HB 418: Social Media User Data Swapping

It’s hard to believe, but just under a decade ago Facebook was the subject of one of the worst data privacy scandals in history. That scandal, referred to as the “Cambridge Analytica Scandal,” was the result of lax data sharing policies between Facebook and third-party organizations like Cambridge Analytica around 2016. Once shared, the third-party was left to their own devices to keep that data safe and use it appropriately. Yet months before the 2016 election, the data accessed by a Cambridge Analytica researcher was used to determine people’s political leanings and advise the Trump campaign. The resulting fine Facebook paid to the FTC under a settlement was also the largest in history: $5 Billion. 

This is particularly relevant in the context of HB 418, Data Sharing Amendments. In a move to allow social media users to transfer their profiles from one platform to another more easily, the bill would require social media companies to create an interoperability framework that would allow the seamless exchange of user’s personal information to third-parties. 

In theory, it makes sense. But in practice, this is a major concern for user privacy. Unlike the laws and regulations governing data privacy in the wake of the Cambridge Analytica Scandal, HB 418 simply requires third parties to follow their own privacy policies – effectively creating a loophole to undermine even Utah’s own data privacy law passed in 2022, the Utah Consumer Privacy Act.

Proponents of this bill may believe the bill is narrowly tailored to only apply to third-party companies who already have stringent privacy policies in place. However, this bill all but incentivizes upstart companies to dupe users into opting into a transfer of their personal information from a secure social media platform to a predatory one. 

What’s more, this bill is a carbon copy of federal legislation for a reason: legislation that would fundamentally alter the way globally operating companies work should only be considered by Congress, who has the authority to regulate interstate commerce. In effect, Congress has already considered the idea multiple times.

S. 2521, introduced by Sen. Mark Warner (D) in 2023, had a handful of bipartisan co-sponsors including Sen. Amy Klobuchar (D), Sen. Richard Blumenthal (D), Sen. Josh Hawley (R), and Sen. Lindsey Graham (R). H.R. 3849, introduced by Rep. Mary Gay Scanlon (D) in 2021, also had a handful of bipartisan co-sponsors including Rep. Hakeem Jeffries (D), Rep. Jamie Raskin (D), Rep. Burgess Owens (R), and Rep. Paul Cosar (R). Each time the bills failed to move forward because the idea wasn’t ready for primetime. 

There is already a patchwork of state data privacy laws in the states across the country that have managed to find some semblance of synchronicity. Yet if HB 418 were passed, we’d have two separate platform experiences for users — one which values data privacy, and another that forfeits Utahns’ data to any company for the sake of complying with a state law.