Americans Want Much More Online Privacy Protection Than They’re Getting

The disconnect appears even more gaping when you delve into Americans’ attitudes about the strongest data privacy provisions, which almost none of those 19 state legislatures have approved.

For example, CR’s survey found that 75 percent of Americans would support a law that limits companies to using only the data they need to provide their service—including 72 percent of Republicans and those who lean Republican and 79 percent of Democrats and those who lean Democratic. This finding appears to demonstrate overwhelming bipartisan support for the idea of “data minimization,” which many privacy advocates consider the gold standard of consumer privacy protection. Yet only one state, Maryland, has passed a privacy law that imposes a data minimization requirement. 

Industry coalitions say this kind of data minimization would stifle innovation by, for example, preventing companies from offering goods, services, and features that consumers would want but haven’t explicitly requested. They also say that any line drawn between what data companies do and do not legitimately need would inevitably be vague and unenforceable.

CR’s survey showed similar widespread support for privacy laws that would explicitly grant consumers a “private right of action,” meaning the ability to sue companies that violate data privacy laws. Consumer advocates say that is necessary because most state attorney general offices lack the resources and expertise to adequately enforce laws and regulations across the vast scope of data practices in their states. And when CR asked, 75 percent of Americans said both states and individuals should be able to sue companies that violate data privacy laws, and another 9 percent said that only individuals (and not states) should be able to sue. 

Despite this near consensus, no state has passed a comprehensive privacy law that includes a private right-of-action provision. (California does allow individuals to sue, but only in the event of a data breach.) 

CR privacy advocates emphasize those findings not only because they believe data minimization and a private right of action would do a lot to protect consumer data. They’re also trying to ensure that several recent state data privacy laws that lack these and other strong consumer protections won’t become models for other states’ laws and, eventually, a federal data privacy law.

“It’s not surprising that consumers want stronger protections than state legislatures have provided to date. I think it’s common sense that companies should limit what data they collect to what they actually need to provide their service and that individuals should be able to hold companies accountable when they break the law,” says Matt Schwartz, a privacy policy analyst at CR. “We hope these findings underscore that it is not the will of the people that their representatives pass watered-down privacy laws.”

Another striking finding of CR’s recent survey is where Americans rank data privacy among their consumer interests. When we asked about interest in consumer protection topics, more of them put “laws that would prevent companies from sharing personal data” among their top three than any other topic, including protecting food from bacterial contamination, ensuring the safe use of artificial intelligence, and keeping plastics out of the environment and food supply. 

Previous surveys have also established the relative importance of privacy to consumers. A recent survey of 45,231 U.S. adults ages 25 and older by Publishers Clearing House and several academic researchers in December 2023, for example, found that 86 percent of Americans are concerned about the privacy and security of personal information and data—more than were concerned about the current state of the economy or the quality of education in the U.S.