Several strong bills pending in Massachusetts would do just that, and Massachusetts consumers would be much safer online if the Legislature enacted them.

The companies collecting our personal data should be the ones with the obligation to protect privacy, not the consumer. A good privacy law requires companies to limit their collection and use of personal data to what is necessary to provide the service the consumer asks for.

The biggest weakness in these laws is that they do not require companies to take proactive steps to protect privacy and instead put the onus on consumers to correct or delete their data — rights that very few consumers know exist or have time to use.

In a recent report scoring state privacy laws @epic.org and US PIRG, nine of those laws received Fs, and none received an A.

States have been leading the way on privacy legislation, but as our recent report points out, many of those state laws lack meaingful privacy protections. We urge any state lawmakers to look to the State Data Privacy Act we released with @consumerreports.org

epic.org/state-data-p...

Last week (26 years later in case anyone is counting at home), EPIC submitted comments to the Chair's Privacy Working Group urging Congress to center data minimization in any proposed federal privacy legislation it considers.

epic.org/epic-urges-f...

When I testified before Congress 23 YEARS later, I said:
"The U.S. faces a data privacy crisis. [...] We need comprehensive, baseline privacy protections for every person in the United States and changes to the business models that have led to today’s commercial surveillance systems."

In 1999(!), EPIC told Congress: "[T]he recent developments in the online industry make clear the need for privacy legislation. For those who are willing to look closely, there is little indication that self-regulation is working. Privacy policies read more like warning notices and disclaimers."