Lindsey Tonsager

Tonsager is vice chair of Covington & Burling’s global privacy and cybersecurity practice and the head of its West Coast privacy and cybersecurity group. She specializes in regulatory and public policy issues. Clients include American Airlines Inc., ByteDance Ltd. and TikTok, the Entertainment Software Association, Expedia Group, Facebook, Hulu LLC, Verizon Communications Inc. and Verizon Media, Microsoft Corp., Nike Inc., The Nintendo Co., PBS and ViacomCBS Inc.

She assists clients respond to informal investigations and enforcement actions, including by self-regulatory bodies such as the Digital Advertising Alliance and the Children’s Advertising Review Unit.

As privacy protections expand in California, she is a leading authority on the state’s Consumer Privacy Act after having lobbied regarding its provisions on behalf of American Airlines and advising other multinational clients on the act and its amendments.

Shortly before Election Day she was anticipating the likely passage of Proposition 24, the Consumer Personal Information Law and Agency Initiative, designed to further privacy advocates’ goals by allowing individuals to direct businesses to not share personal information and by creating a new agency to enforce data privacy laws.

“The whiplash created by the CCPA means there’s never a dull moment in my job,” she said, “and it won’t end with Prop. 24. If it passes, that kicks off a whole process of creating a new administrative agency and a number of questions.” Among them, she said, is how the role of the state attorney general—currently charged with enforcing the CCPA—will be disrupted by the new five-person board that will run what will be known as the Privacy Protection Agency.

“These shifting sands keep throwing uncertainty and doubt at us,” Tonsager said. “Fortunately, there’s quite a long runway,” she added, meaning the two-year period before the new initiative takes effect, during which companies will have time to prepare. Unlike the CCPA, which was modified by legislative amendments, the Prop. 24 setup is designed for the measure to operate as written, without lawmakers’ subsequent input. “That means you don’t have as much leverage as a lobbyist,” Tonsager added.

And that means Tonsager and others are looking beyond California toward the prospect of federal privacy rules potentially enacted by Congress. Again, she said, the election’s outcome will likely determine the contours of any new law. “The Democrats have been very vocal that they don’t want federal legislation to preempt state laws. The Republicans see it the other way.”

Prop. 24 also contains privacy protections for children, including a rule that companies must obtain permission from a parent or guardian before collecting data from consumers younger than 13. “Historically, that’s been a bipartisan issue,” Tonsager said. “The Federal Trade Commission is updating its regulations in that area.”

So there’s a lot to do. “Every day is a new adventure, with no end in sight. That’s why this practice is so interesting,” Tonsager said.

— John Roemer