The man quietly rewriting American privacy law

Working largely by video call from his office in New England, using grassroots-style tactics honed in a town-by-town campaign across rural Massachusetts, Kingman has exerted profound national influence on tech policy, one state at a time.

“It just doesn’t happen without Andy,” said Carl Szabo, general counsel for the tech industry group NetChoice, which works alongside Kingman on privacy issues. “Andy is the foundation for a lot of the privacy legislation that we’re seeing around the country. He is instrumental, and he is essential.”

With Washington lawmakers largely unable or unwilling to pass new tech regulations, states have become the most powerful force in shaping one of the country’s most dynamic sectors over the past three years. As state lawmakers tackle issues such as online safety and artificial intelligence, Kingman has effectively set national policy for a specific and increasingly central part of that story: how much control citizens have over their online data.

As the State Privacy and Security Coalition’s counsel, Kingman represents companies that want to keep lax rules on how data can be collected and used. Its members include Amazon, Google and Meta, as well as consumer giants like Target and General Motors.

He has never officially been an employee of the coalition, instead serving as an outside counsel through law firms including DLA Piper from 2018 to 2021, and then his own firm, Mariner Strategies, from 2022.

The organization has lobbied in at least 32 states looking to pass data privacy regulations. Kingman worked to block tougher regulations or support business-friendly laws in at least 22 of those, a POLITICO review of public records and interviews with state lawmakers found.

His playbook illustrates an irony of modern American policymaking: As energy shifts to state legislatures — which have often been called “laboratories of democracy” — a sophisticated lobbying operation can create a default national standard by pushing a consistent message, one state at a time.

As a result of Kingman’s work, most states have passed data-privacy laws that are relatively friendly to business compared with the tougher provisions that have been enacted in Europe and California. Though they vary in their specifics, all of the laws influenced by Kingman protect companies from being sued directly by citizens for privacy violations. They also chip away at protections through long battles over definitions, like what it means for a company to “sell” data and what should be considered “sensitive” information.

“The battle over the future of privacy protections for Americans is happening at the state level,” Matt Schwartz, a policy analyst for Consumer Reports who advocates on state privacy regulations, said. “Industry knows this, and that is why they have expended so many resources in trying to pass their favored model.”

For decades, American companies have benefited from lax regulations on data collection, allowing industries to profit from collecting, selling and using minute details about people’s lives, from the TV shows they watch to their purchasing habits to the last place they drove.

As worries have mounted about how much companies know about citizens — and how much data misuse might harm people’s lives — lawmakers around the world have taken action. The European Union adopted its strict regulations in 2016; they went into effect in 2018. California passed a similar data privacy law in 2018 and has continued to build on it with laws creating its own privacy protection agency and rulemaking authority over issues like automated decision-making.

Since California’s pioneering law, state lawmakers across the country have started drafting their own data privacy bills — and the business community quickly realized it would have to respond or risk more states taking California’s tough stand.

The SPSC quickly started pushing back, set on quashing similar regulations elsewhere. Kingman started working with the SPSC in 2018, just months before California passed its data privacy law.

Kingman has largely worked behind the scenes, contacting lawmakers before they even introduce a bill, or warning local business groups about how strict privacy regulations will hurt their members. On a 2020 podcast, Kingman said blocking California’s law from spreading to other states was the “jewel in the crown of the SPSC.”

In Maine, he convinced a lawmaker to retract her proposal to copy California’s legislation and swap it for the industry-preferred law that Connecticut had passed. In Kentucky, he worked to sink a senator’s proposal over provisions giving people the right to sue companies that violate the privacy law.

Lawmakers contacted for this story told largely parallel stories of how Kingman fits into the ecosystem and how he operates. Rather than parachuting into statehouses and trying to claim local status — as outside groups sometimes do, to their detriment — he rallies local business groups to put pressure on legislators, while presenting himself as a problem-solver.

Instead of trying to kill privacy bills outright, he’ll explain upfront that businesses are likely to oppose the law — but he’s there to help craft a compromise that they won’t try to actively block.

“He definitely is very honest about who he’s representing and the issues that they have with legislation,” Sen. Lisa Keim, a Maine Republican who consulted with Kingman on her privacy bill, said.

Connecticut state Sen. James Maroney said he had been working on getting privacy legislation passed for three years before he met Kingman. He said he was skeptical of Kingman because of lobbyists successfully blocking his bill for years, but gradually grew to trust him as they discussed what the SPSC’s members were willing to accept in a privacy bill, and what provisions would face opposition.

“We didn’t reach a point where they supported the bill, but we did reach a point where they stood down,” Maroney, who is also a vice chair for the National Conference of State Legislatures’ AI and privacy task force, said.

The resulting bill, which passed in 2022, is now considered a model for business-friendly privacy laws and has been replicated in at least seven other states, including Montana, Minnesota and New Hampshire.

Connecticut’s privacy law even won over support from privacy advocates temporarily, which Kingman highlights when he pitches this model for other states.

He told lawmakers in Vermont that Consumer Reports supports the blueprint. But Justin Brookman, the organization’s director of technology policy, said that was no longer true.

“At the time, we supported the legislation in Connecticut as a compromise that prevented a weaker version … from being passed,” Brookman told POLITICO, noting the law still has many loopholes that benefit industry. “In every state we go to we point out those loopholes and say they need to be fixed. SPSC is quite aware of this fact.”

Kingman’s negotiating skills even impress privacy advocates who often work against him. Charlie Fisher, the state director of the Oregon State Public Interest Research Group, participated in a policy working group with Kingman intended to help state lawmakers craft a data privacy law.

He recalled Kingman’s approach was a stark contrast from the tech industry groups at the meetings, who voiced staunch opposition to proposals.

“He did present himself differently, kind of a good cop to the bad cops of the other industry groups,” Fisher said.

Kingman told POLITICO in an interview that while he is not neutral about where privacy regulations fall, he is upfront about the concerns that businesses have with strict data provisions.

“I try to be an honest broker and explain the consequences,” he said.

When Kingman talks about his role, he doesn’t frame it in terms of loosening laws — he talks about laws getting passed. “There’s over half, at this point, of the U.S. population that is working under some form of privacy protections,” Kingman said. “I’m very proud of the role that we’ve played in that.”

But while many lawmakers, businesses and tech industry groups support the legislation that Kingman recommends, privacy advocates argue that these laws are ineffective and tend to leave consumers worse off.

“In some cases, a weak privacy bill is worse than doing nothing at all,” Consumer Reports’ Schwartz said. “The substantive protections of those bills are not very strong, they’re full of loopholes, they’re borderline unenforceable.”

Kingman’s first dip into politics came in 2006, when he drove over 68,000 miles to visit every town in Massachusetts campaigning for Reed Hillman, the Republican nominee for lieutenant governor. Hillman would shape Kingman’s approach to politics, as the two spent hours on the road together for eight months during the campaign.

“He’d been in public service for quite a while and was somebody who very much believed in meeting people where they were, and listening, and getting to yes, trying to get stuff done positively,” Kingman said.

He used the same skills years later when he returned to Massachusetts as a lobbyist for AT&T, traveling from town to town persuading local officials to grant cell tower permits. That grassroots experience would shape Kingman’s approach as he became a national figure.

“I’ve knocked on hundreds, if not thousands of doors in my life, in my political career,” Kingman said. “I’ve had experiences that allow me to meet people where they are and to not be judgmental and to be able to work effectively with lots of different kinds of folks.”

His role at AT&T would lead him to the SPSC in 2018. Jim Halpert, then the SPSC’s general counsel, saw potential in Kingman’s approach.

The two shared a similar philosophy — that with a law in the works, it was better to steer lawmakers toward friendly legislation than fight tooth-and-nail against it. Halpert considered it a Sisyphean task to try to kill off regulations in every state, when it would be easier to support compromises that lawmakers could agree to.

Halpert declined to comment on the record, citing his role as the general counsel for the White House’s office of the National Cyber Director.

The SPSC’s “secret sauce,” as Kingman describes it, is having a wide variety of industries backing the same message.

The signature Kingman lobbying campaign doesn’t show his fingerprints on it at all — it feels to politicians like a very local, very broad-based pressure campaign. While the coalition’s members, national firms like tech giants, carmakers or pharmaceutical companies, may not have the ears of state lawmakers, Kingman has been able to tap into an influence group they find much harder to ignore: local businesses.

Kingman’s efforts in Vermont embodied this. While he was presenting his arguments against the state’s privacy proposals, local businesses including ski resorts and restaurants were echoing these talking points.

Unbeknownst to the state’s lawmakers, Kingman had also been organizing weekly calls with business groups on messaging strategies against the bill. In a May 6 email obtained by POLITICO, Kingman coordinated with local businesses specifically on the bill’s provisions around enforcement. The groups on the email list included Vermont’s Chamber of Commerce, the Vermont Retail & Grocers Association and the Vermont Ski Areas Association.

“We should push strongly for language stating that the AG has exclusive authority to enforce the provisions of this act,” Kingman wrote in the email. The point of his message was to undercut a provision of the law that businesses were especially worried about: the right of individual citizens to sue.

Representatives from both the Vermont Chamber and the Ski Areas Association told POLITICO they couldn’t support the legislation because of the challenges it presented for businesses. They didn’t respond to the question about whether they worked with Kingman. The Retail & Grocers Association didn’t respond to requests for comment.

Kingman said these weekly calls had been taking place since spring, when drafts of the bill were first released.

Vermont’s local businesses opposing the state’s data privacy proposal confused lawmakers like Democratic state Sen. Becca White, who had never heard from these businesses before.

White recalled that Vermont’s ski resorts were silent on legislation that directly affected land use on ski mountains, but suddenly took issue with the state’s data privacy proposal.

“It was funny to me that I had not heard at all about this major change that we were working on, but I did hear about data privacy,” White said.

The local business pushback divided Vermont’s Democratic-controlled Legislature, swaying senators who sought to change the bill to more closely align with Kingman’s suggestions, while House members stood firm on the original proposal.

The bill ultimately passed through both chambers at the last minute, but the local businesses needed only to convince the most important lawmaker in Vermont: Scott, who cited their concerns in vetoing the privacy regulations. (Scott’s office did not respond to a request for comment about the veto.)

A public records request from POLITICO revealed that out of 84 emails urging the governor to veto the privacy bill, 57 came from businesses that were members of Vermont’s Chamber of Commerce, the Vermont Retail & Grocers Association or the Vermont Ski Areas Association.

After learning about the weekly calls coordinated by Kingman, White said it confirmed her suspicions about local businesses getting talking points from outside sources. She noted that the lobbying efforts were especially effective because Vermont’s lawmakers couldn’t draw a connection between the state’s local businesses and industry groups that Kingman represented.

“It was that kind of pressure, and the belief that it was coming from a legitimate source, and not a coordinated source, that was persuasive,” White, who backed the privacy legislation, said.

“It is tough to go against a business owner who tells you, ‘No, this is obviously for our business, we are not coordinating with Big Tech,” White said. “But then why is the guy who is working with Big Tech regularly meeting with you to give you messaging?”

There are still about 30 states without a privacy law that Kingman can and likely will influence.

A month after Vermont’s governor vetoed the state’s privacy law, POLITICO learned that Kingman had been in touch with Michigan’s Chamber of Commerce. Public records show that he’s also lobbying on privacy regulations in Pennsylvania —both states considering the issue this year.

Lawmakers have long been suspicious about local businesses parroting the tech industry’s requests in data privacy regulations, to the point where multiple state legislators have begun sharing notes about their similar experiences.

Kingman’s opponents have noticed, too: “I’ve always felt like some of the small business opposition that we were facing wasn’t necessarily organic,” Consumer Reports’ Schwartz said. “The level of sophistication, the uniformity and the message discipline just seemed suspicious to me.”