Introduction Taxpayers who elect to itemize their deductions may reduce their federal income tax liability by claiming a deduction for certain state and local taxes paid, often called the "SALT deduction." The 2017 tax revision (commonly referred to as the Tax Cuts and Jobs Act, TCJA; P.L. 115-97 ) established a temporary $10,000 limit, or "SALT cap," on annual SALT deduction claims. By limiting the amount of the SALT deduction, the SALT cap increases the tax liability of certain taxpayers, which increases federal tax revenues relative to what otherwise would have been collected without a limitation in place. The SALT cap's effect on tax liability varies significantly with taxpayer income and with state and local tax rates. A number of bills introduced in the 116 th Congress would modify the SALT cap, and federal regulatory efforts responding to related state and local government activity are ongoing. This report discusses the SALT cap's features, analyzes its potential impact, and summarizes recent legislation and regulatory action to modify the cap. Cap Mechanics and Revenue Effects Under current law, taxpayers itemizing deductions (in lieu of claiming the standard deduction) may reduce their taxable income by claiming the SALT deduction for certain state and local taxes paid during the tax year. The state and local taxes eligible for the SALT deduction are income taxes, sales taxes (claimed in lieu of income taxes), personal property taxes, and certain real property taxes not paid in the carrying on of a trade or business. For taxpayers who would have itemized deductions without access to the SALT deduction, it generates tax savings equal to the amount deducted multiplied by the taxpayer's marginal income tax rate. For example, a taxpayer with $20,000 of eligible state and local taxes and a top marginal tax rate of 35% would save $7,000 from the SALT deduction (i.e., $20,000*0.35). For taxpayers who would have claimed the standard deduction without access to the SALT deduction, it generates tax savings equal to the difference between their tax liability if they had claimed the standard deduction and their total tax liability with itemized deductions (inclusive of the SALT deduction). (Throughout this report, the tax savings attributable to the SALT deduction is also referred to as the benefit from the deduction.) The TCJA established a temporary SALT cap for tax years 2018 through 2025. The SALT cap is set at $10,000 for single taxpayers or married couples filing jointly and $5,000 for married taxpayers filing separately. By limiting the SALT deduction available to certain taxpayers, the SALT cap decreases the tax savings associated with the deduction relative to prior law, thereby increasing federal revenues. The TCJA also changed a number of tax code features (e.g., standard deduction amounts, marginal tax rates) that indirectly affect SALT deduction eligibility and the value of the tax savings it generates. The TCJA roughly doubled the standard deduction and limited other itemized deductions. The TCJA also prohibited SALT deduction claims on taxes paid on foreign real property for tax years 2018 through 2025. The SALT cap, the increased value of the standard deduction, and other tax changes enacted by the TCJA have reduced the number of taxpayers claiming the SALT deduction and the total tax savings from those claims. Table 1 shows the most recent estimates of reductions in federal revenues attributable to the SALT deduction for FY2017, the last full year before enactment of P.L. 115-97 , and FY2019 through FY2023. Revenue losses from the SALT deduction in FY2017 ($100.9 billion) nearly equaled the total losses projected from FY2019 through FY2023 ($117.2 billion). The Joint Committee on Taxation (JCT) projects that 16.4 million taxpayers will claim a SALT deduction for tax year 2019, compared to 46.6 million taxpayers who the Internal Revenue Service (IRS) reported claiming the deduction in 2017. Recent research has estimated the SALT cap's effect on SALT deduction claims independent of other tax changes enacted through the TCJA. A 2019 Treasury Inspector General report examined the SALT cap's hypothetical effect had it been imposed in tax year 2017, prior to the other TCJA changes taking effect. The report found that the cap would have reduced SALT deduction benefits for 10.9 million taxpayers (about 25% of all households claiming the deduction) and reduced deduction amounts by $323 billion, or just over half of the actual amounts deducted in that year. In June 2019, JCT estimated that holding all other portions of the tax code constant, repealing the SALT cap for tax year 2018 would decrease FY2019 federal revenues by $77.4 billion. Effects on State and Local Governments The SALT deduction provides state and local governments with an increased ability to levy taxes by reducing the after-tax cost of state and local taxes to taxpayers. By limiting the deduction's benefits, the SALT cap increases the cost (or "price") of state and local taxes for affected taxpayers. For example, consider a taxpayer with itemized deductions, a 35% marginal tax rate, and $20,000 in eligible SALT payments. Without a SALT cap in place, the net price of those taxes for the taxpayer would be $13,000 (or $20,000*[1-0.35]), as the taxpayer can use all $20,000 of those tax payments to reduce federal tax liability. When a $10,000 SALT cap is imposed, the final price of those taxes rises to $16,500 (or $10,000 + [$10,000*(1-0.35)]). The basic economic law of demandâthere is an inverse relationship between the price of a good and the quantity demandedâsuggests that by increasing the price of state and local taxes, a SALT cap would lead to a decline in demand for state and local government activity. The size of the decrease would be a function of the sensitivity of public desire for state and local services, paid for by taxes, to changes in the price of those services (i.e., the elasticity of demand). Research has found indications that state and local governments respond to federal tax changes with shifts in their own tax and spending practices. Response to the SALT cap could be a function of its salience , that is, the public awareness of its effect on tax liability. SALT cap salience may depend on awareness of the state and local taxes themselves, which can vary significantly across tax system features. Salience for taxpayers who take the standard deduction, but who would be better off itemizing deductions if not for the SALT cap, may be particularly low, as the SALT cap's effects may not be apparent in tax filing software. Taxpayers could also have difficulty differentiating SALT cap-related liability changes from other changes enacted through the TCJA. State and local governments are generally limited in their ability to respond to shifts in demand for government services with changes in fiscal outcomes (i.e., increased deficits or reduced surpluses). Unlike the federal government, which has no enforceable balanced-budget requirement, most state and local governments are statutorily required to balance operating revenues and operating expenses over a one-year or two-year period. Governments with a binding balanced-budget requirement would therefore need to match any reduction in SALT revenue resulting from the cap with a reduction in spending on services provided or increases in other revenue sources. Distributional Effects This section explores features of localities and households that are likely to influence the distribution and intensity of SALT cap effects on tax liability. The recent enactment and implementation of the SALT cap means that tax return data on its impact by state, locality, and income level are currently unavailable. However, analyzing the SALT deduction's distribution prior to the cap's imposition can provide insight into its likely impact. The data indicate that the SALT cap's effects will vary significantly across state and local jurisdictions and household income. Distribution Across States and Congressional Districts The SALT cap's effect is in part a function of state and local tax policies. For example, greater effective rates levied on taxes that qualify for the deduction (income taxes, general sales taxes, real and personal property taxes) would increase the amount of SALT-eligible tax payments and therefore increase the probability that a taxpayer will have SALT deductions that exceed the cap. State and local tax rates could thus affect both the number of taxpayers with higher tax liability from the SALT cap (sometimes referred to as SALT cap exposure) and the amount of those increases (sometimes referred to as the SALT cap burden). Differences in local incomes and price levels are another determinant of the SALT cap's effect. Wages and prices are the bases against which state and local governments levy SALT-eligible income, sales, and property taxes. Consider two households that are in separate localities and have different incomes but the same tax rates and the same purchasing power. In other words, adjusting for their local price levels, each household is able to purchase the same sets of goods and services. Although each household faces the same set of purchasing options on the public and private markets, the household facing higher price levels is more likely to have SALT payments in excess of the SALT cap. State and local governments raised a combined $1.30 trillion in individual income taxes, general sales taxes, and property taxes in 2017, an average of about $8,500 per federal income taxpayer. Those revenues are divided almost evenly between state governments ($667 billion in revenues), which collected the majority of the income and sales taxes, and local governments ($632 billion), which collected the majority of property taxes. There is considerable geographic variation in the rates at which taxes are levied and in the incomes and prices to which those taxes apply. Figure 1 shows effective state and local tax rates for all SALT-eligible taxes in each state, calculated as the percentage of total adjusted gross income paid in-state and local general sales taxes, individual income taxes, and property taxes. In 2017, New York (17.2% effective tax rate), Washington, DC (16.9%), Hawaii (16.1%), Maine (15.0%), and Nebraska (14.2%) had the highest combined effective state and local tax rates. Delaware (6.8%), Alaska (7.6%), Florida (7.7%), New Hampshire (8.3%) and Tennessee (8.4%) had the lowest combined tax rates. All else equal, states with higher SALT-eligible effective tax rates are likely to experience greater SALT cap effects on tax liability than states with lower rates. Figure 2 plots the average SALT deduction amount for each 2017 congressional district (districts are from the 115 th Congress). The districts with the 20 highest average SALT deductions are located in states with above-average effective tax rates in Figure 1 , including New York, California, Connecticut, and New Jersey. Nineteen of the districts with the 20 lowest average SALT deductions are located in Florida, Texas, Tennessee, Alabama, Nevada, Arizona, and Alaska, all states with below-average effective state and local tax rates. Figure 2 shows the potential significance of local tax and economic activity on the SALT cap's effects. Figure 3 adds a layer of analysis by plotting two variables on each congressional district: (1) average adjusted gross income (AGI) of taxpayers and (2) average effective SALT rates. Each district categorized as having low effective SALT rates in Figure 3 had an average AGI below $75,000, and 13 of these districts had average AGI below $50,000. Nineteen of the 20 districts with the highest effective SALT rates had an average AGI above $100,000, and four of the top five districts had an average AGI above $200,000. The distribution of SALT deductions across household income is discussed further in the next section. Figure 3 demonstrates the importance of considering both tax rates and the tax base when examining potential SALT cap effects. Distribution Across Income Levels As with other tax deductions, SALT deduction benefits accrue more for higher-income taxpayers than lower-income taxpayers. Two factors explain this pattern: (1) higher incomes directly lead to more state and local income taxes and are correlated with higher sales and property tax payments stemming from greater consumption; and (2) taxpayers with higher incomes are subject to higher marginal tax rates, so each dollar deducted from tax liability results in greater tax savings. Table 2 shows the JCT projections of SALT benefits by income class in tax years 2017 (the last year before the TCJA took effect) and 2019. Taxpayers with more than $100,000 of AGI received the vast majority of SALT benefits in both 2017 (93%) and 2019 (89%). Taxpayers with income between $50,000 and $200,000 received a larger share of total benefits in 2019 (44%) than 2017 (29%), whereas the opposite trend occurs for taxpayers with more than $200,000 (declining from 71% to 56%). Taxpayers with less than $50,000 received relatively little benefit from the SALT deduction in both years. Data from Table 2 suggest that the SALT cap increased the federal tax burden of high-income taxpayers. This occurs because the SALT cap (1) reduced the number of taxpayers claiming the SALT deduction, who disproportionately fell in higher income classes; and (2) reduced SALT benefit levels of taxpayers with more than $10,000 in SALT payments, who were particularly likely to have high levels of income. JCT estimated that were the SALT cap eliminated in tax year 2019, more than half of the additional tax benefits would have been claimed by taxpayers with incomes exceeding $1 million. The SALT cap's total effect on the combined federal, state, and local tax burden across income levels will depend on the state and local government response to the SALT cap, which is uncertain. Figure 4 plots the percentage of all tax returns, the percentage of returns claiming SALT deductions, and the percentage of SALT deduction amounts claimed across income levels in tax year 2017, the latest year for which data are available. (The amount of SALT deduction claimed reflects the dollars deducted and not the tax savings associated with the deduction.) Tax returns with AGI exceeding $1 million represented less than 1% of all tax returns, but claimed over 25% of all SALT deduction amounts. Tax returns with over $100,000 in AGI claimed more than 78% of the SALT deduction amounts claimed, while returns with AGI below $50,000 claimed less than 10% of that total. The composition of state and local taxes also affects the SALT cap's ultimate effect on taxpayers within a local jurisdiction. Table 3 illustrates how SALT cap burden distribution can differ when the composition of state and local taxes changes while holding total tax revenue constant. In both jurisdictions, total tax revenues are $44,000. In Jurisdiction I, relatively high income tax rates generate higher income tax payments, and the SALT cap burden falls on Tax Units A and B, the taxpayers with higher incomes. In Jurisdiction II, property tax rates are higher than income tax rates, and the SALT cap burden instead falls on Tax Units A and C, the taxpayers with high property values. More of the state and local tax revenue in Jurisdiction II is above the SALT cap, meaning that taxpayers in Jurisdiction II are able to deduct less in SALT deductions on their federal income tax returns. This analysis highlights the importance of state and local tax structure in determining the SALT cap's effect on taxpayer liability even when holding the average level of taxes constant. State Responses to the SALT Cap The state and local response to the SALT cap's effect has varied across municipalities. Certain governments in states with relatively high mean SALT deduction values (see Figure 1 ) have either enacted legislation that would appear to make tax changes to reduce the SALT cap's effect on their taxpayers or taken legal action against the federal government. Recent federal and legal responses to some of these actions suggest these efforts will likely be unsuccessful. State and local governments with relatively lower levels of SALT cap exposure have taken little to no action. Following enactment of the TCJA, several state governments made changes to their tax codes with the potential to lower their residents' SALT cap exposure. Certain states enacted laws that provided taxpayers a credit against state taxes for charitable donations to state entities, which would then be eligible for the federal charitable deduction under Section 170 of the Internal Revenue Code. The IRS has since issued a final ruling limiting the availability of Section 170 charitable deductions in such a way that would render the new charitable activity ineligible. A legislative proposal that would overturn IRS regulations, S.J.Res. 50 , was rejected by the Senate in October 2019. Some states have tried to use a "pass-through work around" to reduce the SALT cap's impact on some of their taxpayers with pass-through business income. Many types of businesses that do not pay corporate income taxes (including S corporations and partnerships) pass through income to their owners, who pay taxes on that income at the individual level. The SALT cap does not limit SALT deductions associated with the carrying on of a trade or business. Hence, taxpayers whose SALT tax payments are associated with pass-through business income may not be subject to the SALT cap in the same manner as other individual income tax payments. Certain state governments have adjusted for this activity by enacting laws that levy or raise taxes on the pass-through business entity itself that are offset (holding total tax rates constant) by tax reductions or tax credits applied to individual income liability for pass-through business members subject to the tax increase . The IRS has not issued guidance on the viability of such legislation or its effect on SALT cap exposure. Several states also took legal action related to the SALT cap following enactment of the TCJA, filing suit against the U.S. government in July 2018 and challenging the cap's constitutionality. A September 2019 federal district court ruling upheld the SALT cap's constitutionality, asserting that it did not unconstitutionally penalize certain jurisdictions. Legislation in the 116th Congress Legislation introduced in the 116 th Congress would modify the SALT cap, including proposals that would (1) repeal the SALT cap entirely; (2) increase the SALT cap's value for all taxpayers; (3) increase the SALT cap's value for some taxpayers; (4) make the SALT cap permanent; and (5) repeal IRS regulations affecting SALT cap liability. Table 4 displays legislation in the 116 th Congress that would directly modify the SALT cap.


Introduction Technological convergence, in general, refers to the trend or phenomenon where two or more independent technologies integrate and form a new outcome. One example is the smartphone. A smartphone integrates several independent technologies—such as telephone, computer, camera, music player, television (TV), and geolocating and navigation tool—into a single device. The smartphone has become its own, identifiable category of technology. Currently, over 35% of the global population are smartphone users and over 3 billion active devices are in circulation. In the United States, about 80% of the U.S. population are smartphone users, and over 280 million active devices are in circulation. The technological convergence has resulted in establishing a new and prominent smartphone industry sector, worth over $350 billion globally, according to some estimates. Technological convergence may present a range of issues where Congress may take legislative and/or oversight actions. Three selected issue areas associated with technological convergence are regulatory jurisdiction, digital privacy, and data security. First, merging and integrating multiple technologies from distinct functional categories into one converged technology may pose challenges to defining regulatory policies, roles, and responsibilities. Determining oversight jurisdictions and regulatory authorities for converged technologies may become complicated as the boundaries that once separated single-function technologies are blended together. In other words, delineating which policy authorizes which government agency to apply which standards to regulate which industry is no longer simple and straightforward. How Congress chooses to oversee certain industries and government agencies may also become complicated due to converging technologies that blur and blend existing categorical boundaries. Second, digital privacy concerns stem from converged technologies' collection and usage of personal and machine data. Technological convergence facilitates increasing consumption and collection of data, which poses potential digital privacy concerns for consumers. Data collection and usage are tied to digital privacy issues because a piece or aggregation of information could identify an individual or reveal patterns in their activities. Converged technologies leverage large volumes of data to try to improve the user experience by generating more tailored and anticipatory results. This data can also potentially be used to identify, locate, track, and monitor an individual without the person's knowledge. The same data can potentially be sold to third-party entities without an individual's awareness. As the use of converged technologies continues to propagate, digital privacy issues will likely remain central to the policy debate. Third, data security concerns are often associated with smart devices. As devices are able to interconnect, the convenient ubiquitous features may create vulnerabilities that could be exploited by malicious actors. Data security, a component of cybersecurity, protects data from unauthorized access and use. Along with digital privacy, data security is a pertinent issue for converged technologies, which generate and consume large volumes of data. Technological convergence poses three potential data security concerns: increased number of access points susceptible to cyberattacks, linkage to physical security, and theft of data. The first section of this report describes technological convergence along with closely associated media convergence and network convergence. The report uses the Internet of Things (IoT) and smart home devices as primary examples. Of these three convergences, consumers most often directly engage with converged technologies. In contrast, general consumers may not have the same level of engagement or understanding of media and network convergences, as they often occur in the background. The second section of this report presents regulatory, digital privacy, and data security issues pertaining to technological convergence. The current state, challenges, and recent legislative activities are discussed. The third section of this report concludes with potential considerations for Congress. An overarching consideration for regulatory, digital privacy, and data security issues may be determining the role, if any, of the federal government in an environment where technological evolution changes quickly and continues to disrupt existing frameworks. Policies governing these three issues—regulations, digital privacy, and data security—may be of interest to Congress as well as other stakeholders, including U.S. government agencies, commercial entities, and the general public. Description of Technological Convergence "Technological convergence" is a concept whereby merging, blending, integration, and transformation of independent technologies leads to a completely new converged technology. This broad, complex concept encompasses a wide range of technologies, including IoT and smart home devices. When a converged technology emerges, it often replaces single-function technologies or renders them obsolete. In this sense, technological convergence can be viewed as a progression or evolution of technology. A discussion of technological convergence in isolation is difficult because technological convergence is closely associated with media convergence and network convergence. Technological, media, and network convergences are interdependent, but each possesses subtle distinctions. These three terms are often used interchangeably, further complicating the discussion of an already complex topic. Figure 1 illustrates relationships between technological, media, and network convergences. Technological convergence : This occurs when the functions of different technologies are merged and interoperate as a single unit. A converged unit can typically process multiple types of media that correspond to each technology that merged. Technological convergence includes devices and systems that interface with end users. For example, a user interacts with converged devices, such as a smart television (TV), to access the contents that are distributed over a network. A smart TV has combined the functions of a traditional TV, a computer, and several other devices that used to have one specific purpose. In addition to displaying over-the-air broadcast TV channels, smart TVs interface with users to surf the internet, view photos taken from smartphones and stored in the "cloud," display feeds from home security cameras connected to a network, play music, notify users of incoming calls and messages, and allow video teleconferencing. Smart TVs can process a variety of formats of media to perform multiple functions. Media convergence : This refers to content that is made available through multiple forms, formats, and access points. Media convergence proliferated as analog mediums of communication became digitized. For example, the contents on a newspaper used to be available only in print. The same content is currently available in both print and digital forms, as text, visual, and/or audio formats, and through multiple devices and platforms including social media. Network convergence : This refers to a single network infrastructure that handles and distributes multiple types of media. Network convergence became prominent when telecommunications and information networks integrated; it became prevalent when mobile cellular communications incorporated access to the internet and made it widespread. For example, today's cable companies process information in forms of voice, video, and data on a single network and often offer their services as a bundle package (e.g., phone, television, and internet services). Similarly, cellular networks, which distribute information to and from mobile devices and fixed platforms, process voice, video, and data. Prior to network, media, and technological convergences, a separate, independent network was dedicated to handling and distributing one particular type of media that was processed by a single-function device. For example, a telephone network distributed audio information (i.e., voice) between telephone handsets. A broadcasting network delivered video to television sets. Convergence removes such pairing (i.e., "decouples") between media, network, and device. Decoupling gives convergence its versatility, flexibility, and complexity. Characteristics of Smart Devices Many technological convergence devices are called "smart" devices, which often include IoT devices. (Examples of IoT devices are discussed in following sections.) Despite a wide range of applications, smart converged technologies share key characteristics: Smart devices can execute multiple functions to serve blended purposes; Smart devices can collect and use data in various formats and employ machine learning algorithms to deliver optimized and enhanced user experience; and Smart devices are connected to a network directly and/or are interconnected with other smart devices, offering ubiquitous access to users from anywhere on any platform. These key characteristics may present potential policy questions for Congress, including the following: Who will provide oversight and how will regulatory authorities be applied to technologies that serve multiple functions or that do not belong to an established category? How should consumer data be collected and used to protect digital privacy without limiting technology innovation? How to shape data security practices to safeguard personal information and physical security from malicious actors? An Overview of Internet of Things The IoT is a common example of technological convergence. The IoT is a system of devices that are connected to a network and each other, exchanging data without necessarily requiring human-to-human or human-to-computer interaction. In other words, IoT is a collection of electronic devices that can share information among themselves (e.g., smart home devices). The IoT possess all three characteristics of converged technologies: multiple functions, data collection and use, and ubiquitous access. Various categories of IoT include industrial Internet of Things, Internet of Medical Things, smart city infrastructures, and smart home devices. IoT industry is a growing market both globally and in the United States. According to some estimates, in 2018, the IoT retail market in the United States was almost $4 billion, and over 700 million consumer IoT devices were in use in 2017 in the United States. Figure 2 illustrates global revenue of the IoT from 2012 to 2018, according to Statista, a company that consolidates statistical data, based on information from IC Insights. In 2018, consumer IoT devices, such as wearable and connected smart home devices, generated over $14 billion globally. The connected cities category, or smart cities, was the largest (41%) of 2018 global IoT revenue. The industrial Internet of Things, such as smart factories, had the biggest growth in terms of global revenue between 2017 and 2018 among the different categories of the IoT. An estimate of various IoT markets by McKinsey also shows the industrial IoT as potentially increasing the most by 2025 compared to other IoT systems. The development, application, and usage of IoT will likely continue to grow with Fifth-Generation (5G) Technologies cellular service, which will allow a larger number of devices to be connected simultaneously to a network, supporting not only consumer but industrial use of IoT devices and systems. IoT devices are used in many different fields and serve a variety of functions. The IoT encompasses a broad range of applications. Selected categories of IoT devices are discussed below. Industrial Internet of Things (IIoT): Examples of commercial application of the IoT can be found in the manufacturing industry. Referred to as industrial Internet of Things (IIoT), networked machines in a production facility can communicate and share information to improve efficiency, productivity, and performance. The application of IIoT can vary significantly, from detecting corrosion inside a refinery pipe to providing real-time production data. Also, IIoTs can enable a variety of industries, such as manufacturing, chemicals, food and beverage, automotive, and steel, to transform their operations and potentially yield financial benefits. Currently in North America, there are more consumer IoT connections than IIoT connections, but this may change in the future. Incorporation of IIoT and analytics is considered by some as the Fourth Industrial Revolution (4IR). Internet of Medical Things (IoMT): Some experts project the use of Internet of Medical Things (IoMT) is increasing. IoMT devices, such as heart monitors and pace makers, collect and send a patient's health statistics over various networks to healthcare providers for monitoring, remote configuration, and preventions. In 2017, over 300 million IoT devices in the medical sector were connected worldwide, and, in 2018, over 400 million devices were connected. At a personal health level, wearable IoT devices, such as smart watches and fitness trackers, can track a user's physical activities, basic vitals, and sleeping patterns. In 2017, over 40 million fitness tracker IoT were in use in the United States. Smart Cities: IoT devices and systems in transportation, utilities, and infrastructure sectors may be grouped under the category of "smart city." An example of utilities IoT in a smart city is "smart" grid and meters for electricity, water, and gas where sensors collect and share customer usage data to enable the central control system to optimize production and distribution to meet demand real-time. An example of transportation IoT in a smart city is fare readers and status trackers or locaters that interface across all public transportation platforms. Columbus, OH's winning proposal for the Department of Transportation's (DOT) Smart City Challenge of 2016, included connected infrastructure that interacts with vehicles, trip planning and common payment system across multiple transit system, and electric autonomous vehicles and shuttles. Other finalists of the DoT Smart City Challenge were Austin, TX; Denver, CO; Kansas City, MO; Pittsburgh, PA; Portland, OR; and San Francisco, CA. Smart cities is currently the largest segment of IoT in terms of revenue. Smart Home: Consumer product IoT devices used in homes and buildings are often grouped under the "smart home" category. Included in this categories are smart appliances, smart TV, smart entertainment systems, smart thermostats, and network-connected light bulbs, outlets, door locks, door bells, and home security systems. These smart home IoT devices are connected to a single network and can be controlled remotely over the internet. Eight of 11 categories of consumer IoT devices used in 2017 were related to smart home. In 2018, the size of the global smart home market was estimated to be over $30 billion. An Example: Smart Home A smart home contains a collection of consumer IoT devices intended for personal use where user experience is improved by connecting various features of a house to a network. For example, smart home IoT devices may be interconnected to each other and to a central control system for a home with voice interface, often referred to as a virtual assistant. Commonly known examples of virtual assistants are Amazon's Alexa, Apple's Siri, Google Assistant, Microsoft's Cortana, and Samsung's Bixby. A virtual assistant is a platform that can manage and relay information to smart home devices based on user-established criteria. Moreover, a smart home may have a doorbell with a video camera and a speaker that allows a user to see who is at the door and to speak to the person at the door from anywhere over the internet. A smart home may have a smart door lock that can be locked and unlocked remotely. In addition, the thermostat, lights, electrical outlets, and appliances in a smart home may be remotely controlled by a user over the internet. A smart appliance, such as a smart refrigerator that is networked, can use its sensors to identify items and can notify a user based on set criteria, such as restocking alerts or suggested recipes. Some smart home devices resemble traditional devices, but with cross-over functions or networking abilities. Examples include smart lightbulbs, smart electrical outlet plugs, smart TV, and smart appliances. Some smart home devices are establishing a new category of industry segment that did not exist previously. An example is Amazon's Echo products with virtual assistant Alexa as voice user interface. Whether it is the former (evolutionary technologies) or the latter (new/revolutionary technologies), the smart home industry is fast emerging and growing. Smart home devices, which are a type of IoT, possess the three characteristics of converged technologies: multiple or blended functions, collection and use of data, and ubiquitous access through network connection. Thus, potential policy interests associated with technological convergence can be also observed in smart home devices. Potential smart home issues for Congress include the following. Congress may decide it is necessary to resolve oversight jurisdictions and regulatory authorities of smart home devices, especially for products like virtual assistants, which may not belong to an established category of technology. The mission of the Federal Trade Commission (FTC) includes both protecting consumers and promoting business competition. Congress may choose to review the FTC's current authorities to ensure that they are sufficient to oversee emerging smart home technologies. In addition, potentially deconflicting or harmonizing jurisdictions may be discussed if other federal government organizations and their mission are impacted by emerging smart home technologies. Congress may decide that new or expanded policies are necessary to protect consumer digital privacy, including personal data that are collected and used by smart home devices, such as a smart TV, in private spaces, such as a user's home. Although the FTC does promote a level of digital privacy through its consumer protection authorities, emerging digital privacy issues are linked to practices that are legal as opposed to fraud, theft, or other malicious activities. Congress may examine whether a federal law that comprehensively addresses personal digital privacy is necessary or an expansion of the FTC's consumer data protection authorities is required. Emerging smart home technologies may further necessitate safeguarding data from malicious actors. In addition to collecting and using personal data, smart home devices bridge physical security and cybersecurity. Malicious actors may have more means to exploit a user's information and home through smart home devices, which offer ubiquitous access as a key convenience feature. Whether current policies adequately addresses data, cyber, and physical security concerns may also be considered. Selected Issues Associated with Technological Convergence Regulation, digital privacy, and data security are three selected issues associated with technological convergence that may be of interest to many stakeholders, including Congress. As identified in the smart home example in the previous section, each of these three issues is discussed further in subsequent subsections. The three selected issues are tied to the three characteristics of converged technologies discussed previously in the " Characteristics of Smart Devices " section. First, convergence of technologies blend and blur existing categorical distinctions for each technology because a converged technology can perform multiple functions. Second, technological convergence consumes, collects, and generates a large volume of both personal and machine data. Third, converged technologies allow ubiquitous access points to the end users. These characteristics are typically observed as a result of decoupling the devices from media and network. Regulatory Issues Congress may consider policies that address blending standards and boundaries as converged technologies and companies merge and replace traditionally independent and distinct categories. Policy issues may include oversight jurisdictions, regulatory authorities, and commercial competitiveness since a converged technology could fall within multiple domains. An example may be delineating the Federal Communications and Commission's (FCC) and the FTC's authorities on convergence technologies as more devices and services become mobile and wirelessly connected. Merging and integrating multiple technologies from distinct functional categories into one converged technology pose challenges to regulatory policies and responsibilities. Determining oversight jurisdictions and regulatory authorities for converged technologies becomes unclear as the boundaries that once separated single-function technologies blend and blur together. A challenge for policymakers may be in delineating which government agency and which policies and standards would best apply to certain technologies or certain industries. Where there were once clear lines of authority by industry or media type (e.g., voice, video, data), they are no longer simple and straightforward for technologies where these functionalities have converged. How Congress oversees which industries and government agencies may become complicated due to converging technologies that blend existing categorical boundaries. Congress may decide that it is necessary for specific legislative committees to effectively oversee a converged technology that serves multiple functions. As a result, the alignment of converged technologies to regulatory authorities may shift as technologies evolve. The complexities in setting regulatory jurisdiction can be further subdivided into regulating converging technologies and regulating evolving technology companies . They are discussed below. Regulating Converging Technologies Regulating a converging technology, which is a result of blending or integrating multiple technologies, can be challenging. This is because (1) the one-to-one relationship between a converging technology and a regulatory entity is no longer clear, and (2) a converging technology may create a new sector where a regulatory entity has not been identified. Initially, the standards and oversight policies for a specific technology were established independently. They were not necessarily developed with merging or interoperability in mind. For example, telephony (when providing voice), cable TV (when providing video), and mobile cellular technologies each follow their respective standards, and these services were regulated by policies specific to each type. When a converged technology utilizes differing communications technologies, it may be required to adhere to multiple standards and regulations. In such cases, multiple agencies may need to regulate a single converged technology. This may require extended timelines for regulatory reviews. Industry may incur additional costs to meet standards and reporting requirements for converged technologies. In other situations, as technologies converge, the outcome may yield a completely new technology for which a regulatory category did not previously exist. Examples include social media, IoTs, and virtual assistants. Without a clear regulatory and oversight framework in place, new converged technologies may be left unregulated, partially regulated, or regulated under a newly developed framework. They could also be left to self-regulate by the industry; or they could be overlooked as governing bodies remain indeterminate on which jurisdictional boundaries need to be stretched to cover emerging technology fields. Regulating Evolving Companies Regulating companies that offer converged technologies is challenging because the services and product lines evolve and expand such that they do not fall within a single category. Although diversification is considered normal business practice, technological convergence broadens the operational range for companies, spanning multiple industry sectors. Antitrust concerns could arise, or companies may not be subjected to the same level of oversight and regulation due to lack of classification. For example, companies such as Amazon, Apple, and Google each offer smart home devices and platforms. Some of these devices, such as a smart doorbell with a video camera, smart doors and locks, and networked contact sensors and video cameras, may function as home security devices. Many of these products are bundled as a starting kit for home security. However, these technology convergence companies may not be required to follow state and local regulations as traditional home security companies that provide monitored security service do. Another example discussed widely in Congress is social media—whether social media companies should be classified as information technology companies, as advertising and marketing firms, as communications platforms, or as the press. As converged technologies and associated companies straddle or fall between jurisdictional boundaries, regulatory roles and responsibilities become more complex. Digital Privacy Issues Congress may be interested in digital privacy concerns of converged technologies, which often collect and use personal information and machine data as they directly interface with end-users. Current federal laws protect certain types of data pertaining to privacy by specifying collection, storage, use, and dissemination practices. As converged technologies generate and innovatively leverage more types and volumes of data that can identify, locate, or track a person, consumer concerns for protecting digital privacy may intensify. Technological convergence facilitates increased consumption and collection of data, posing potential digital privacy concerns for consumers. Data collection and usage are tied to digital privacy issues because a piece or aggregation of information could identify an individual or reveal patterns in their activities. Converged technologies leverage large volumes of data to try to improve the user experience by generating more tailored and anticipatory results. However, such data can potentially identify, locate, track, and monitor an individual without the person's knowledge. As the use of converged technologies continues to propagate, digital privacy issues will likely remain central. Current Data Protection Laws While a federal law that comprehensively addresses digital privacy does not currently exist, many laws are in place to protect certain types of data and their impact on specific aspects of privacy. Current U.S. data protection laws include the following, as taken from CRS Report R45631, Data Protection Law: An Overview : Gramm-Leach-Bliley Act (GLBA): The GLBA imposes several data protection obligations on financial institutions. These obligations are centered on a category of data called "consumer" "nonpublic personal information" (NPI), and generally relate to: (1) sharing NPI with third parties, (2) providing privacy notices to consumers, and (3) security NPI from unauthorized access. Health Insurance Portability and Accountability Act (HIPAA): Under the HIPAA, the Department of Health and Human Services (HHS) has enacted regulations protecting a category of medical information called "protected health information" (PHI). These regulations apply to health care providers, health plans, and health care clearinghouses (covered entities), as well as certain "business associates" of such entities. The HIPAA regulations generally speak to covered entities': (1) using or sharing of PHI, (2) disclosure of information to consumers, (3) safeguards for securing PHI, and (4) notification of consumers following a breach of PHI. Fair Credit Reporting Act (FCRA): The FCRA covers the collection and use of information bearing on a consumer's creditworthiness. FCRA and its implementing regulations govern the activities of three categories of entities: (1) credit reporting agencies (CRAs), (2) entities furnishing information to CRAs (furnishers), and (3) individuals who use credit reports issued by CRAs (users). In contrast to HIPAA or GLBA, there are no privacy provisions in FCRA requiring entities to provide notice to a consumer or to obtain his opt-in or opt-out consent before collecting or disclosing the consumer's data to third parties. FCRA further has no data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access. Rather, FCRA's requirements generally focus on ensuring that the consumer information reported by CRAs and furnishers is accurate and that it is used only for certain permissible purposes. The Communications Act : The Communications Act of 1934 (Communications Act or Act), as amended, established the Federal Communications Commission (FCC) and provides a "comprehensive scheme" for the regulations of interstate communication. [T]he Communications Act includes data protection provisions applicable to common carriers, cable operators, and satellite carriers. Video Privacy Protection Act (VPPA): The VPPA was enacted in 1988 in order to "preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials." The VPPA does not have any data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access. However, it does have privacy provisions restricting when covered entities can share certain consumer information. Specifically, the VPPA prohibits "video tape service providers"—a term that includes both digital video streaming services and brick-and-mortar video rental stores—from knowingly disclosing [personally identifiable information] (PII) concerning any "consumer" without that consumer's opt-in consent. The VPPA does not empower any federal agency to enforce violations or the Act and there are no criminal penalties for violations, but it does provide for a private right of action for persons aggrieved by the Act. Family Educational Rights and Privacy Act (FERPA): The FERPA creates privacy protections for student education records. "Education records" are defined broadly to generally include any "materials which contain information directly related to a student" and are "maintained by an educational agency or institution." FERPA defines an "educational agency of institution" to include "any public or private agency or institution which is the recipient of funds under any applicable program." FERPA generally requires that any "educational agency or institution" (i.e., covered entities) give parents or, depending on their age, the student (1) control over the disclosure of the student's educational records, (2) an opportunity to review those records, and (3) an opportunity to challenge them as inaccurate. Federal Securities Laws : While federal securities statutes and regulations do not explicitly address data protection, two requirements under these laws have implications for how companies prevent and respond to data breaches. First, federal securities laws may require companies to adopt controls designed to protect against data breaches. Second, federal securities laws may require companies to discuss data breaches when making required disclosures under securities laws. Children's Online Privacy Protection Act (COPPA): The COPPA and the FTC's implementing regulations regulate the online collection and use of children's information. Specifically, COPPA's requirements apply to: (1) any "operator" of a website or online service that is "directed to children," or (2) any operator that has any "actual knowledge that it is collecting personal information from a child" (i.e., covered operators). Covered operators must comply with various requirements regarding data collection and use, privacy policy notifications, and data security. Electronic Communications Privacy Act (ECPA): The ECPA was enacted in 1986, and is composed of three acts: the Wiretap Act, the Stored Communications Act (SCA), and the Pen Register Act. Much of ECPA is directed at law enforcement, providing "Fourth Amendment like privacy protections" to electronic communications. However, "ECPA's three acts also contain privacy obligations relevant to non-governmental actors. ECPA is perhaps the most compressive federal law on electronic privacy, as it is not sector-specific, and many of its provisions apply to a wide range of private and public actors. Nevertheless, its impact on online privacy has been limited. As some commentators have observed, ECPA "was designed to regulate wiretapping and electronic snooping rather than commercial data gathering," and litigants attempting to apply ECPA to online data collection have generally been unsuccessful. Computer Fraud and Abuse Act (CFAA): The CFAA was originally intended as a computer hacking statute and is centrally concerned with prohibiting unauthorized intrusions into computers, rather than addressing other data protection issues such as the collection or use of data. Specifically, the CFAA imposes liability when a person "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains… information from any protected computer." A "protected computer" is broadly defined as any computer used in or affecting interstate commerce or communications, functionally allowing the statute to apply to any computer that is connected to the internet. Federal Trade Commission Act (FTC Act): The FTC Act has emerged as a critical law relevant to data privacy and security. As some commentators have noted, the FTC has used its authority under the Act to become the "go-to agency for privacy," effectively filling in gaps left by the aforementioned federal statutes. While the FTC Act was originally enacted in 1914 to strengthen competition law, the 1938 Wheeler-Lea amendment revised Section 5 of the Act to prohibit a broad range of unscrupulous or misleading practices harmful to consumers. The Act gives the FTC jurisdiction over most individuals and entities, although there are several exemptions. For instance, the FTC Act exempts common carriers, nonprofits, and financial institutions such as banks, savings and loan institutions, and federal credit unions. Consumer Financial Protection Act (CFPA): Similar to the FTC Act, the CFPA prohibits covered entities from engaging in certain unfair, deceptive, or abusive acts. Enacted in 2010 as Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, the CFPA created the Consumer Financial Protection Bureau (CFPB) as an independent agency within the Federal Reserve System. The Act gives the CFPB certain "organic" authorities, including the authority to take any action to prevent any "covered person" from "committing or engaging in an unfair, deceptive, or abusive act or practice" (UDAAP) in connection with offering or providing a "consumer financial product or service." State laws, such as California Consumer Privacy Act (CCPA), and international laws, such as European Union's General Data Protection Regulations (GDPR), aim to provide a comprehensive guidance on digital privacy. The FTC Act and the Clayton Act are the primary statutes that give the FTC investigative, law enforcement, and litigating authority to protect consumers and promote competition (i.e., antitrust). The FTC "has enforcement or administrative responsibilities under more than 70 laws." The FTC's consumer protection mission currently focuses more on data security issues—such as identity theft, violation of Do Not Call or Do Not Track, and deceptive advertising—than digital privacy concerns associated with lawful activities. While consumer protection and digital privacy are increasingly becoming synonymous, consumer protection law alone may not provide sufficient jurisdiction and authority to encompass digital privacy and data security issues for all data on all devices. Data Privacy and Data Security Digital privacy discussions often involve two closely associated topics: data privacy and data security. Data privacy is the governing of data collection, use, and sharing. Data security is protection of data from unauthorized or malicious actors. These two topics often differ in the lawfulness of activities, the intended use of data, and the effect on an individual. Data security is an aspect of cybersecurity more so than privacy. Data security defends against illicit activities such as theft of data. Data security practices include proactive measures against cyber-attacks and responsive measures such as sending notifications to affected individuals upon a data breach. Data security issues typically involve actors whose intents are malicious, who carry out unlawful activities, and use data in ways that harm an individual. Examples include breaking into a database or sending spear phishing emails to steal identity and financial information. Stolen identity and financial information are often exploited, causing financial damage to individuals and businesses. Privacy implications arise when personal information is compromised during a data security incident. D ata privacy practices determine how and to what extent data are collected, used, and with whom the data are shared. Data privacy sets the scope for control of personal information—this may include data ownership and responsibilities of involved entities. Data privacy issues typically arise from lawful activities, but personal information may have been collected, used, or shared beyond given permission or awareness of an individual. The process or results may reveal aspects of an individual that were unexpected. Examples of data privacy issues include mobile apps and websites collecting and using an individual's online activity and location data to suggest targeted ads. In general, such activities are a lawful commercial marketing strategy, from which the customers may benefit in forms of enhanced user experience and discounts. But, these activities become an issue when they lack transparency (i.e., when customers are not aware of what information is collected on them, who shares the information with whom, and how the information is used and for what purpose). Individuals may experience that their rights to privacy have been violated when aggregation of information reveals highly targeted information that an individual did not anticipate. Key aspects of data privacy—such as data collection, storage, sharing, access, and use—are not defined for digital data that are often leveraged by convergent technologies. These key aspects are defined only for certain types of information, such as medical and financial, where federal laws are in place. Similar guidance is limited or not available for other personal data, such as the following: Geolocation data collected by apps; Contact information and other user-generated content on social media; Video recordings made by smart home IoT devices; Voice recordings made by virtual assistants; and Vitals and health data collected by fitness tracking wearable IoT devices. Committees in both the House and the Senate of the 115 th Congress held several hearings where technology companies were present as witnesses. Over a dozen bills were introduced in the 115 th Congress to address various aspects of data privacy and security; but, none became a law. Committees in both the House and the Senate of the 116 th Congress have already held multiple hearings on privacy. Several bills were introduced by the 116 th Congress to address data privacy concerns as they relate to technological convergence. These bills include the following: H.R. 1282 (Representative Bobby Rush), introduced on February 14, 2019, as the Data Accountability and Trust Act, would "require certain entities who collect and maintain personal information of individuals to secure such information and to provide notice to such individuals in the case of a breach of security involving such information…." This bill would define the term personal information; outline special requirements for information brokers; and assign specific responsibilities to the FTC to regulate commercial entities' data security policies and procedures for using and protecting personal information. S. 142 (Senator Marco Rubio), introduced on January 16, 2019, as the American Data Dissemination (ADD) Act of 2019, would "impose privacy requirements on providers of internet services similar to the requirement imposed on Federal agencies under the Privacy Act of 1974." This bill would require the FTC to submit recommendations for privacy requirements for internet service providers. S. 189 (Senator Amy Klobuchar), introduced on January 17, 2019, as the Social Media Privacy Protection and Consumer Rights Act of 2019, would "protect the privacy of users of social media and other online platforms." This bill would require commercial entities with an online platform to clearly disclose their practices for personal data collection and use prior to obtaining user consents. This bill also outlines enforcement of privacy requirements by the FTC and the attorney general of each state. S. 583 (Senator Catherine Cortez Masto), introduced on February 27, 2019, as the Digital Accountability and Transparency to Advance (DATA) Privacy Act, would provide "digital accountability and transparency." This bill would require commercial entities to clearly disclose its privacy practices for various collected data. This bill also would require the FTC to enforce privacy practices to ensure that the minimum requirements are satisfied. Data Brokers According to the FTC, data brokers are companies that collect consumers' personal information and resell or share that information with others. Data brokers collect personal information about consumers from a wide range of sources and provide it for a variety of purposes, including verifying an individual's identity, marking products, and detecting fraud. Because these companies generally never interact with consumers, consumers are often unaware of their existence, much less the variety of practices in which they engage. The FTC classifies data brokers into three categories: 1. Entities subject to the FCRA; 2. Entities that maintain data for marketing purposes; and 3. Non-FCRA covered entities that maintain data for non-marketing purposes that fall outside of the FCRA. The FCRA governs the activities of credit reporting agencies, such as Equifax, Experian, and TransUnion; entities furnishing information to credit reporting agencies; and individuals who use credit reports issued by credit reporting agencies. These entities subjected to the FCRA fall within the first of the three categories of data brokers listed above. However, the FCRA does not have privacy or data security provisions. Regarding the second and third categories of data brokers, the FTC report notes that "while the FCRA addresses a number of critical transparency issues associated with companies that sell data for credit, employment, and insurance purposes, data brokers within the other two categories remain opaque." Data brokerage companies include Acxiom, Cambridge Analytica, Corelogic, Datalogix, Epsilon, Exactis, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future in addition to the "big three" credit reporting agencies (Equifax, Experian, and TransUnion). Many data brokers, which are conducting lawful activities, are self-regulated. As depicted in Figure 3 , data brokerage companies purchase and aggregate information from various sources, which are also self-regulated. These sources include app developers, websites, and social media. As technological convergence continues to proliferate, more data will likely be generated and consumed. Aggregations of seemingly simple and benign pieces of data when examined together could expose highly personal aspects in detail. Data brokers and entities that collect data could significantly impact digital privacy especially if individuals remain unaware of activities pertaining to their personal data. Data Security Issues Congress may be interested in data and physical security aspects of converged technologies because ubiquitous access equates to more possible entry points for both authorized and unauthorized users. This is often referred to as increase in attack surface. As more converged devices become connected to each other and to the internet, the overall impact of a compromise increases, along with the possibility of a cascading effect of a cyberattack. In policies, the requirements and responsibilities of data protection may be addressed separately from privacy concerns associated with legal use of personal data. Data security, a component of cybersecurity, protects data from unauthorized access and use. Along with digital privacy, data security is a pertinent issue to technological convergence, which generates and consumes large volumes of data. Technological convergence poses a number of different types of potential data security concerns, including the following: potentially increased number of access points susceptible to cyberattacks, linkage to physical security, and theft of data. Increased connectivity generally translates to increased risk of cyberattack. Converged technologies, such as IoT devices, offer the users ubiquitous access: access from anywhere, at any time, using any device. While this is an extremely convenient characteristic, it also poses cybersecurity concerns. Multiple access points equate to increased points or opportunities for potential exploitation by malicious actors. This is often described as increased attack vectors, or broadening attack surface, which is a sum of attack vectors. The same entry points a user may use for remote access can be exploited by an adversary to steal personal information. From the data security perspective, this is a tradeoff to consider between convenience and vulnerability. Cybersecurity and physical security are directly linked through converged technologies. For example, when smart doors and smart locks are remotely controlled by a malicious actor through cyberattack, the physical security of that building also becomes compromised. The damage may not be limited to loss of digital content or information. Loss of personal data stored in the compromised location as well as personal security could be in jeopardy. Potential loss or theft of personal data may be a data security concern for converged technologies because IoT devices often do not employ strong encryption at the device or user interface level. Not implementing strong encryption may be intentional due to associated benefits—it usually keeps the cost low, increases battery life of devices, minimizes memory requirements, reduces device size, and is easier to use or implement. This means, not only is the attack vector increased, but a system is also easier to break into. IoT devices may be the most vulnerable points of a system targeted by malicious actors for exploitation. Some experts note that IoT security currently lacks critical elements such as end-to-end security solutions, common security standards across the IoT industry, and customers' willingness to pay additional cost for enhanced security. Congressional Considerations for Technological Convergence With relatively few policies in place for specifically overseeing technological convergence, Congress may consider potential policy options to address the issues discussed in this report. The fundamental policy considerations to identifying options may be determining the role, if any, of the federal government in overseeing technological convergence, digital privacy, and data security. Regulatory Considerations Regulating technological convergence may entail policies for jurisdictional deconfliction, harmonization, and expansion to address blended or new categories of technology. Currently, aspects of converged technologies may be regulated by different agencies based on the individual technologies that compose the convergence, but not as a whole. Regulating a converged technology as a whole can also be challenging because the combinations of technologies may generate too many possible outcomes. When converged technologies establish a new domain and fall outside of existing regulatory jurisdictions, they are often left to self-regulate. Congress and the Administration could take a number of approaches in regulating technological convergence. Three potential approaches are discussed here. First, the federal government could continue to allow industry to self-regulate, especially where technology evolves quickly. This may promote innovative space, but relies on the industry to exercise responsible and accountable practices. Second, Congress and the Administration could maintain current regulatory jurisdiction but leverage a deconfliction or harmonization policy so that convergent technologies are regulated under one primary authority instead of potentially multiple authorities. Preserving existing regulatory jurisdiction may require minimal restructuring and allow relatively short timeline for implementation. While a deconfliction or harmonization policy could increase coordination, overlaying such policy on an existing regulatory framework may not present the most efficient process. Third, the Administration could consider expanding regulatory jurisdictions and authorities to include new and emerging convergent technologies that are self-regulated. This may require a complete overhaul of the technology regulatory framework, requiring congressional action and a relatively lengthy adaptation timeline for the affected industries. Some could also view such actions as extensive regulation that stifles innovation and commercial growth. On the other hand, this approach could present an opportunity to update policies on par with technology progressions and posture for emerging capabilities. Digital Privacy Considerations Federal data protection laws currently in place apply to specific types of data and have varied privacy and data security provisions. A federal law that comprehensively addresses digital privacy for all types of data is not in place. While illegal use of personal information (such as identity theft and fraud) is defined and enforced by federal agencies, legal use of data generated by users or converged technologies (such as social media and IoT) is not regulated to the same extent. Transparency into the activities of legal data brokers and collectors is limited. Congress may choose to define the role of the federal government overseeing digital privacy by introducing new comprehensive federal law(s) and/or by determining minimal required standards of digital privacy. An alternative option could be expanding existing digital privacy authorities. This could include deciding whether federal entities, such as the FTC, should have their rulemaking abilities clarified or expanded. An expanded or new federal digital privacy policy may require a variety of decisions by Congress. Two of many potential decisions pertaining to federal digital privacy policy are determining how data privacy and data security could be addressed legislatively and determining whether various types, or categories, of personal data should be treated equally or differently under varied guidance. Data Security Considerations Data security, as it pertains to technological convergence, may impact both the cyber and physical fronts. Some of the federal data protection laws currently in place have data security provisions, though they vary and may be focused predominantly on the cyber-aspect. This also means that different data security protocols apply to different types of data. For instance, the guidance for notifying users when personal data gets compromised is different for health, financial, and location data. Similar to the digital privacy considerations, Congress could begin by determining whether overarching legislation for data security is necessary. Congress may consider new legislation explicitly addressing data security concerns pertaining to technological convergence. Or, Congress may consider new legislation to expand existing cybersecurity missions to address data security issues. Data security is often considered as a component of cybersecurity, but protection of the data is equally important as safeguarding a network or a system. As with any security challenge, finding the right balance between convenience and security measures is a key component of an effective security policy. A data security policy that predominantly focuses on security measures to address potential vulnerabilities created by converged technologies could negate convenient features and beneficial capabilities, such as ubiquitous access, offered by the converged technologies. On the other hand, allowing maximum accessibility without a security measure exposes both the data and the system to risks. Not having an updated data security policy relies on existing cybersecurity measures to address potential vulnerabilities introduced by technological convergence. Congress may determine whether data privacy and data security should be addressed in one policy. Data privacy and data security are linked and complementary, especially for digital information. While two coupled topics could be addressed in a single policy, data privacy and data security are two distinct issues. Having separate complementary policies could potentially focus more clearly on specific aspects of each issue.