meanwhile, major data breaches and ransomware attacks are exposing the sensitive data from tens of millions of Americans because the companies responsible for safeguarding it continue to face limited consequences for their failures. Bad actors use powerful data collection and processing techniques to target older Americans and other vulnerable citizens through robocalls and misinformation scams.

All of this is worth pause and concern as American consumers invite new voice-activated assistants into their homes and let AI systems take control of their cars. Even the savviest consumers of technology cannot fully understand how companies use their data, where their data goes, how far companies are willing to go to profit from that data, and whether the companies’ business practices encroach on their privacy and freedom.

Moreover, companies have declared that this data is theirs for the taking, and they’ve repeatedly rejected responsibility and accountability for the greater impacts of any bad behavior.

So as we stare down the barrel of threats from foreign adversaries and unrestrained private firms trying to target personal data in consumer households, businesses, and government agencies, the data privacy space remains a complete and total Wild West in need of a new sheriff in town. And that is a huge problem. The DPA is an important part of the solution.