The proposed Smart Meter Data Privacy Protection Act would impose restrictions on certain utilities’ sale of data collected from smart meters and direct the Federal Trade Commission (FTC) to establish standards for the security and retention of that information.
The proposal is notable not only for its treatment of energy-use data but also its potential implications for companies in other sectors that collect detailed information about consumers’ activities and behavior. The bill focuses on utilities that are not wholly US-owned, at a moment when privacy and national security concerns are converging around foreign access to US sensitive data.
Absent comprehensive federal privacy legislation, lawmakers and regulators are progressively targeting data and practices that may pose heightened privacy risks to consumers. Meanwhile, states continue to expand their own privacy requirements, creating a complex patchwork of rules governing the ways in which companies collect, use, share, or monetize consumer information.
For US businesses, the emerging question is less about whether a particular dataset is traditionally considered sensitive and more about what the data can reveal about an individual, alone or in combination with other information. Companies with international owners or investors must also consider whether foreign access to that data could attract heightened regulator interest.
ENFORCEMENT IS EXPANDING TO PASSIVE DATA COLLECTION
Recent federal and state enforcement actions underscore growing scrutiny of data collected in the background of everyday technologies. In January, the FTC finalized a connected vehicle order resolving allegations that precise location and driving behavior data were collected and sold to third parties without adequate notice or affirmative consent. The order restricts certain data sharing and requires greater transparency and consumer control.
Smart TVs have also drawn enforcement attention. In an earlier action, the FTC and a state attorney general challenged the collection of detailed television viewing histories, which were combined with demographic information and sold for advertising purposes without consumers’ knowledge or consent. More recently, state enforcement agreements addressing automatic content recognition technology, which tracks television viewing activity, have required clearer on-screen disclosures, informed consent, and accessible privacy choices.
Together, these actions highlight regulators’ increasing focus on whether consumers understand that connected products are collecting information, how that data may be used to build consumer profiles, and whether consumers have meaningful opportunities to control its collection and use.
A GROWING FOCUS ON PARTICULARLY SENSITIVE DATA
The smart meter proposal also fits a longstanding feature of US privacy regulation: imposing heightened protections on specific categories of information rather than relying on a comprehensive federal privacy framework.
Federal and state laws already provide varying levels of protection for children’s, health, and financial information, as well as biometric and precise geolocation data. More recently, state privacy laws continue to expand the definition of “sensitive data,” imposing additional requirements on its collection and use.
The FTC has likewise used its existing authority to analyze the collection and use of data that it considers to be “sensitive.” FTC enforcement involving precise geolocation data, for example, has focused on whether consumers understood and consented to the collection, use, and sale of information that could reveal visits to sensitive locations. The agency has emphasized the importance of clearly disclosing what information companies collect, why they collect it, and what third parties may receive it.
The result is a regulatory landscape in which sensitivity is more frequently determined by context and potential use rather than simply by the industry that is collecting the information.
A company may therefore encounter significant privacy obligations, even if data collection is incidental to its principal business. An energy company, automaker, retailer, technology provider, employer, or manufacturer may collect information, through products and services, that generates insights traditionally associated with more obviously data-intensive businesses.
NAVIGATING A PATCHWORK OF PRIVACY REQUIREMENTS
Without comprehensive federal privacy legislation, states continue to adopt varying privacy requirements, with state attorneys general playing an increasingly prominent enforcement role. State privacy laws impose different obligations concerning sensitive data. Some require consent before processing sensitive data while others impose restrictions involving data minimization, retention, targeted advertising, or the sale or sharing of such information.
Recent amendments to Delaware’s privacy law illustrate a growing emphasis on accessible consumer choice. The amendments will require covered controllers to provide a clear and conspicuous link on their websites or applications, directing consumers to a web page or interface for exercising their opt-out rights. The revision underscores the importance of making consumer privacy choices readily accessible and visible rather than burying them in privacy policies.
The proposed smart meter legislation illustrates how another targeted federal requirement could be layered onto the existing framework. The bill would authorize state attorneys general and the FTC to enforce its provisions, potentially giving state regulators another tool for scrutinizing data practices.
For companies operating nationally, complying with each new requirement in isolation may be challenging. A more sustainable approach involves establishing enterprise-wide, scalable processes for identifying sensitive data and understanding how it moves throughout the organization.
THE VALUE OF DATA AND THE RISK OF ITS SECONDARY USE
None of this means that companies should avoid using data to develop products, improve services, or better understand customers. Consumer information can generate substantial value for both businesses and consumers. But the regulatory risk may increase when information collected for one reason is used for a secondary purpose, particularly when the additional use is unexpected or involves disclosure or sale to a third party.
Companies should therefore consider whether their external disclosures accurately reflect their actual data practices. They may also want to assess whether consumers would reasonably expect a particular use based on the context in which the information was originally collected. That assessment is especially important when data is automatically collected in the background of an everyday product.
To reduce regulatory risk, companies may choose to provide clear, conspicuous, and device-appropriate notice at or before collection. Depending on the product, appropriate disclosures may need to appear during setup, on the device itself, in a companion app, or at another point during which consumers will encounter them, rather than solely in a general privacy policy. Companies should separately assess and implement any consent or opt-out mechanisms required under applicable law.
The analysis can become more crucial as businesses deploy artificial intelligence and other advanced analytics that are capable of extracting new insights from existing datasets. Information that appears to be limited when collected may become considerably more revealing when combined with other data or when analyzed with new tools. Data governance increasingly requires organizations to understand not only what information they possess but also what they are capable of doing with it.
WHEN PRIVACY AND NATIONAL SECURITY CONVERGE
The Smart Meter Data Privacy Protection Act raises questions about the intersection of privacy and national security. Its definition of covered utilities appears to focus on state-regulated electric utilities that are not wholly owned by US persons, amid a broader US policy focus on foreign access to sensitive data.
For example, the US Department of Justice’s Data Security Program restricts or prohibits certain transactions that could provide countries of concern or covered persons access to bulk US sensitive personal data or government-related data.
For multinational companies, these developments highlight the importance of understanding what type of sensitive data is collected, how it is used, where it is stored, and who can access it.
WHAT COMPANIES SHOULD CONSIDER
Regardless of whether the smart meter proposal becomes law, it emphasizes broader privacy risks that businesses across industries should consider when creating and implementing their privacy and data governance programs:
- What data are we actually collecting? Data inventories should account for information collected automatically through connected products, sensors, apps, websites, vehicles, and other technologies, not only information consumers knowingly provide.
- What can the data reveal? Companies should assess whether seemingly routine information can, alone or when combined with other data, reveal sensitive details or be used to build consumer profiles.
- How is the data being used? Organizations should identify secondary uses, including advertising, analytics, product development, and AI training.
- Who has access to the information? Companies should review their data disclosures to vendors, affiliates, and other third parties, including potential downstream uses.
- Are consumers adequately informed? Clear and conspicuous disclosures should accurately describe data collection, including passive collection through connected products, profiling, and third-party sharing. Companies should also confirm that consent mechanisms satisfy applicable requirements.
- Can consumers readily exercise their privacy rights? Where required, websites and applications should provide clear and conspicuous links to functioning opt-out mechanisms for targeted advertising, data sales, and qualifying profiling.
- Does cross-border access create additional risks? Companies should assess whether data storage, vendor relationships, or other foreign access arrangements create additional legal obligations.
As everyday products generate increasingly detailed information about consumers, regulators are focusing on what data reveals, how it is used and disclosed, and whether consumers receive adequate notice and meaningful choices. Companies should proactively assess their practices rather than wait for regulatory scrutiny or new legislation.
