The Monopoly Report – Episode 45: Cobun Zweifel-Keegan on the Great U.S. State Regulatory Experiment

Host: Alan Chapell
Guest: Cobun Zweifel-Keegan, Managing Director, IAPP
Date: September 3, 2025

Episode Overview

This episode delves deeply into the evolving landscape of U.S. state regulation of privacy and artificial intelligence (AI) in the absence of comprehensive federal action. Alan Chapell and guest Cobun Zweifel-Keegan discuss the factors driving states to innovate new privacy laws, key enforcement and legislative trends, and the growing patchwork of state approaches to regulating both data privacy and AI. The conversation explores how and why states are becoming laboratories for tech regulation and the implications for businesses, individuals, and future federal action.

Key Points & Insights

1. What Drives State Action?

Timestamps: 03:00–08:55

• Consumer Demand & Federal Inaction

  • Cobun emphasizes that "consumers want these laws" and that demand for data protections has increased as technology evolves (03:36). Inaction by Congress has left space that states are rapidly filling.
  • “The states waited quite a long time just to see if Congress would step in... But by now they figured out that Congress is probably not going to move as fast as the states can.” (04:40)
  • The first major push, notably in California, was motivated by grassroots action and the threat of a ballot initiative (03:36, 07:29).

• Tangible Harms Now Evident

  • Alan points out a shift: what were once “ethereal, hard to demonstrate” harms are now real, with “people... starting to get hurt.” (05:23)
  • Cobun agrees, noting technological advances have increased personal risk, especially concerning sensitive data like health and location (06:12).

2. Historical Context: How Did We Get Here?

Timestamps: 06:47–10:29

• California’s Pioneering Role

  • California set precedent with early data breach laws and the CCPA (09:20). Cobun notes, “I don't want to give too much credit to California, but... that's kind of where the spark finally struck.” (07:29)
  • Other states followed, with legislative templates often tracing back to debates and bills in California and Washington (08:55).

• Activist AGs in Early Privacy Battles

  • Before 2018, state action was mainly led by a few activist Attorneys General like Eliot Spitzer and Kamala Harris (06:47).

3. Common State Regulatory Themes & Enforcement

Timestamps: 10:29–15:25

• Key Enforcement Areas

  • Cobun identifies three primary state enforcement themes:
    • Sensitive data (esp. location): A focus due to its perceived trust and harm risk, e.g., Texas lawsuits against automakers for sharing driver data with insurers (13:56).
    • Health data: Recent California actions underscore heightened scrutiny over its collection and use.
    • Automated decision-making / AI: An emerging area, with rulemaking more common than enforcement thus far (10:36, 13:56).
  • “Texas sued rather than negotiate with these companies...alleged that the consumers really aren’t aware of this...very invasive thing that consumers shouldn’t...expect their cars to be reporting." (13:56)

• Resource Disparities Among States

  • Enforcement varies widely: "Some states have actually given millions of dollars...while other states haven’t. So...only a couple of dedicated staffers...maybe two." (10:36)

• Unexpected Consistency (so far)

  • The ad industry has benefited from relative consistency across state privacy laws, though revision rounds could introduce greater variance (15:57).

4. Growing Variance and Federal Preemption

Timestamps: 15:57–22:05

• States Begin to Diverge in Rulemaking

  • California, Colorado, and New Jersey are highlighted as states with unique features in their AI and privacy rule sets (16:47).
  • “I do think we are starting to see some deviations. California just finalized their automated decision-making rules. Those do differ from the Colorado regulations...New Jersey has draft rules and...a lot of the rules are different.” (16:47)

• Will this Push Federal Preemption?

  • Alan speculates a surge in state disparities could finally drive federal preemption efforts (18:56).
  • Cobun is cautious: “We've all gotten a little chilled on the idea that maybe that would one day happen.” (19:35)
  • Historical parallel: Despite predictions, a federal data breach law never materialized; instead, 50+ state laws exist (19:35).

5. Intersection of Privacy and AI Regulation

Timestamps: 22:05–25:00

• AI and Privacy Are Inseparable
  • Current Congressional discussions increasingly treat preemption and regulation as distinct issues for AI vs privacy, though “it’s hard to regulate AI without also regulating privacy” (21:21).
  • The Republican-led approach is more deregulatory, even floating a federal “moratorium” on state AI rules—the idea is not true preemption, but to pause state action while Congress catches up (22:05).
  • Many state AI laws extend from automated decision-making provisions in privacy laws (22:05, 23:03).

6. Notable Moments and Reflections

Timestamps: 24:03–30:20

• Analogies and Media Moments

  • The recent New York Times story on the leaking of lawmakers’ Spotify data sparked Alan’s reflection on how personal data leaks have previously driven Congressional action (e.g., Bork’s videotape rentals and the Video Privacy Protection Act) (24:03).
  • “But it reminded me of...when somebody had published a list of Mr. Bork's video rental history and that...freaked out lawmakers...So I don't know if you're going to be willing to play with me on this, but what makes you think that...wouldn't result in a similar level of congressional CYA?” (24:03)
  • Cobun responds, “We've actually seen...killings in Minnesota spur the discussions...because that was definitely noticeable to lawmakers that this person used data brokers...to figure out where they actually live.” (25:00)

• Normalization of ‘Invasive’ Practices

  • Alan: “We are so anesthetized to what 30 years ago would have seemed like wildly invasive activities. And today those are taken in stride.” (27:38)

• Private Right of Action Debates

  • Both point out the creativity of class action lawyers in expanding old statutes to new technologies, fueling business opposition to wider private rights of action (28:42).

7. AI Rulemaking: The State of Play

Timestamps: 30:20–34:47

• Privacy vs AI Legislative Effectiveness

  • Alan contends state privacy laws have been “reasonably effective” so far, but AI laws feel less so, perhaps due to the field’s immaturity (30:20).
  • Cobun highlights the vast scope and definitional challenges of AI, and Colorado as a leading example of automated decision-making standards (30:55).

• Foundational Model Regulation

  • States have eyed regulations on AI model developers, but “industry...steadfastly opposed” these efforts (32:27).

8. Predictions for the Next 18 Months

Timestamps: 34:47–39:36

• Persistent State Leadership

  • Cobun predicts: “That deregulatory moment...isn’t going to fade very quickly, but...we are seeing a lot of media attention, a lot of consumer attention to AI harms...That level of engagement...is probably going to come back...to legislators.” (35:20)
  • More states will pass or revise privacy laws, and potentially double down on their AI regulations in response to Congressional suggestions of a moratorium (35:06, 37:13).

• Federal Action Still Unlikely

  • Federal bills will emerge, but Cobun won’t predict passage: “It’s always a challenge to predict that tech policy legislation will pass.” (37:13)

Notable Quotes

• “Consumers want these laws...as technologies evolve, [they] want protections.” – Cobun Zweifel-Keegan (03:36)
• “What’s really happened over the last...five to seven years is that you now have tangible harms. Stuff is starting to break, and...people are starting to get hurt.” – Alan Chapell (05:23)
• “Some states have actually given millions of dollars...while other states haven’t. So...one, one and a half is maybe the average...But states like Texas [are]...more active.” – Cobun (10:36)
• “The more variance there is...sooner or later that’s going to create an impetus for a federal preempting...privacy law.” – Alan (18:56)
• “AI policy is a very broad area. It covers every committee on the Hill...” – Cobun (22:05)
• “…People are so anesthetized to what 30 years ago would have seemed...wildly invasive activities. And today those are taken in stride.” – Alan (27:38)
• “That deregulatory moment that we're in isn't going to fade very quickly, but at the same time, we are seeing a lot of media attention, a lot of consumer attention to AI harms.” – Cobun (35:20)
• “I think that doubling down is just as likely to see more energy towards preemption...But I guess we'll see both.” – Alan (38:22)

Memorable Moments & Segments

• Texas’s innovative legal actions over auto industry data sharing. (13:56)
• Comparing today's data leaks (Spotify, lawmaker playlists) to historical precedents like Bork’s videotape scandal. (24:03)
• The discussion on how legal definitions haven’t kept pace with tech (e.g., what counts as a “video rental” today). (27:38)
• AI as the ‘policy bubble’ of the moment, but with legislative struggle to define and regulate it clearly. (32:19)
• Prediction about legislative activity: more state action, more media attention, federal stalemate. (35:06–37:13)

Closing Notes

Alan closes by highlighting Cobun’s insights and recommending he be read “religiously” for all privacy professionals (39:19). He emphasizes the continuing trend of state leadership but sees growing momentum—and political irony—in renewed federal preemption efforts.

Useful Timestamps

• 03:00: Why states are leading on privacy and AI
• 10:29: The “three big enforcement themes” across states
• 13:56: Texas lawsuits and enforcement details
• 16:47: How state law variance is emerging
• 22:05: AI and privacy: inseparability and implications for federal preemption
• 24:03: Spotify data hack & the “Bork tape” analogy
• 27:38: Social normalization of data intrusions
• 30:55: The state of AI legislation
• 35:06: Predictions for the next 18 months

End of Summary