Apple preaches privacy. Lawmakers want the talk to turn to action
By REED ALBERGOTTI AND TONY ROMM | The Washington Post | Published: July 15, 2019
When Apple CEO Tim Cook privately hosted six Democratic lawmakers at the company's space-age headquarters this spring, he opened the conversation with a plea - for Congress to finally draft privacy legislation after years of federal inaction.
"It was the first issue he brought up," said Washington Rep. Suzan DelBene, one of the lawmakers who made the trip to Cupertino, California. The Apple chief "really talked about the need for privacy across the board," said DelBene, a former Microsoft executive.
But when DelBene discussed her own privacy bill, which would require companies to obtain consent before using consumers' most sensitive information in unexpected ways, Cook didn't specifically endorse it, she said.
A number of privacy advocates and U.S. lawmakers - who did not attend the meeting - say Apple has not put enough muscle behind any federal effort to tighten privacy laws. And state lawmakers, who are closest to passing rules to limit data sharing, say Apple is an ally in name only - and in fact has contributed to lobbying efforts that might undermine some new data-protection legislation.
While Apple formally supports the notion of a federal privacy law, the company has yet to formally back any bills proposed on the Hill - unlike Microsoft. "I would argue there's a need for Apple to be a more vocal part of this debate," said Virginia Sen. Mark Warner, a fierce critic of tech companies for their privacy violations.
And in California, Washington and Illinois, home to the most significant state privacy bills, the iPhone giant has sought to battle back or soften local legislators' proposed bills, often through its trade associations. That has frustrated lawmakers such as California assemblyman Marc Levine, who has introduced two privacy bills in the Golden State's legislature this year. He and others argue that states represent the best hope for privacy legislation given the lack of federal progress.
"While the headlines from Tim Cook have him being really forward on advancing the idea that policy can help control how data is used and mismanaged and abused, that hasn't played out in policy making," he said. "I would welcome a stronger presence by Apple and I would also welcome their advocacy on what best practices should be."
Apple indirectly opposed the legislation, via trade groups it funded. On the other hand, Levine noted that Apple had approached him directly to discuss California's plastic bag ban. "They lobby in all these other areas. They're just not face forward on privacy."
"We believe privacy is a fundamental human right and is at the core of what it means to be an American. To that end, we advocate for strong federal legislation that protects everyone regardless of which state they may live," said Apple spokesman Fred Sainz. "We understand the frustration at the state level - we are frustrated too - but this topic is so important we need to be united across America."
The states' privacy protections could influence federal lawmakers as they try to craft a national standard, experts say. Politicians and aides said they hoped Apple would counterbalance the more active Google and Facebook, whose businesses are highly reliant on data-sharing.
Still, by focusing any support purely behind a potential federal law, Apple's position for now allows it to function in an economy in which there is very little regulation of privacy.
Apple and other tech giants are scheduled to testify on Capitol Hill Tuesday in front of a House Judiciary subcommittee focused on antitrust issues, the latest blockbuster hearing to highlight one of Washington's most pressing questions: How to regulate large technology companies that have come to sway markets, influence elections and impact the social fabric of society.
On the issue of privacy, Apple itself has helped create the sky-high expectations with its public pronouncements. For months, it has been running advertisements touting its privacy bona fides, including one plastered to the side of a hotel during a major tech conference that promised, "What happens on your iPhone, stays on your iPhone."
Last year, Apple chief executive Cook sharply attacked Facebook for its practice of collecting personal information on users in the wake of the Cambridge Analytica scandal. Months later, he made a rare appearance before the European Parliament, calling for a U.S. version of Europe's tough data-protection rules, known by the acronym GDPR.
In a recent commencement speech at Stanford University, Cook painted a frightening picture of a world in which the collection of consumer data continues unabated. "Even if you have done nothing wrong other than think differently, you begin to censor yourself. Not entirely at first. Just a little, bit by bit. To risk less, to hope less, to imagine less, to dare less, to create less, to try less, to talk less, to think less. The chilling effect of digital surveillance is profound, and it touches everything," he said.
"If you are going to use the value of privacy in your marketing, I think you have an obligation to your consumers to tell us what that means," said India McKinney, a legislative analyst for the Electronic Frontier Foundation, a civil liberties organization that advocates for internet privacy and security.
McKinney noted that Apple hasn't signed on to privacy legislation that other companies, such as web browser DuckDuckGo, have supported, such as an amendment to the new California law that prevents consumer data collection by default and gives citizens the right to sue tech companies for violations. If Apple were to throw its weight behind strong privacy protections even at the state level, it would help counter pressure from other large tech companies to water down the legislation, she said. "That would make headlines. That would be really useful," she said.
In many cases, though, Apple finds itself aligned with the companies it criticizes in seeking to ward off state legislative proposals, often through lobbying organizations in which they share membership, such as TechNet and CompTIA.
While Apple sat on the sidelines, other tech companies, such as Amazon, Google and Facebook, have been actively opposing laws in states including California, Illinois and Washington that would protect consumers and pushing for amendments that would roll back some of the provisions in the California Consumer Protection Act, the landmark state law, according to lawmakers in those states. Silicon Valley companies such as Facebook opted not to stand in the way of that law passing, according to people involved in getting the legislation passed, only after calculating that the alternative - putting privacy legislation in front of voters as a ballot measure - was less attractive.
Facebook, Google and Amazon declined to comment. (Amazon CEO Jeff Bezos owns The Washington Post.)
Apple's business model stands in stark contrast to its rivals such as Google and Facebook because its bottom line doesn't depend on collecting user data for the purpose of advertising.
In recent weeks, Cook and other Apple executives have been making the rounds in Washington to meet with members of Congress and the Federal Trade Commission, touting the company's privacy practices in what many see as an attempt to draw contrast with tech giants such as Facebook, according to people who have attended the meetings. The FTC is expected to play a stepped-up role policing the privacy practices of tech giants if lawmakers pass legislation. On antitrust issues, meanwhile, the Department of Justice newly plans to scrutinize Apple for its business practices, the Post previously reported.
Cook took his privacy pitch directly to lawmakers in May, on the heels of Apple's unveiling of its new D.C. flagship store, meeting with House Speaker Nancy Pelosi and Republican Sen. Roger Wicker, who leads his chamber's top tech-focused committee. Apple spokesman Sainz said the company has discussed its views on privacy in more than 100 meetings with lawmakers around the country.
But Apple hasn't given its explicit stamp of approval to any federal bills that have been introduced, which would set a national privacy standard - something tech companies, including Apple, say they would prefer over a patchwork of state laws. A collection of Democrats and Republicans in the House and Senate have said they plan to offer a national privacy proposal in the coming months.
Warner offered an example of Apple's absence: A bill that would essentially outlaw so-called "dark patterns" that trick users into surrendering their personal information when they sign up for a service. The senator said the bill he introduced in April had garnered early support from Microsoft and Mozilla, a non-profit known for its privacy-focused Firefox internet browser. Not Apple.
"We would be the first to say we can do more and constantly challenge ourselves to do so," Sainz said in the statement. "We have offered to help write the legislation and reiterate this offer."
DelBene, who also visited other tech companies during the Democratic lawmakers' tour of Silicon Valley, said she "didn't think of it as a negative" that Cook didn't publicly endorse her legislation because most companies have backed concepts rather than specific bills so far in the privacy debate.
Apple's history with lawmakers is complicated. Steve Jobs, Apple's late co-founder, openly disdained lobbying. Under Cook, though, Apple has stepped up its presence in D.C., particularly around privacy and government surveillance. It engaged in a legal battle with the FBI in 2015 when law-enforcement officials sought to force it to crack a password-protected iPhone at the heart of the deadly shooting in San Bernardino, California.
Cook has embraced his powerful role as Apple's chief political spokesman. In private meetings spanning from Trump's golf course in Bedminster, New Jersey, to the Oval Office, the Apple chief executive has convinced the president to spare his company's iPhones, iPads and other products from the stiff tariffs that have affected other goods coming from China. Apple also lobbies for issues that would further its interests, such as lowering corporate taxes and reforming the U.S. patent system.
Politically, though, Apple lags far behind competitors. Alphabet, Google's parent company, spent $22 million on federal lobbying efforts in 2018, and Facebook spent $13 million. That's compared to Apple's $7 million. And unlike its competitors, Apple doesn't donate directly to political candidates.
On privacy legislation, most of the action is taking place outside of Washington. Over the past year, policymakers have considered at least 24 bills targeting data privacy, according to a tally by the National Conference of State Legislatures. Many raced to act in the months after California adopted toughest-in-America rules last year that provide web users with more information about what happens to their data - and more ability to prevent it from being sold.
Alastair Mactaggart, a real estate developer who championed California's privacy bill, for months couldn't snag sufficient support from tech companies, including Apple. One sticking point was a provision in his original proposal that gave Californians the right to sue companies caught violating their privacy.
After several trips to Cupertino to meet with Jane Horvath, a former Google lawyer who now heads Apple's privacy efforts, Apple offered an olive branch: Mactaggart could tell lawmakers that if the bill narrowed citizens' right to sue to cases in which consumer data was leaked due to a company's negligence, Apple would "dislike the bill less," he said. "It allowed me to go to legislators and say the biggest company in the world is willing to live with this."
Mactaggart said Apple's stance was instrumental in getting the bill passed, but Apple was far from a privacy champion. "I don't think Apple was super thrilled about it. They weren't going rah-rah-rah."
Apple's stance opposing a citizen's right to sue companies for privacy violations is a strike against its pro-privacy reputation, said Neema Singh Guliani, senior legislative counsel for the American Civil Liberties Union. She also knocked Apple for supporting the idea of a single federal law that would override state laws. "Any company that says they are for strong privacy protections should not try to use federal legislation to wipe out the ability of states to put in place higher privacy standards," she said. "They should also be in favor of strong enforcement," which includes the ability to sue, she said.
For tech giants, the stakes in the states are high. "The states will influence privacy legislation," said University of California, Berkeley law professor Paul Schwartz, who has studied the interplay between state and federal privacy legislation.
California State Sen. Hannah-Beth Jackson described a lack of support from Apple after she introduced legislation in February that would have expanded the ability of Californians to sue tech companies for violations of their privacy rights. Instead of directly weighing in on the legislation, Apple deferred to the industry associations it belongs to with Facebook, Amazon and Google, she said, which have been effective in stalling privacy legislation in California. TechNet, like many other business groups, actively opposed the measure. "It was all the different tech associations comprised of all the different companies. Nobody had to take responsibility," Jackson said.
In a statement, TechNet said its agenda is a "collaborative effort" from its 80 corporate members. "At both the federal level and in 24 states this year, TechNet has promoted consumer privacy legislation that strikes the appropriate balance of these priorities," said spokeswoman Natalie McLaughlin. "America needs to continue its leadership to protect consumers while not discouraging companies from delivering new and innovative products and services," said Alexi Madon, CompTIA's vice president for state government affairs.
In the state of Washington, meanwhile, Rep. Zack Hudgins said he also lacked Apple's help earlier this year in battling large tech companies over provisions in a privacy bill that ultimately failed in part because of industry opposition. "Apple could be doing a lot more than they did in Washington state," he said. "They could have put forth stronger legislation and they could have advocated for some of the legislation that was stronger on artificial intelligence."
Hudgins, after speaking directly with Microsoft president Brad Smith and meeting directly with representatives from PayPal, Twitter, Google, IBM and Facebook, said he asked an Apple lobbyist to put him in touch with Apple's Cook. Apple did not make anyone from the company available, he said.
Apple did step in when Illinois lawmakers proposed legislation that would have criminalized the unauthorized collection of audio by devices such as Amazon's Echo and Apple's HomePod - but only to ensure the wording of the law would not open Apple up to lawsuits, according to Abe Scarr, state director for the Illinois Public Interest Research Group. He said Apple wanted to make sure the language was sufficiently "tight," so that Apple wasn't liable for apps in the iOS ecosystem that might violate the law. The bill, in its final form, was significantly weakened.
Apple was "opposed and remained opposed after we made lots of concessions," he said. When it came to that particular privacy bill, Apple wasn't an advocate for consumer privacy protections, he said. "They were an obstacle."