During Mark Zuckerberg's first day of hearings on Capitol Hill Tuesday, Senator Richard Durbin, D-Illinois, tried to ask the Facebook CEO a question about his state. "Illinois has a Biometric Information Privacy Act, or the state does, which is to regulate the commercial use of facial, voice, finger and iris scans and the like. We're now in a fulsome debate on that. And I'm afraid Facebook has come down to the position of trying to carve out exceptions to that. I hope you'll fill me in on how that is consistent with protecting privacy."
Zuckerberg never had to answer the question because Durbin’s time expired. But the incident highlights how, even as Zuckerberg promised Congress that Facebook would do a better job protecting its users’ privacy, the company has been working to oppose or weaken privacy measures at the state level.
Facebook pours millions of dollars into state and federal lobbying efforts, some of which oppose legislation designed to bolster privacy. The company has contributed to the campaigns of representatives who want to gut the Illinois privacy law referenced by Durbin, and it ponied up $200,000 to oppose a consumer privacy ballot initiative in California. Wednesday, shortly after Zuckerberg finished testifying in Washington, Facebook said it was no longer contributing to the group opposing the California measure.
“I’m sitting here watching Mark Zuckerberg say he’s sorry and that Facebook will do better on privacy, yet literally as he testifies lobbyists paid by Facebook in Illinois and California are working to stop or gut privacy laws,” says Alvaro Bedoya, a professor and the executive director of the Center on Privacy & Technology at Georgetown Law School. “If Facebook wants to do better on privacy, it needs to put its money where its mouth is, it needs to stop paying lobbyists to gut critical privacy initiatives in these states."
Facebook's lobbying efforts are part of a wider push among tech corporations including Google, Verizon, and Comcast, which also often oppose consumer privacy legislation. Facebook's business model, like that of other internet platforms, primarily relies on collecting people's personal data and using that information to sell ads. The social network has financial incentives to ensure that state regulations don't hinder its efforts to amass that info. But Zuckerberg himself said on Capitol Hill this week that he is open to new laws regulating his company, meaning the social network's lobbying efforts may soon change.
While Zuckerberg answered questions from Congress Wednesday, state representatives in Illinois were scheduled to attend the first of two hearings about a proposed amendment to the Biometric Information Privacy Act, the law Durbin brought up to Zuckerberg.
The proposed amendment was not discussed in committee during the scheduled hearings this week, but if passed, it would essentially gut the law, which is widely regarded as one of the strongest biometric privacy protections in the country. It's likely the reason for example that Google's widely popular Arts & Culture app, which turns your selfies into art, doesn't work in Illinois.
Passed in 2008, the Illinois law requires that companies ask permission before collecting biometric data, including for facial recognition. It mandates corporations list the purpose and length of time a person's data will be stored, and to include those details in a written biometric privacy policy. The law also allows consumers to sue alleged violators; that’s led to numerous lawsuits, including against Facebook.
Chicago resident Carlo Licata and two others sued the social network in 2015. They said Facebook had enrolled them without their consent in Tag Suggestions, a Facebook feature introduced in 2010 that relies on facial recognition to automatically tag individuals in photos. Snapchat and Google have faced similar lawsuits. Facebook began informing people more explicitly about its facial recognition data collection practices earlier this year, but Licata's case is ongoing, and a trial is set for July.
The proposed amendment to the Illinois law would create several wide-reaching exceptions to its rules. If passed, the law would no longer apply to companies that collect biometric data used exclusively for "employment, human resources, fraud prevention, or security purposes." The bill would also exempt companies that don't directly sell, lease, trade, or similarly profit from selling biometric information. Most importantly, the amendment would allow companies to bypass the law as long as they store and transmit biometric data in the same way that they store and transmit other sensitive information.
"It is a work of art in how to remove consumer privacy protections in a bill that has been on the books for 10 years. It’s really unattractive,” says Pam Dixon, the founder and executive director of World Privacy Forum, a nonprofit research group that opposes the amendment. The Electronic Frontier Foundation said the bill would "strip residents of critical protection of their biometric privacy, including their right to decide whether or not a business may harvest and monetize data about their faces and fingerprints."
Two sponsors of the legislation in the Illinois Senate—Napoleon Harris, and Chris Nybo each received contributions of $2,000 to $2,500 from Facebook late last year, according to Illinois Sunshine, a tool for browsing political contributions in the state. The amendment is also supported by the Illinois Chamber of Commerce's Tech Council, of which Facebook is a member.
Bill Cunningham, one of the state senators behind the bill, says Facebook played no role in conceiving the legislation. “I have not talked to anyone at Facebook about this,” he says, adding that he has spoken to Google. “I completely agree with the advocates that protecting biometric material is of utmost importance, but I believe there is a way to walk and chew gum here.”
This isn't the first time lawmakers in Illinois have tried to gut the biometric-privacy law. In 2016, Facebook supported a similar amendment, according to The Verge. The amendment was withdrawn after outcry from privacy groups.
Illinois is not the only state where Facebook has opposed biometric privacy laws. Trade organizations it is a part of lobbied against similar legislation last year in Montana and Washington, according to a report from the Center for Public Integrity. Facebook also hired its own lobbyist in Washington state, according to the report. “Every single meaningful privacy law at this point when it is introduced at the state level it receives such profound—especially industry association—opposition that is very challenging to get anything passed,” says Dixon.
In California, a group of citizens has proposed a ballot initiative designed to boost consumer privacy rights. The California Consumer Privacy Act would give Californians the right to find what personal information a business is collecting about them, the right to know where and to whom that data is being sold or disclosed, and the right to opt out of that collection without affecting the services they receive from a business. It also imposes stricter fines on companies that fail to implement reasonable security practices.
“When I really started digging in about how much information corporations were collecting it was just astounding to me. They’re still so powerful, they’ve been able to starve off any sort of regulation,” says Mary Ross, a former CIA counterintelligence officer and president of the group paying for the ballot initiative.
The proposed initiative has not yet gained enough signatures to be placed on the California ballot in November, but that hasn't stopped tech companies from creating a political action committee opposing the measure. According to public records, Facebook, Google, Verizon, AT&T and Comcast have each donated $200,000 to a group designed to fight the initiative. Aside from Facebook, the companies did not immediately respond to requests for comment.
“If you have tech companies putting a million dollars already to an initiative that’s not even on the ballot, what is going to happen when it does or if it does get on the ballot?” asked Dixon.
On Wednesday, Facebook announced it would stop contributing to the group opposing the measure. The move came after sustained public pressure, and after Zuckerberg spent two days on Capitol Hill answering questions from lawmakers about his company's privacy practices. "We took this step in order to focus our efforts on supporting reasonable privacy measures in California," a Facebook spokesperson said in a statement.
But that doesn’t mean Facebook supports the proposed ballot measure. “Facebook did not drop its opposition to the initiative, they're still opposed to it,” says Steven Maviglio, a representative for the Committee to Protect California Jobs, the group opposing the measure. He says Facebook has not asked for its money back. "It's not being returned, they haven't asked for it to be returned."
Still, the decision to pull out in California might signal a new stance from Facebook. In recent weeks, Zuckerberg and Facebook COO Sheryl Sandberg have both indicated that they are more open to regulation than in the past.
One test will be Facebook’s response to potential federal legislation. The US, for now, has no national privacy law. But earlier this week, two Democratic senators introduced a measure that would require opt-in consent from users to share, sell, or use personal information.
One of the authors, Senator Ed Markey, D-Massachusetts, asked Zuckerberg during Tuesday’s hearing whether Facebook would support the legislation. "As a principle, yes, I would," Zuckerberg answered.
- There were two distinct kinds of questions from lawmakers for Mark Zuckerberg during his second hearing on Capitol Hill
- If Congress doesn't understand Facebook, what hope do users have?
- Here are all 43 things Zuckerberg says he'll follow up with lawmakers on
