Caitriona Fitzgerald

Maryland Online Data Privacy Act Comes Into Effect <p>Today, October 1, 2025, the Maryland Online Data Privacy Act came into effect. This law marks a significant shift in state privacy law landscape toward laws that meaningfully limit personal data co...

Happy Maryland Online Data Privacy Act effective date! As of today, Marylanders have some of the strongest privacy rights in the country. MODPA requires companies to align their data pratices with what consumers expect, not just collect data for whatever purpose they please. epic.org/maryland-onl...

Life, Liberty, and the pursuit of #privacy. I love my city.

Thank you Commissioner Slaughter for getting right back to work pushing the FTC to do it's job: protecting American consumers from harmful practices lie subscription traps!

Join @carolecadwalla.bsky.social, @carissaveliz.bsky.social and me TODAY at 9am PT / noon ET / 5pm BT for a podcast on Substack entitled “Privacy Is Power”. Link is below.

🚨 JUST IN: On a 99-1 vote this morning, the Senate overwhelmingly passed an amendment to remove the "AI Moratorium," a budget bill provision that would have prevented states from passing regulations on AI systems for 10 years.

In the wee hours of the morning, amendment 2814 by Senators Blackburn, Collins, and Cantwell stripping the AI state law moratorium from the bill passed 99-1!!! A huge thanks to my Senator @markey.senate.gov for his leadership on this too.

That’s my Senator! Thank you @markey.senate.gov for your leadership on this.

EPIC opposes the revised AI moratorium: “The multiple iterations of the AI state law moratorium demonstrate that, at the end of the day, members of Congress recognize that a sweeping ban on state-level AI regulation simply does not work,” said @caitrionafitz.bsky.social, EPIC's Deputy Director.

The Big Beautiful Bill Could Decimate Legal Accountability for Tech and Anything Tech Touches | TechPolicy.Press To understand how the so-called “AI moratorium” will destroy state laws and the internet, consider the literal meaning of its text, writes David Brody.

The House’s 10-year ban on state AI regulation would wreak havoc on our country. The language is so broad that it could upend everything from state privacy law to contract law. It could even break the internet. I will do everything in my power to stop it. www.techpolicy.press/the-big-beau...

Inject the second paragraph of this footnote directly into my veins.

(And then send it to the nine firms that have bent the knee.)

Time for another musical digital security PSA! Here’s “We Are Never Ever Getting Back Together” but it’s about breaking up with Google 💔

The United States of Surveillance Capitalism vs. The Rule of Law Join Shoshana Zuboff (moderator), Alan Butler, Rohit Chopra, Caitriona Fitzgerald, and Jonathan Kantor as they look at the current high-stakes clash between the competing institutional orders of surve...

On 4/24, EPIC Executive Director @alanindc.bsky.social and Deputy Director @caitrionafitz.bsky.social will speak at “The United States of Surveillance Capitalism vs. The Rule of Law” hosted by the Carr-Ryan Center for Human Rights. tinyurl.com/asbfz4s7

Note: This event is only open to HUID holders.

Several strong bills pending in Massachusetts would do just that, and Massachusetts consumers would be much safer online if the Legislature enacted them.

The companies collecting our personal data should be the ones with the obligation to protect privacy, not the consumer. A good privacy law requires companies to limit their collection and use of personal data to what is necessary to provide the service the consumer asks for.

The biggest weakness in these laws is that they do not require companies to take proactive steps to protect privacy and instead put the onus on consumers to correct or delete their data — rights that very few consumers know exist or have time to use.

In a recent report scoring state privacy laws @epic.org and US PIRG, nine of those laws received Fs, and none received an A.

Data privacy laws are only as good as their consumer protections - The Boston Globe The biggest weakness in these laws is that they do not require companies to take proactive steps and instead put the onus on consumers to correct or delete their data — rights that very few consumers ...

Thanks to @bostonglobe.com for printing my letter pointing out that state privacy laws are only as good as their consumer protections.

www.bostonglobe.com/2025/04/20/o...

Well, well, well, the CT AG released a new report on the CT Data Privacy Act and look what it says about data minimization!

Full report: portal.ct.gov/-/media/ag/p...

The State Data Privacy Act <p>In our State Data Privacy Act, we set forth a compromise bill built on existing state laws that meaningfully protects privacy while encouraging innovation.</p>

States have been leading the way on privacy legislation, but as our recent report points out, many of those state laws lack meaingful privacy protections. We urge any state lawmakers to look to the State Data Privacy Act we released with @consumerreports.org

epic.org/state-data-p...

EPIC Urges Federal Privacy Working Group to Center Data Minimization in Federal Privacy Law <p>EPIC’s comments highlighted lessons learned from years of state-level advocacy on privacy laws and stated that a federal privacy law should provide a floor for states to build on top of rather than...

Last week (26 years later in case anyone is counting at home), EPIC submitted comments to the Chair's Privacy Working Group urging Congress to center data minimization in any proposed federal privacy legislation it considers.

epic.org/epic-urges-f...

When I testified before Congress 23 YEARS later, I said:
"The U.S. faces a data privacy crisis. [...] We need comprehensive, baseline privacy protections for every person in the United States and changes to the business models that have led to today’s commercial surveillance systems."

In 1999(!), EPIC told Congress: "[T]he recent developments in the online industry make clear the need for privacy legislation. For those who are willing to look closely, there is little indication that self-regulation is working. Privacy policies read more like warning notices and disclaimers."

Chairmen Guthrie, Bilirakis, and Palmer Launch Investigation into 23andMe and its Handling of Americans’ Sensitive Medical and Genetic Information The Committee on Energy and Commerce is the oldest standing legislative committee in the U.S. House of Representatives and is vested with the broadest jurisdiction of any congressional authorizing com...

The leaders of the House Energy & Commerce Committee wrote to #23andme saying that since there is no federal comprehensive data privacy law, they have "great concern" about the safety of Americans' most sensitive personal info. Not at all frustrating.

energycommerce.house.gov/posts/chairm...

President Trump just fired almost the entire staff of the CFPB, who protect you from getting scammed by Wall Street.

This is another assault on consumers and our democracy by Trump's lawless Administration.

We will fight back with everything we've got.

This is what a digital coup looks like “We are watching the collapse of the international order in real time, and this is just the start,” says investigative journalist Carole Cadwalladr. In a searing talk, she decries the rise of the “bro...

Thank you @carolecadwalla.bsky.social: "Privacy is power. [...] There is a beautiful internet of the future, free from corporate capture and data tracking. We can build it. It is going to take a movement."

I'm fired up for the fight ahead.

www.ted.com/talks/carole...

23andMe bankruptcy highlights need for data protection law - The Boston Globe Consumers should be allowed to control how their private info is used.

Excited to see that Sunday's @bostonglobe.com editorial urges MA to adopt a strong comprehensive privacy law! Let's do this! www.bostonglobe.com/2025/04/13/o...

How a bankruptcy judge can stop a genetic privacy disaster Any new owner of 23AndMe’s data will want to find ways to make money from it. Lawmakers have a big opportunity to help keep it safe

"Of course, this raises a bigger question: Why should anyone be able to buy the genetic data of millions of Americans in a bankruptcy proceeding? The answer is simple: Lawmakers allow them to."

www.technologyreview.com/2025/03/28/1...

EPIC’s @caitrionafitz.bsky.social will testify before a MA Legislature Joint Committee today in support of the Massachusetts Consumer Data Privacy Act and the Massachusetts Data Privacy Act.

Watch EPIC’s testimony this afternoon: malegislature.gov/Events/Heari...

EPIC Alert

Know who sends a great monthly newsletter and will never sell your e-mail address? @epic.org!

Signup for the EPIC Alert here: epic.org/alert/

Logos of endorsing orgs

EPIC & @consumerreports.org are pleased to re-release the State Data Privacy Act with lots of new endorsements!

Now endorsed by:
Accountable Tech | CDT | Common Sense Media | CFA | Issue One | PIRG | Public Knowledge | Young People's Alliance

Learn more: epic.org/state-data-privacy-act