The individual subtly transforming U.S. privacy legislation
Lobbyist Andrew Kingman has transformed American policy on a significant technology matter — all without ever visiting Capitol Hill.
TroibNews 
Just moments after Vermont's legislative session concluded on May 11, lawmakers celebrated the passage of a new law aimed at protecting privacy and ensuring kids' online safety, establishing the most stringent data protection regulations in the nation.
However, that celebration was short-lived. Under sustained pressure from local businesses, Republican Gov. Phil Scott ultimately vetoed the bill.
Vermont's legislators remarked that they had never encountered a lobbying effort of this magnitude opposing their privacy legislation, with nearly every sector in the state voicing dissent. Yet, lawmakers from other states have seen similar campaigns, all linked by a common figure: lobbyist Andrew Kingman.
Operating primarily via video conferences from his New England office, Kingman has wielded significant national influence over tech policies, using grassroots tactics developed during a campaign across rural Massachusetts.
“It just doesn’t happen without Andy,” said Carl Szabo, general counsel for the tech industry group NetChoice, which collaborates with Kingman on privacy issues. “Andy is the foundation for a lot of the privacy legislation that we’re seeing around the country. He is instrumental, and he is essential.”
With Congress generally unable or unwilling to enact new tech regulations, states have emerged as key players in shaping policies related to one of the country's most dynamic sectors over the past three years. As state lawmakers address matters such as online safety and artificial intelligence, Kingman has effectively influenced national policy regarding citizens' control over their online data.
As the State Privacy and Security Coalition’s counsel, Kingman represents companies intent on maintaining lax rules governing data collection and usage. Members of the Coalition include Amazon, Google, and Meta, alongside consumer giants like Target and General Motors.
Although he has never been a formal employee of the coalition, Kingman served as outside counsel through various law firms, including DLA Piper from 2018 to 2021, and then through his own firm, Mariner Strategies, from 2022 onward.
The coalition has lobbied in at least 32 states to advance data privacy regulations, with Kingman working to block tougher measures or promote business-friendly legislation in at least 22 of those states, according to a PMG review of public records and interviews with lawmakers.
His approach underscores an irony in contemporary American policymaking: as focus shifts to state legislatures, often referred to as "laboratories of democracy," a well-coordinated lobbying effort can establish a de facto national standard by consistently promoting a unified message, state by state.
Thanks to Kingman's efforts, most states have enacted data privacy laws that are relatively favorable to business compared to the stringent regulations seen in Europe and California. While these laws vary in details, they all share key provisions that shield companies from direct lawsuits by citizens for privacy violations, and they often diminish protections through extended debates over terms such as “selling” data and what constitutes “sensitive” information.
“The battle over the future of privacy protections for Americans is happening at the state level,” noted Matt Schwartz, a policy analyst at Consumer Reports advocating for state privacy regulations. “Industry knows this, and that is why they have expended so many resources in trying to pass their favored model.”
For decades, U.S. companies have thrived under minimal regulations concerning data collection, enabling industries to profit from gathering, selling, and utilizing detailed information about individuals’ lives, from their viewing habits to shopping patterns to travel routes.
As concerns about corporate knowledge of personal data and potential misuse have escalated, lawmakers around the globe have begun taking action. The European Union implemented its stringent regulations in 2016, with enforcement commencing in 2018. California introduced a similar privacy law in 2018 and has since expanded it with laws establishing a dedicated privacy protection agency and regulatory authority over issues like automated decision-making.
In the wake of California's lead, state legislators nationwide began drafting their own data privacy legislation, compelling the business community to react to avoid further states adopting similar stringent measures.
The SPSC quickly mobilized to combat these emerging regulations. Kingman joined the SPSC in 2018 just before California enacted its privacy law, marking the beginning of a strategic defense against regulations.
Behind the scenes, Kingman has proactively engaged with legislators before they introduce bills, cautioning local business organizations about the potential harm strict privacy regulations could cause. On a podcast in 2020, he described thwarting the spread of California’s law to other states as the “jewel in the crown of the SPSC.”
In Maine, he persuaded a lawmaker to retract her initiative to mimic California's legislation in favor of adopting the industry-preferred law from Connecticut. In Kentucky, he intervened to derail a senator's proposal that included provisions granting citizens the right to sue companies violating the privacy law.
Lawmakers interviewed for this article provided similar accounts of Kingman's role and strategy. Rather than arriving in state houses unexpectedly and harming his credibility, he connects with local business groups to exert pressure on legislators while positioning himself as a problem-solver.
Instead of outright opposing privacy bills, he candidly presents the likelihood of business opposition while offering to assist in crafting a compromise that business interests would not actively oppose.
“He definitely is very honest about who he’s representing and the issues that they have with legislation,” reflected Sen. Lisa Keim, a Republican from Maine who consulted with Kingman on her privacy bill.
Connecticut state Sen. James Maroney shared that he worked on privacy legislation for three years before encountering Kingman. Initially skeptical due to past unsuccessful efforts, Maroney grew to trust Kingman as they discussed the provisions SPSC’s members would accept, and which ones would be contentious.
“While we didn’t reach a point where they supported the bill, we did get to a point where they stood down,” noted Maroney, who also serves as vice chair for the National Conference of State Legislatures’ AI and privacy task force.
The resulting bill, approved in 2022, has since been lauded as a model for business-friendly privacy laws and replicated in at least seven other states, including Montana, Minnesota, and New Hampshire.
Connecticut’s privacy law even garnered temporary support from privacy advocates, a fact Kingman highlights when promoting this model to other states.
He informed Vermont lawmakers that Consumer Reports endorsed the Connecticut blueprint, but Justin Brookman, the organization’s director of technology policy, clarified that this endorsement no longer stands.
“At the time, we supported the legislation in Connecticut as a compromise that prevented a weaker version … from being passed,” Brookman explained to PMG, adding that the law still contains numerous loopholes benefiting industry interests. “In every state we visit, we point out those loopholes and emphasize they need to be fixed. The SPSC is quite aware of this fact.”
Kingman's negotiation skills have even earned him respect from privacy advocates who typically oppose him. Charlie Fisher, the state director of the Oregon State Public Interest Research Group, took part in a working group with Kingman aimed at aiding lawmakers in formulating a privacy law.
He remembered Kingman presenting himself distinctly compared to other industry representatives at meetings who aggressively opposed proposals.
“He did present himself differently, kind of a good cop to the bad cops of the other industry groups,” Fisher remarked.
In an interview with PMG, Kingman stated that while he does not shy away from representing business interests regarding privacy regulations, he aims to be an honest broker, outlining the implications of strict data provisions.
When discussing his role, he highlights the number of states with some form of privacy protection laws. “There’s over half, at this point, of the U.S. population that is working under some form of privacy protections,” Kingman said. “I’m very proud of the role that we’ve played in that.”
Nevertheless, despite support from many lawmakers, businesses, and tech industry groups for the legislation Kingman advocates, privacy advocates contend that these laws are often ineffective and leave consumers vulnerable.
“In some cases, a weak privacy bill is worse than doing nothing at all,” stated Schwartz of Consumer Reports. “The substantive protections of those bills are not very strong; they’re full of loopholes, they’re borderline unenforceable.”
Kingman’s initial foray into politics occurred in 2006 when he drove over 68,000 miles to visit every town in Massachusetts in support of Reed Hillman, the Republican candidate for lieutenant governor. Hillman significantly shaped Kingman’s political style, as they spent eight months campaigning around the state.
“He’d been in public service for quite a while and was somebody who very much believed in meeting people where they were, and listening, and getting to yes, trying to get stuff done positively,” said Kingman.
Years later, he applied those same skills while working as a lobbyist for AT&T, traveling around Massachusetts to persuade local officials regarding cell tower permits. This grassroots experience directly influenced Kingman’s evolving national role.
“I’ve knocked on hundreds, if not thousands of doors in my life, in my political career,” he said. “I’ve had experiences that allow me to meet people where they are and to not be judgmental and to be able to work effectively with lots of different kinds of folks.”
His work with AT&T ultimately led him to join the SPSC in 2018. Jim Halpert, then the SPSC’s general counsel, recognized Kingman’s potential.
The two shared a philosophy: when legislation is being drafted, it’s more effective to guide lawmakers toward favorable legislation than to engage in fruitless battles against it. Halpert believed it was a Sisyphean endeavor to try to thwart regulations in every state when it’s more feasible to support compromise legislation.
Halpert opted not to comment on the record due to his role as the general counsel for the White House’s National Cyber Director’s office.
What Kingman describes as the SPSC’s “secret sauce” lies in its diverse membership supporting a common message.
Typically, Kingman’s lobbying campaigns appear to originate from local groups, creating a perception among politicians of broad-based pressure. Despite the involvement of national corporations, Kingman has successfully tapped into local business influences that state lawmakers find hard to dismiss.
His efforts in Vermont exemplified this strategy. During his presentations against the state’s privacy proposals, local businesses, such as ski resorts and restaurants, echoed his arguments.
Unbeknownst to lawmakers, Kingman had organized weekly calls with business groups to devise strategies against the bill. A May 6 email obtained by PMG reveals Kingman coordinating with local businesses about the bill's enforcement provisions. The email list included Vermont's Chamber of Commerce, the Vermont Retail & Grocers Association, and the Vermont Ski Areas Association.
“We should push strongly for language stating that the AG has exclusive authority to enforce the provisions of this act,” Kingman wrote, aiming to undermine a provision of the law of particular concern to businesses: the ability for citizens to sue.
Representatives from the Vermont Chamber and the Ski Areas Association disclosed to PMG that they could not support the legislation due to the challenges it posed for businesses but did not address whether they collaborated with Kingman. The Retail & Grocers Association did not respond to inquiries for comment.
Kingman stated that these weekly calls had been occurring since spring, around the time drafts of the bill became available.
The opposition from Vermont’s local businesses caught lawmakers like Democratic state Sen. Becca White off guard, as she had not received any prior input from these businesses.
White recalled that Vermont’s ski resorts had been silent regarding legislation impacting land use on ski mountains but suddenly expressed concerns over the state’s data privacy proposal.
“It was funny to me that I had not heard at all about this major change that we were working on, but I did hear about data privacy,” White said.
The pushback from local businesses splintered Vermont’s Democratic-controlled Legislature, persuading some senators to adjust the bill in accordance with Kingman’s recommendations, while House members resisted the original proposal.
Ultimately, the bill passed both chambers at the last moment, but local businesses only needed to convince the most pivotal lawmaker: Governor Scott, who cited their concerns in his veto of the privacy regulations.
Public records obtained by PMG revealed that out of 84 emails urging the governor to veto the privacy bill, 57 came from businesses associated with Vermont's Chamber of Commerce, the Vermont Retail & Grocers Association, or the Vermont Ski Areas Association.
After learning of the weekly calls coordinated by Kingman, White remarked that it reinforced her suspicions about local businesses receiving talking points from external sources. She noted that the lobbying efforts were particularly effective because Vermont’s lawmakers struggled to connect local businesses with the industry groups represented by Kingman.
“It was that kind of pressure, and the belief that it was coming from a legitimate source, and not a coordinated source, that was persuasive,” White, who supported the privacy legislation, said.
“It is tough to go against a business owner who tells you, ‘No, this is obviously for our business, we are not coordinating with Big Tech,” said White. “But then why is the guy who is working with Big Tech regularly meeting with you to give you messaging?”
Approximately 30 states remain without privacy laws that Kingman is likely to influence.
A month after Vermont’s governor vetoed the state’s privacy law, PMG learned that Kingman was in discussions with Michigan’s Chamber of Commerce. Public records indicate he is also lobbying on privacy regulations in Pennsylvania—both states are contemplating data privacy issues this year.
Lawmakers have long expressed skepticism toward local businesses mimicking the tech industry’s requests concerning data privacy regulations, prompting multiple legislators to share their similar experiences.
Kingman’s adversaries have observed this trend too: “I’ve always felt like some of the small business opposition that we were facing wasn’t necessarily organic,” Schwartz from Consumer Reports commented. “The level of sophistication, the uniformity and the message discipline just seemed suspicious to me.”
Aarav Patel contributed to this report for TROIB News
However, that celebration was short-lived. Under sustained pressure from local businesses, Republican Gov. Phil Scott ultimately vetoed the bill.
Vermont's legislators remarked that they had never encountered a lobbying effort of this magnitude opposing their privacy legislation, with nearly every sector in the state voicing dissent. Yet, lawmakers from other states have seen similar campaigns, all linked by a common figure: lobbyist Andrew Kingman.
Operating primarily via video conferences from his New England office, Kingman has wielded significant national influence over tech policies, using grassroots tactics developed during a campaign across rural Massachusetts.
“It just doesn’t happen without Andy,” said Carl Szabo, general counsel for the tech industry group NetChoice, which collaborates with Kingman on privacy issues. “Andy is the foundation for a lot of the privacy legislation that we’re seeing around the country. He is instrumental, and he is essential.”
With Congress generally unable or unwilling to enact new tech regulations, states have emerged as key players in shaping policies related to one of the country's most dynamic sectors over the past three years. As state lawmakers address matters such as online safety and artificial intelligence, Kingman has effectively influenced national policy regarding citizens' control over their online data.
As the State Privacy and Security Coalition’s counsel, Kingman represents companies intent on maintaining lax rules governing data collection and usage. Members of the Coalition include Amazon, Google, and Meta, alongside consumer giants like Target and General Motors.
Although he has never been a formal employee of the coalition, Kingman served as outside counsel through various law firms, including DLA Piper from 2018 to 2021, and then through his own firm, Mariner Strategies, from 2022 onward.
The coalition has lobbied in at least 32 states to advance data privacy regulations, with Kingman working to block tougher measures or promote business-friendly legislation in at least 22 of those states, according to a PMG review of public records and interviews with lawmakers.
His approach underscores an irony in contemporary American policymaking: as focus shifts to state legislatures, often referred to as "laboratories of democracy," a well-coordinated lobbying effort can establish a de facto national standard by consistently promoting a unified message, state by state.
Thanks to Kingman's efforts, most states have enacted data privacy laws that are relatively favorable to business compared to the stringent regulations seen in Europe and California. While these laws vary in details, they all share key provisions that shield companies from direct lawsuits by citizens for privacy violations, and they often diminish protections through extended debates over terms such as “selling” data and what constitutes “sensitive” information.
“The battle over the future of privacy protections for Americans is happening at the state level,” noted Matt Schwartz, a policy analyst at Consumer Reports advocating for state privacy regulations. “Industry knows this, and that is why they have expended so many resources in trying to pass their favored model.”
For decades, U.S. companies have thrived under minimal regulations concerning data collection, enabling industries to profit from gathering, selling, and utilizing detailed information about individuals’ lives, from their viewing habits to shopping patterns to travel routes.
As concerns about corporate knowledge of personal data and potential misuse have escalated, lawmakers around the globe have begun taking action. The European Union implemented its stringent regulations in 2016, with enforcement commencing in 2018. California introduced a similar privacy law in 2018 and has since expanded it with laws establishing a dedicated privacy protection agency and regulatory authority over issues like automated decision-making.
In the wake of California's lead, state legislators nationwide began drafting their own data privacy legislation, compelling the business community to react to avoid further states adopting similar stringent measures.
The SPSC quickly mobilized to combat these emerging regulations. Kingman joined the SPSC in 2018 just before California enacted its privacy law, marking the beginning of a strategic defense against regulations.
Behind the scenes, Kingman has proactively engaged with legislators before they introduce bills, cautioning local business organizations about the potential harm strict privacy regulations could cause. On a podcast in 2020, he described thwarting the spread of California’s law to other states as the “jewel in the crown of the SPSC.”
In Maine, he persuaded a lawmaker to retract her initiative to mimic California's legislation in favor of adopting the industry-preferred law from Connecticut. In Kentucky, he intervened to derail a senator's proposal that included provisions granting citizens the right to sue companies violating the privacy law.
Lawmakers interviewed for this article provided similar accounts of Kingman's role and strategy. Rather than arriving in state houses unexpectedly and harming his credibility, he connects with local business groups to exert pressure on legislators while positioning himself as a problem-solver.
Instead of outright opposing privacy bills, he candidly presents the likelihood of business opposition while offering to assist in crafting a compromise that business interests would not actively oppose.
“He definitely is very honest about who he’s representing and the issues that they have with legislation,” reflected Sen. Lisa Keim, a Republican from Maine who consulted with Kingman on her privacy bill.
Connecticut state Sen. James Maroney shared that he worked on privacy legislation for three years before encountering Kingman. Initially skeptical due to past unsuccessful efforts, Maroney grew to trust Kingman as they discussed the provisions SPSC’s members would accept, and which ones would be contentious.
“While we didn’t reach a point where they supported the bill, we did get to a point where they stood down,” noted Maroney, who also serves as vice chair for the National Conference of State Legislatures’ AI and privacy task force.
The resulting bill, approved in 2022, has since been lauded as a model for business-friendly privacy laws and replicated in at least seven other states, including Montana, Minnesota, and New Hampshire.
Connecticut’s privacy law even garnered temporary support from privacy advocates, a fact Kingman highlights when promoting this model to other states.
He informed Vermont lawmakers that Consumer Reports endorsed the Connecticut blueprint, but Justin Brookman, the organization’s director of technology policy, clarified that this endorsement no longer stands.
“At the time, we supported the legislation in Connecticut as a compromise that prevented a weaker version … from being passed,” Brookman explained to PMG, adding that the law still contains numerous loopholes benefiting industry interests. “In every state we visit, we point out those loopholes and emphasize they need to be fixed. The SPSC is quite aware of this fact.”
Kingman's negotiation skills have even earned him respect from privacy advocates who typically oppose him. Charlie Fisher, the state director of the Oregon State Public Interest Research Group, took part in a working group with Kingman aimed at aiding lawmakers in formulating a privacy law.
He remembered Kingman presenting himself distinctly compared to other industry representatives at meetings who aggressively opposed proposals.
“He did present himself differently, kind of a good cop to the bad cops of the other industry groups,” Fisher remarked.
In an interview with PMG, Kingman stated that while he does not shy away from representing business interests regarding privacy regulations, he aims to be an honest broker, outlining the implications of strict data provisions.
When discussing his role, he highlights the number of states with some form of privacy protection laws. “There’s over half, at this point, of the U.S. population that is working under some form of privacy protections,” Kingman said. “I’m very proud of the role that we’ve played in that.”
Nevertheless, despite support from many lawmakers, businesses, and tech industry groups for the legislation Kingman advocates, privacy advocates contend that these laws are often ineffective and leave consumers vulnerable.
“In some cases, a weak privacy bill is worse than doing nothing at all,” stated Schwartz of Consumer Reports. “The substantive protections of those bills are not very strong; they’re full of loopholes, they’re borderline unenforceable.”
Kingman’s initial foray into politics occurred in 2006 when he drove over 68,000 miles to visit every town in Massachusetts in support of Reed Hillman, the Republican candidate for lieutenant governor. Hillman significantly shaped Kingman’s political style, as they spent eight months campaigning around the state.
“He’d been in public service for quite a while and was somebody who very much believed in meeting people where they were, and listening, and getting to yes, trying to get stuff done positively,” said Kingman.
Years later, he applied those same skills while working as a lobbyist for AT&T, traveling around Massachusetts to persuade local officials regarding cell tower permits. This grassroots experience directly influenced Kingman’s evolving national role.
“I’ve knocked on hundreds, if not thousands of doors in my life, in my political career,” he said. “I’ve had experiences that allow me to meet people where they are and to not be judgmental and to be able to work effectively with lots of different kinds of folks.”
His work with AT&T ultimately led him to join the SPSC in 2018. Jim Halpert, then the SPSC’s general counsel, recognized Kingman’s potential.
The two shared a philosophy: when legislation is being drafted, it’s more effective to guide lawmakers toward favorable legislation than to engage in fruitless battles against it. Halpert believed it was a Sisyphean endeavor to try to thwart regulations in every state when it’s more feasible to support compromise legislation.
Halpert opted not to comment on the record due to his role as the general counsel for the White House’s National Cyber Director’s office.
What Kingman describes as the SPSC’s “secret sauce” lies in its diverse membership supporting a common message.
Typically, Kingman’s lobbying campaigns appear to originate from local groups, creating a perception among politicians of broad-based pressure. Despite the involvement of national corporations, Kingman has successfully tapped into local business influences that state lawmakers find hard to dismiss.
His efforts in Vermont exemplified this strategy. During his presentations against the state’s privacy proposals, local businesses, such as ski resorts and restaurants, echoed his arguments.
Unbeknownst to lawmakers, Kingman had organized weekly calls with business groups to devise strategies against the bill. A May 6 email obtained by PMG reveals Kingman coordinating with local businesses about the bill's enforcement provisions. The email list included Vermont's Chamber of Commerce, the Vermont Retail & Grocers Association, and the Vermont Ski Areas Association.
“We should push strongly for language stating that the AG has exclusive authority to enforce the provisions of this act,” Kingman wrote, aiming to undermine a provision of the law of particular concern to businesses: the ability for citizens to sue.
Representatives from the Vermont Chamber and the Ski Areas Association disclosed to PMG that they could not support the legislation due to the challenges it posed for businesses but did not address whether they collaborated with Kingman. The Retail & Grocers Association did not respond to inquiries for comment.
Kingman stated that these weekly calls had been occurring since spring, around the time drafts of the bill became available.
The opposition from Vermont’s local businesses caught lawmakers like Democratic state Sen. Becca White off guard, as she had not received any prior input from these businesses.
White recalled that Vermont’s ski resorts had been silent regarding legislation impacting land use on ski mountains but suddenly expressed concerns over the state’s data privacy proposal.
“It was funny to me that I had not heard at all about this major change that we were working on, but I did hear about data privacy,” White said.
The pushback from local businesses splintered Vermont’s Democratic-controlled Legislature, persuading some senators to adjust the bill in accordance with Kingman’s recommendations, while House members resisted the original proposal.
Ultimately, the bill passed both chambers at the last moment, but local businesses only needed to convince the most pivotal lawmaker: Governor Scott, who cited their concerns in his veto of the privacy regulations.
Public records obtained by PMG revealed that out of 84 emails urging the governor to veto the privacy bill, 57 came from businesses associated with Vermont's Chamber of Commerce, the Vermont Retail & Grocers Association, or the Vermont Ski Areas Association.
After learning of the weekly calls coordinated by Kingman, White remarked that it reinforced her suspicions about local businesses receiving talking points from external sources. She noted that the lobbying efforts were particularly effective because Vermont’s lawmakers struggled to connect local businesses with the industry groups represented by Kingman.
“It was that kind of pressure, and the belief that it was coming from a legitimate source, and not a coordinated source, that was persuasive,” White, who supported the privacy legislation, said.
“It is tough to go against a business owner who tells you, ‘No, this is obviously for our business, we are not coordinating with Big Tech,” said White. “But then why is the guy who is working with Big Tech regularly meeting with you to give you messaging?”
Approximately 30 states remain without privacy laws that Kingman is likely to influence.
A month after Vermont’s governor vetoed the state’s privacy law, PMG learned that Kingman was in discussions with Michigan’s Chamber of Commerce. Public records indicate he is also lobbying on privacy regulations in Pennsylvania—both states are contemplating data privacy issues this year.
Lawmakers have long expressed skepticism toward local businesses mimicking the tech industry’s requests concerning data privacy regulations, prompting multiple legislators to share their similar experiences.
Kingman’s adversaries have observed this trend too: “I’ve always felt like some of the small business opposition that we were facing wasn’t necessarily organic,” Schwartz from Consumer Reports commented. “The level of sophistication, the uniformity and the message discipline just seemed suspicious to me.”
Aarav Patel contributed to this report for TROIB News
