The Washington PostDemocracy Dies in Darkness

Apple preaches privacy. Lawmakers want the talk to turn to action.

As states introduce privacy legislation, the tech giant is either absent from those efforts or backs industry groups that actively lobby against them.

Apple displayed its privacy message at the tech conference CES 2019 in January. (David Becker/Getty Images)
Placeholder while article actions load

When Apple CEO Tim Cook privately hosted six Democratic lawmakers at the company’s space-age headquarters this spring, he opened the conversation with a plea — for Congress to finally draft privacy legislation after years of federal inaction.

“It was the first issue he brought up,” said Rep. Suzan DelBene (Wash.), one of the lawmakers who made the trip to Cupertino, Calif. The Apple chief “really talked about the need for privacy across the board,” said DelBene, a former Microsoft executive.

But when DelBene discussed her own privacy bill, which would require companies to obtain consent before using consumers’ most sensitive information in unexpected ways, Cook didn’t specifically endorse it, she said.

A number of privacy advocates and U.S. lawmakers — who did not attend the meeting — say Apple has not put enough muscle behind any federal effort to tighten privacy laws. And state lawmakers, who are closest to passing rules to limit data sharing, say Apple is an ally in name only — and in fact has contributed to lobbying efforts that might undermine some new data-protection legislation.

While Apple supports the notion of a federal privacy law, the company has yet to formally back any bills proposed on the Hill — unlike Microsoft. “I would argue there’s a need for Apple to be a more vocal part of this debate,” said Sen. Mark R. Warner (D-Va.), a fierce critic of tech companies for their privacy violations.

And in California, Washington and Illinois, home to the most significant state privacy bills, the iPhone giant has sought to battle back or soften local legislators’ proposed bills, often through its trade associations. That has frustrated lawmakers such as California Assemblyman Marc Levine (D), who has introduced two privacy bills in his state’s legislature this year. He and others argue that states represent the best hope for privacy legislation, given the lack of federal progress.

“While the headlines from Tim Cook have him being really forward on advancing the idea that policy can help control how data is used and mismanaged and abused, that hasn’t played out in policymaking,” he said. “I would welcome a stronger presence by Apple and I would also welcome their advocacy on what best practices should be.”

Apple indirectly opposed the legislation via trade groups it funded. On the other hand, Levine noted that Apple had approached him directly to discuss California’s plastic bag ban: “They lobby in all these other areas. They’re just not face forward on privacy.”

”We believe privacy is a fundamental human right and is at the core of what it means to be an American. To that end, we advocate for strong federal legislation that protects everyone regardless of which state they may live,” said Apple spokesman Fred Sainz. “We understand the frustration at the state level — we are frustrated too — but this topic is so important we need to be united across America.”

Read Apple’s full statement on privacy lobbying

The states’ privacy protections could influence federal lawmakers as they try to craft a national standard, experts say. Politicians and aides said they hoped Apple would counterbalance the more active Google and Facebook — businesses highly reliant on data sharing.

Still, by focusing any support purely behind a potential federal law, Apple’s position for now allows it to function in an economy in which there is very little privacy regulation.

Apple and other tech giants are scheduled to testify Tuesday on Capitol Hill in front of a House Judiciary subcommittee focused on antitrust issues, the latest blockbuster hearing to highlight one of Washington’s most pressing questions: how to regulate large technology companies that have come to sway markets, influence elections and impact the social fabric of society.

On the issue of privacy, Apple itself has helped create sky-high expectations with its public pronouncements. For months, it has been running advertisements touting its privacy bona fides, including one plastered to the side of a hotel during a major tech conference that promised, “What happens on your iPhone, stays on your iPhone.”

Last year, Cook sharply attacked Facebook for its practice of collecting personal information on users, in the wake of the Cambridge Analytica scandal. Months later, he made a rare appearance before the European Parliament, calling for a U.S. version of Europe’s tough data-protection rules, known by the acronym GDPR.

In a recent commencement speech at Stanford University, Cook painted a frightening picture of a world in which the collection of consumer data continues unabated. “Even if you have done nothing wrong other than think differently, you begin to censor yourself. Not entirely at first. Just a little, bit by bit. To risk less, to hope less, to imagine less, to dare less, to create less, to try less, to talk less, to think less. The chilling effect of digital surveillance is profound, and it touches everything,” he said.

Despite Apple’s public stance on privacy, a Washington Post investigation earlier this year found Apple allows iPhone apps to include tracking software that surreptitiously sends the personal data of Apple customers to outside companies. Apple said it requires its app developers to have a clear privacy policy. Apple announced in June that it will prohibit that form of tracking in apps for children later this year.

“If you are going to use the value of privacy in your marketing, I think you have an obligation to your consumers to tell us what that means,” said India McKinney, a legislative analyst for the Electronic Frontier Foundation, a civil liberties organization that advocates for Internet privacy and security.

McKinney noted that Apple hasn’t signed on to privacy legislation that other companies, such as search engine DuckDuckGo, have supported, including an amendment to the new California law that prevents consumer data collection by default and gives citizens the right to sue tech companies for violations. If Apple were to throw its weight behind strong privacy protections even at the state level, it would help counter pressure from other large tech companies to water down the legislation, she said. “That would make headlines. That would be really useful,” she said.

In many cases, though, Apple finds itself aligned with the companies it criticizes in seeking to ward off state legislative proposals, often through lobbying organizations in which they share membership, such as TechNet and CompTIA.

While Apple sat on the sidelines, other tech companies such as Amazon, Google and Facebook have been actively opposing laws in states including California, Illinois and Washington that would protect consumers, and pushing for amendments that would roll back some of the provisions in the California Consumer Privacy Act, the landmark state law, according to lawmakers in those states. Silicon Valley companies such as Facebook opted not to stand in the way of that law passing, according to people involved in getting the legislation passed, only after calculating that the alternative — putting privacy legislation in front of voters as a ballot measure — was less attractive.

Facebook, Google and Amazon declined to comment for this report. (Amazon founder and CEO Jeff Bezos owns The Washington Post.)

'There's going to be a fight here to weaken it': Inside the lobbying war over California's landmark privacy law

Apple’s business model stands in stark contrast to its rivals such as Google and Facebook because its bottom line doesn’t depend on collecting user data for the purpose of advertising.

In recent weeks, Cook and other Apple executives have been making the rounds in Washington to meet with members of Congress and the Federal Trade Commission, touting the company’s privacy practices in what many see as an attempt to draw contrast with tech giants such as Facebook, according to people who have attended the meetings. The FTC is expected to play a stepped-up role policing the privacy practices of tech giants if lawmakers pass legislation. On antitrust issues, meanwhile, the Justice Department plans to scrutinize Apple for its business practices, The Post previously reported.

Cook took his privacy pitch directly to lawmakers in May, on the heels of Apple’s unveiling of its new D.C. flagship store, meeting with House Speaker Nancy Pelosi (D-Calif.) and Sen. Roger Wicker (R-Miss.), who leads his chamber’s top tech-focused committee. The company has discussed its views on privacy in more than 100 meetings with lawmakers around the country, Apple spokesman Sainz said.

But Apple hasn’t given its explicit stamp of approval to any federal bills that have been introduced, which would set a national privacy standard — something tech companies, including Apple, say they would prefer over a patchwork of state laws. A collection of Democrats and Republicans in the House and Senate have said they plan to offer a national privacy proposal in the coming months.

Warner offered an example of Apple’s absence: a bill that would essentially outlaw “dark patterns” that trick users into surrendering their personal information when they sign up for a service. The senator said the bill he introduced in April had garnered early support from Microsoft and Mozilla, a nonprofit organization known for its privacy-focused Firefox Internet browser. Not Apple.

“We would be the first to say we can do more and constantly challenge ourselves to do so,” Sainz said in the statement. “We have offered to help write the legislation and reiterate this offer.”

Big Tech went big on a lobbying spending — and privacy advocates are concerned

DelBene, who also visited other tech companies during the Democratic lawmakers’ tour of Silicon Valley, said she “didn’t think of it as a negative” that Cook didn’t publicly endorse her legislation because most companies have backed concepts rather than specific bills so far in the privacy debate.

Apple’s history with lawmakers is complicated. Steve Jobs, Apple’s late co-founder, openly disdained lobbying. Under Cook, though, Apple has stepped up its presence in the nation’s capital, particularly around privacy and government surveillance. It engaged in a legal battle with the FBI in 2015 when law enforcement officials sought to force it to crack a password-protected iPhone at the heart of a terrorist attack in San Bernardino, Calif.

Cook has embraced his powerful role as Apple’s chief political spokesman. In private meetings spanning from President Trump’s golf course in Bedminster, N.J., to the Oval Office, the Apple chief executive has persuaded the president to spare his company’s iPhones, iPads and other products from the stiff tariffs that have affected other goods coming from China. Apple also lobbies for issues that would further its interests, such as lowering corporate taxes and reforming the U.S. patent system.

Politically, though, Apple lags far behind competitors. Alphabet, Google’s parent company, spent $22 million on federal lobbying efforts in 2018, and Facebook spent $13 million, compared with Apple’s $7 million. And unlike its competitors, Apple doesn’t donate directly to political candidates.

On privacy legislation, most of the action is taking place outside Washington. Over the past year, policymakers have considered at least 24 bills targeting data privacy, according to a tally by the National Conference of State Legislatures. Many raced to act in the months after California adopted toughest-in-America rules last year that provide Web users with more information about what happens to their data — and more ability to prevent it from being sold.

The tech industry is suddenly pushing for privacy legislation. Watch out.

Alastair Mactaggart, a real estate developer who championed California’s privacy bill, for months couldn’t snag sufficient support from tech companies, including Apple. One sticking point was a provision in his original proposal that gave Californians the right to sue companies caught violating their privacy.

After several trips to Cupertino to meet with Jane Horvath, a former Google lawyer who now heads Apple’s privacy efforts, Apple offered an olive branch: Mactaggart could tell lawmakers that if the bill narrowed citizens’ right to sue to cases in which consumer data was leaked because of a company’s negligence, Apple would “dislike the bill less,” he said. “It allowed me to go to legislators and say the biggest company in the world is willing to live with this.”

Mactaggart said Apple’s stance was instrumental in getting the bill passed, but Apple was far from a privacy champion: “I don’t think Apple was super thrilled about it. They weren’t going rah-rah-rah.”

Apple supports the idea of a single federal law that would override state laws. That stance is unpopular with privacy advocates. “Any company that says they are for strong privacy protections should not try to use federal legislation to wipe out the ability of states to put in place higher privacy standards,” said Neema Singh Guliani, senior legislative counsel for the American Civil Liberties Union. Another unpopular stance Apple has taken is its opposition to a citizen’s right to sue for privacy violations. Companies “should also be in favor of strong enforcement,” Guliani said, which includes the ability to sue.

For tech giants, the stakes in the states are high. “The states will influence privacy legislation,” said University of California at Berkeley law professor Paul Schwartz, who has studied the interplay between state and federal privacy legislation.

Democrats vow Congress will 'assert itself' against tech - starting with Silicon Valley's privacy practices

California state Sen. Hannah-Beth Jackson (D) described a lack of support from Apple after she introduced legislation in February that would have expanded the ability of Californians to sue tech companies for violations of their privacy rights. Instead of directly weighing in on the legislation, Apple deferred to the industry associations it belongs to with Facebook, Amazon and Google, she said, which have been effective in stalling privacy legislation in California. TechNet, like many other business groups, actively opposed the measure. “It was all the different tech associations comprised of all the different companies. Nobody had to take responsibility,” Jackson said.

In a statement, TechNet said its agenda is a “collaborative effort” from its 80 corporate members. “At both the federal level and in 24 states this year, TechNet has promoted consumer privacy legislation that strikes the appropriate balance of these priorities,” said spokeswoman Natalie McLaughlin.

“America needs to continue its leadership to protect consumers while not discouraging companies from delivering new and innovative products and services,” said Alexi Madon, CompTIA’s vice president for state government affairs.

In Washington state, meanwhile, Rep. Zack Hudgins (D) said he also lacked Apple’s help earlier this year in battling large tech companies over provisions in a privacy bill that ultimately failed in part because of industry opposition. “Apple could be doing a lot more than they did in Washington state,” he said. “They could have put forth stronger legislation, and they could have advocated for some of the legislation that was stronger on artificial intelligence.”

Hudgins, after speaking directly with Microsoft President Brad Smith and representatives from PayPal, Twitter, Google, IBM and Facebook, said that he asked an Apple lobbyist to put him in touch with Apple’s Cook. Apple did not make anyone from the company available, he said.

Apple did step in when Illinois lawmakers proposed legislation that would have criminalized the unauthorized collection of audio by devices such as Amazon’s Echo and Apple’s HomePod — but only to ensure the wording of the law would not open Apple up to lawsuits, according to Abe Scarr, state director for the Illinois Public Interest Research Group. He said Apple wanted to make sure the language was sufficiently “tight,” so that Apple wasn’t liable for apps in the iOS ecosystem that might violate the law. The bill, in its final form, was significantly weakened.

Apple was “opposed and remained opposed after we made lots of concessions,” he said. When it came to that particular privacy bill, Apple wasn’t an advocate for consumer privacy protections, he said. “They were an obstacle.”