As Congress Stalls, States Are Countering Digital Deception

The federal government has done remarkably little to counter digital deception in our democracy. Even now, three years after the 2016 election exposed the extent of digital threats, Congress hasn’t passed any bills that substantively address the issue. The state level, however, is a different story. There, legislators are taking decisive action against digital threats to democracy via transparency laws, privacy protections, and more.

State-level legislation protects statewide elections and provides a preview of how larger-scale legislation might function. On the other hand, it can result in a patchwork of laws that cause companies to complain about the burdens of compliance. Facebook and Google have both stopped running political ads in some states with especially strong online ad disclosure regimes. We therefore urgently need federal legislation to address digital deception — not to preempt strong state laws, but to ensure that those protections extend consistently to all elections in our country.

Here is some of the legislation confronting online political manipulation in the states:

Transparency for Digital Political Ads

Washington State has had one of the strictest political transparency laws in the country since 1972, when it was passed via ballot initiative. In May 2018, the state’s Public Disclosure Commission passed an emergency rule clarifying that the existing law — which requires advertisers to keeps a record of political advertisements sold within the previous three years — applies to digital ad platforms. The record of political ads needs to include copies of advertisements sold, as well as information on who paid for them, when they ran, and how much they cost. The rule passed following an investigation by Seattle newspaper The Stranger, which exposed that tech companies were failing to release advertising records from the 2017 municipal election. Shortly afterward, state attorney general Bob Ferguson sued both Facebook and Google for failing to comply with the law. The companies jointly agreed to pay $455,000 to settle the lawsuits. Both companies also announced policies to stop running political ads in the state, since their online ad archives do not meet the state’s transparency requirements — although Google has been found to still be running some ads.

Signed into law in April 2018, New York’s Democracy Protection Act extends the disclosure requirements already in place for political advertising on television and radio to online ads. Under the law, political ads run online have to include a disclosure stating who paid for the ad. Additionally, the law requires that any person or entity wanting to run an ad that qualifies as an independent expenditure (an ad that advocates for or against the election of a candidate that is not made in coordination with that candidate) would need to register as an independent expenditure committee with the state Board of Elections. The law also prohibits foreign spending in elections and directs the Board of Elections to create an online archive of all political communications.

In May 2018, Maryland enacted the Online Electioneering Transparency and Accountability Act. The law requires digital companies with more than 100,000 monthly visitors to keep a database of all Maryland political ads on their platforms, as well as information about who the ads target. The legislation also prohibits foreign spending on political advertising in state elections. These regulations prompted Google to prohibit ads related to Maryland ballot measures or candidates for state and local elections on its platform. The act has been challenged in court by a coalition of newspapers, who argue that requiring them to comply would violate the First Amendment. In January, a judge granted an injunction against enforcing the law; while this has been appealed, the law’s status remains up in the air.

In late September 2018, California passed the Social Media DISCLOSE Act (which will go into effect on January 1, 2020). The act requires online platforms to keep a database of political ads run on their platforms and to disclose information about the ad, including who paid for it, when the ad ran, total impressions, and the amount spent on the ad. Online platforms are defined in the act as those that sell ads directly to advertisers, not those that display ads sold through another platform.

New Jersey has long required that anyone disseminating campaign communications regulated by state law must retain a record of said communication, including an exact copy of the ad; information about the number of copies made; dates and times it was viewed; and information about who paid for it. As a result, Google does not allow ads related to New Jersey ballot measures or candidates for state and local elections on its platform. Nevada has similar regulations, but only the cost of the advertisement needs to be disclosed, and only if it ran in the 10 days before a primary or general election, or within 30 days after the election.

Online Privacy Protections

In June 2018, California Gov. Jerry Brown signed into law the nation’s most comprehensive data privacy act to date: the California Consumer Privacy Act (CCPA). The CCPA is primarily focused on giving users control over how their data is collected and used online. This can help to prevent digital deception, as political actors deploy this data to target and manipulate voters. The act, which will also go into effect on January 1, 2020, requires companies to detail to users exactly what data is being collected about them and how it is used; gives users the right to delete data that websites have collected about them; and prevents the sale of that data. However, over the past year tech companies have supported a raft of bills meant to weaken the CCPA.

Other states are contemplating similar laws. In May, state senator Kevin Thomas introduced the New York Privacy Act. While it is similar to California’s law in many respects, the New York bill would additionally establish “data fiduciary” responsibilities for social media platforms and allow citizens to sue companies directly over privacy violations. The New York bill would apply to all companies, while California’s only applies to those that make more than $25 million. Massachusetts is also considering a consumer privacy bill, introduced in January.

Vermont recently passed the first law in the United States that would regulate data brokers (companies that track and sell individuals’ information to advertisers). Under the new law, brokers must register with the state and allow individuals to opt out of having their data collected. Companies could face legal action if data they have sold leads to illegal discrimination.