As a commenter points out, the government is usually slow to address new trends, but there are a few pieces of legislation worth mentioning. Three examples from US Congress, and then a closing mention of a new law in California. None of these examples addresses surveillance capitalism specifically (as defined above), but these are all related to user privacy and user data collection.
First, a negative example (avoiding legislation). The EFF has supported the Email Privacy Act for a while (it "requires government agents to first obtain a probable cause warrant when seeking the content of communications stored by companies like Google, Facebook, Slack, Dropbox, and Microsoft."). That bill passed in the house, but when it came up in the senate,
Sessions and fellow Republican Senator John Cornyn added controversial surveillance-friendly amendments to the bill that caused it to falter and expire. Sessions wanted to grant law enforcement the ability to demand data from internet firms without a warrant in ill-defined "emergency" cases, despite the fact that many companies already do voluntarily hand over personal data in emergency situations. Even a retired Washington, DC homicide detective of 27 years called that amendment "unwise and unsafe."
Cornyn, meanwhile, attempted to expand the power of the FBI's national security letters, which can be secretly used to demand private information from internet firms. That expansion would have allowed national security letters to be used without warrants to grab metadata, like a target's browsing history and IP addresses. Dozens of civil liberties groups and tech firms including Google and Yahoo signed a letter opposing the amendment, but it ultimately delayed the bill too long to reach a vote before the end of the Congressional session.
via wired: https://www.wired.com/2017/02/trump-power-email-privacy-act-never-urgent/
The point is, the senate was a bit too apprehensive about expanding surveillance capabilities and decided not to pass the amended bill.
The other legislation is a positive example (creating legislation) from House rep Wyden. Here's a summary from his page about the bill.
The Consumer Data Protection Act protects Americans’ privacy, allows consumers to control the sale and sharing of their data, gives the FTC the authority to be an effective cop on the beat, and will spur a new market for privacy-protecting services. The bill empowers the FTC to:
- Establish minimum privacy and cybersecurity standards.
- Issue steep fines (up to 4% of annual revenue), on the first offense for companies and 10-20 year criminal penalties for senior executives.
- Create a national Do Not Track system that lets consumers stop third-party companies from tracking them on the web by sharing data, selling data, or targeting advertisements based on their personal information. It permits companies to charge consumers who want to use their products and services, but don’t want their information monetized.
- Give consumers a way to review what personal information a company has about them, learn with whom it has been shared or sold, and to challenge inaccuracies in it.
- Hire 175 more staff to police the largely unregulated market for private data.
- Require companies to assess the algorithms that process consumer data to examine their impact on accuracy, fairness, bias, discrimination, privacy, and security.
Another positive example (creating legislation) comes from Senator Schatz. Quick summary and outline from the senator's web page:
... U.S. Senator Brian Schatz (D-Hawai‘i), the top Democrat on the Senate Communications, Technology, Innovation, and the Internet Subcommittee, led a group of 15 senators in introducing new legislation to protect people’s personal data online. The Data Care Act would require websites, apps, and other online providers to take responsible steps to safeguard personal information and stop the misuse of users’ data.
The Data Care Act establishes reasonable duties that will require providers to protect user data and will prohibit providers from using user data to their detriment:
- Duty of Care – Must reasonably secure individual identifying data and promptly inform users of data breaches that involve sensitive information;
- Duty of Loyalty – May not use individual identifying data in ways that harm users;
- Duty of Confidentiality – Must ensure that the duties of care and loyalty extend to third parties when disclosing, selling, or sharing individual identifying data;
- Federal and State Enforcement – A violation of the duties will be treated as a violation of an FTC rule with fine authority. States may also bring civil enforcement actions, but the FTC can intervene.
- Rulemaking Authority – FTC is granted rulemaking authority to implement the Act.
None of the above have become law yet. However, California has passed a "GDPR lite" (my paraphrasing) privacy bill last June. Some info from NYTimes:
The new law grants consumers the right to know what information companies are collecting about them, why they are collecting that data and with whom they are sharing it. It gives consumers the right to tell companies to delete their information as well as to not sell or share their data. Businesses must still give consumers who opt out the same quality of service.