Concentrated platform power is concentrated public power.

The European Union enacted the General Data Protection Regulation (GDPR) in 2018. China enacted the Personal Information Protection Law in 2021. The United States has not passed a comprehensive federal privacy law. The result is a fragmented sectoral patchwork — HIPAA for health, FERPA for education, GLBA for finance, COPPA for children — with everything else governed by the FTC's general consumer-protection authority. State-level privacy laws (CCPA in California, CDPA in Virginia, CPA in Colorado, and at least a dozen others) have advanced in the federal vacuum, producing a 50-state patchwork that businesses navigate through compliance overhead and that regulators navigate through inconsistent application. The American Privacy Rights Act and similar federal proposals would establish a comprehensive framework: data minimization requirements, consent rules for sensitive data, individual rights (access, correction, deletion, portability), and FTC enforcement authority. The recurring sticking point is preemption — whether federal law would preempt state laws (which industry favors) or set a federal floor over which states can build (which advocates favor). The substantive policy compromises are negotiable; the political compromise on preemption has been the harder problem.

Generative AI deployment has accelerated rapidly since 2022. The federal regulatory response has been incremental: Executive Order 14110 (2023) established a baseline of agency action; the NIST AI Risk Management Framework provided voluntary technical guidance; sectoral agencies (FTC, EEOC, DOJ Civil Rights, FDA, others) have applied existing authorities to AI systems within their jurisdictions. Comprehensive federal AI legislation has been introduced in multiple forms but not enacted. The substantive policy levers: pre-deployment evaluation requirements for high-impact systems (employment, lending, healthcare, criminal justice), post-deployment monitoring and incident reporting, transparency requirements (training data, model cards, capability disclosures), and meaningful liability frameworks for harm. State-level action has filled some gaps — Colorado's AI Act, California's SB 1047 (vetoed but reintroduced in modified form), and several state-level disclosure and labeling rules. The federal preemption question that constrains privacy law also constrains AI law; industry preference for a federal preemption floor has been a recurring obstacle. The advocates' position has been that federal law should set a meaningful floor without preempting state-level experimentation.

After roughly forty years of underenforcement under the consumer-welfare standard, US antitrust enforcement against major platforms has been the most active in a generation. The DOJ Search case against Google reached trial in 2023; the August 2024 ruling found Google liable for monopolization of search; remedies are being litigated. The DOJ AdTech case against Google reached trial in 2024. The FTC case against Meta (concerning Instagram and WhatsApp acquisitions) is in active proceedings. The DOJ case against Apple's iOS practices was filed in 2024. State AG cases have run in parallel. The substantive policy question is increasingly about remedies. Conduct remedies — behavioral commitments by the dominant firm — have a poor track record in tech antitrust historically (Microsoft 1990s consent decree being the standard reference). Structural remedies — divestitures of specific lines of business — are more enforceable but politically and operationally more complex. The legislative complement to enforcement: the American Innovation and Choice Online Act and similar bills would prohibit specific self-preferencing and discrimination practices by dominant platforms. Reintroduced in multiple sessions; not yet enacted. The combined enforcement and legislative agenda represents the most concerted antitrust push of the post-1980s period.

Net neutrality — the principle that internet service providers should not discriminate among lawful internet traffic by content, source, or destination — has been adopted, repealed, and reinstated multiple times depending on which party controls the FCC. The underlying statutory framework, the Communications Act, was last comprehensively updated in 1996 (before the consumer internet existed in its current form). The Court of Appeals' 2024 ruling vacating the most recent net-neutrality reinstatement, on Chevron-related grounds following the 2024 Loper Bright ruling, has made the regulatory path narrower; congressional action would now be the more durable route. Beyond net neutrality, the broadband access gap remains substantial. Roughly 30% of US adults rely on smartphones for primary internet access; tens of millions of households lack home broadband. The Bipartisan Infrastructure Law's Broadband Equity, Access, and Deployment program is the largest federal broadband infrastructure investment in history. The Affordable Connectivity Program, which subsidized broadband for low-income households, ran out of funding in 2024; restoration is a continuing legislative priority. The combined infrastructure-and-affordability agenda is one of the more bipartisan tech policy areas, with broad consensus on the destination if not on the funding mechanism.

Several digital-economy issues that intersect this cluster but require their own attention. Platform labor (rideshare, delivery, task work) is covered in the Labor & Wages cluster's misclassification subtopic; the digital infrastructure that mediates it is part of this cluster. Creator economy policy — compensation for artists, writers, and creators whose work is used to train generative AI — is an active legislative and litigation frontier; the COPIED Act, the NO FAKES Act, and various state-level laws on AI-generated likenesses are advancing. Non-consensual intimate imagery (NCII), including AI-generated, is an area where federal action has been incremental (the TAKE IT DOWN Act and similar proposals) and state action has been more aggressive. Children's online safety has been a particularly active area, with KOSA and parallel proposals raising substantive policy questions about platform liability, content moderation, and parental controls — and constitutional questions about First Amendment reach. Across all of these, the structural pattern is similar to other tech-policy areas: rapid commercial development, slower regulatory response, and a recurring tension between federal preemption and state-level experimentation.