AUDIE CORNISH, HOST:
Privacy groups lost a major battle when Congress and President Trump canceled Internet privacy rules written under the Obama administration. The regulations prevented Internet service providers from selling your web browsing history to third parties, and they were stricter than rules for other kinds of Internet firms. But as NPR's Martin Kaste reports, the fight's not over. It's just moved to the states.
MARTIN KASTE, BYLINE: Drew Hansen is a Democrat in the Washington State House, and Internet privacy policy is not something he usually deals with. But that's changing after this action by Congress.
DREW HANSEN: One of my constituents emailed me and said, I'm outraged that Congress is going to allow Internet service providers to sell my browsing history; can we do anything about that? And I said, well, I don't know. That's a great question. Let me find out.
KASTE: He talked to the lawyers, and they didn't see why he couldn't just introduce legislation for a state version of the privacy rules that Congress had just canceled.
HANSEN: Well, there's no conflict here. I mean the federal entities have just chosen not to act. Federal law in this area is a floor rather than a ceiling. There's nothing to protect states from being more protective of privacy than the federal government has chosen to do.
KASTE: And he's not alone in thinking this way. Legislators around the country are responding to public anger and introducing ISP privacy bills in Minnesota, Illinois, Maryland. The list keeps growing. But is it really true that there's no conflict here with the feds? Blake Reid is an expert on telecom law at the University of Colorado.
BLAKE REID: Anytime states are intruding into an area or - I shouldn't say intruding but treading into an area that the federal government has got a significant role - and telecommunications is one such area - there's always this question of whether Congress has intended to preempt states' role in that.
KASTE: The federal agency with authority over ISPs is the FCC, and it's not saying whether it thinks the states are intruding on its turf. Jim Halpert is a lawyer for a coalition of tech companies which includes ISP. He says it may come down to how well the states write their rules. He says some of them have been overreaching. He calls it the meat-axe approach.
JIM HALPERT: If you categorically say you cannot collect information or disclose information, that's what the internet does. (Laughter) It - having a barrier to that unless a user consents is likely to result in frustrating consumers, and it's also likely to be unconstitutional.
KASTE: Halpert says states can expect to spend some tax dollars defending laws like that in court. Ernesto Falcon is legislative council for the Electronic Frontier Foundation, which is one of the groups that fought to keep the stricter federal privacy rules.
ERNESTO FALCON: I think in the long term this is something that either the federal judiciary or Congress will have to resolve. In the short term, though, because you really do have a clear gap in privacy protections now, the states are going to have to fill the void.
KASTE: But he also agrees that the states that passed their own ISP privacy laws can expect things to get litigious. Martin Kaste, NPR News.
(SOUNDBITE OF THE STROKES SONG, "REPTILIA") Transcript provided by NPR, Copyright NPR.
