138
Virginia Policy Review
Protecting Voter Information After Cambridge Analytica: A Review of the Voter Privacy Act By Dana Holmstrand Introduction Cambridge Analytica became shorthand for political exploitation of user data in 2018. When the New York Times first broke the story of a nefarious foreign data company exploiting Americans’ information, it sounded like the work of an evil mastermind intent on disrupting American elections. However, as more information about Cambridge Analytica has come to light, it sounds more like a series of snake oil salesmen got lucky. Using just five factors present in all personalities, a company promised it would serve the exact right advertisement to Americans they had not even surveyed in order to manipulate them into voting for your candidate. While neither political targeting nor advertising is particularly new, what likely made this action feel so slimy or egregious to the average American was its perceived underhanded use of social media. Cambridge Analytica contracted a Russian-American researcher to access not just the data of the people who consented to be surveyed but the online friends of those users. This was not the work of great hackers: Facebook’s terms and conditions at the time explicitly allowed users to consent to giving up their friends’ data to third parties. In response to public outrage and in preparation for the 2020 Presidential election, Senator Diane Feinstein (D-California) introduced the Voter Privacy Act of 2019.53 Designed to protect voters from psychological manipulation online,54 the bill takes aim at a broad range of “covered entities” by restricting their ability to target specific individuals and providing individuals with more ownership over their data and how it is used by campaigns. Or so the bill and its supporters claim. The bill didn’t stop the collection of data unless explicitly prohibited by an individual principle in conjunction with its toothless notice requirements— similar to other so-called privacy regimes in the United States—do little actually protect the data of consumers. Additionally, the bill’s narrow definitions of covered entities and targeting services represent a lackluster attempt to tackle the larger problem of data collection and use under the guise of voter protection. If Congress wants to avoid another data debacle during the 2020 presidential election, a regulation or law must be passed to require disclosure of data collection and use practices coupled with a broader
53
Voter Privacy Act, S.2398, 116th Cong. (2019). Press Release, Sen. Dianne Feinstein, Feinstein Bill Would Give Voters Control Over Personal Data (Jul. 31, 2019), https://www.feinstein.senate.gov/public/index.cfm/press-releases?ContentRecord_id=B4FBA307B050-4623-8EAF-841DCDCAFDA4. 54
