Ash Johnson
Ash Johnson is a senior policy manager at ITIF, specializing in Internet policy issues including privacy, security, platform regulation, e-government, and accessibility for people with disabilities. Her insights appear in numerous prominent media outlets such as TIME, The Washington Post, NPR, BBC, and Bloomberg.
Previously, Johnson worked at Software.org: the BSA Foundation, focusing on diversity in the tech industry and STEM education. She holds a master’s degree in security policy from The George Washington University and a bachelor’s degree in sociology from Brigham Young University.
Recent Publications
Congress’ Age Verification Proposals Are Flawed in Different Ways
Age verification isn't a silver bullet for protecting kids online. Congress' competing proposals each solve some problems while creating others, underscoring the need for a balanced national approach.
Comparing Recent Federal Data Privacy Bills
As Congress considers a national data privacy standard, the SECURE Data Act represents a significant shift from earlier proposals. This comparison examines how it differs from the American Privacy Rights Act and the American Data Privacy and Protection Act and why those differences matter for consumers, businesses, and innovation.
Waiting for a Better Congress on Data Privacy Won't Work
Waiting for the next Congress is the wrong approach. Because neither party can pass a federal privacy law without bipartisan support, lawmakers should build on the SECURE Data Act's bipartisan, state-tested framework to enact a national privacy law that protects consumers and the economy.
Comments to Office of the Privacy Commissioner of Canada Regarding Online Age Assurance
Age assurance should not become a default prerequisite for accessing the Internet, but it can still hold a place in a comprehensive approach to children’s online safety.
UK’s Latest Online Safety Proposal Would Further Erode Privacy and Free Speech
The UK is considering new requirements for nudity-scanning software on children's devices that would further expand its controversial online safety regime. While intended to protect children, the proposal would undermine privacy, anonymity, and free speech, and the UK should instead pursue more targeted, privacy-preserving measures.
Amicus Brief to the Supreme Court of the United States in the Case of NetChoice & CCIA v. Paxton
ITIF supports applicants seeking to vacate a Fifth Circuit stay that allowed Texas Attorney General Ken Paxton to immediately enforce Texas’s App Store Accountability Act, a law requiring app stores to implement age-verification and parental consent restrictions.
The State of Privacy: Lessons From State Laws for a National Framework
The United States’ patchwork approach to privacy is unworkable in the long term. But that patchwork is already here, and Congress can learn from the policies states have implemented to craft a national data privacy framework.
Comments to the UK’s Department for Science, Innovation, & Technology Regarding Growing Up in the Online World
The UK should resist the urge to regulate in haste. Protecting children online is essential, but protection should mean smarter design, stronger safety tools, and greater parental control, not blanket bans that remove technology from young people and choice from families.
State Privacy Laws Show the SECURE Data Act’s Merits and Political Appeal
Critics say the SECURE Data Act is a unified Republican effort. Yet its core provisions mirror privacy protections passed by Democratic and Republican majorities in 21 states. So, while it would preempt state laws, it also draws heavily from those laws, reflecting a bipartisan, multistate consensus on how to protect consumers while enabling innovation.
State Laws Are Creating a Fragmented Digital Market for Americans
A New Mexico ruling against Meta highlights how the growing patchwork of state digital regulations could fragment the U.S. internet by forcing companies to restrict or withdraw online services in certain states, underscoring the need for Congress to establish a unified federal digital policy framework.
AI and Kids’ Safety Need Separate Solutions, Not New Problems
The TRUMP AMERICA AI Act combines AI regulation with children’s online safety legislation in a single bill, creating overbroad, ill-suited policies that increase compliance burdens and ultimately weaken both innovation and effective protection of minors. These issues should be addressed separately with targeted approaches.
App Stores Shouldn’t Have to Parent the Internet
App store–level age verification laws pose privacy, security, and free-speech risks while leaving websites unregulated, whereas device-level, opt-in parental controls offer a more comprehensive and safer way to protect children online.
Recent Events and Presentations
The New Push for a National Data Privacy Standard
Watch now for an expert panel discussion on the current state of federal privacy negotiations and the path forward for Congress.
The State of State Privacy
Watch now for an expert panel discussion examining how the rapid growth of state privacy laws is influencing the debate over federal privacy legislation.
Tech Policy 202: Spring 2026 Educational Seminar Series for Congressional and Federal Staff
ITIF’s spring seminar course explores core emerging technologies and issues that are reshaping our world and, in the process, creating public policy challenges and opportunities. The course is open to congressional and federal staff only.
Tech Policy 101: Fall 2025 Educational Seminar Series for Congressional and Federal Staff
ITIF’s fall seminar course will explore core emerging technologies that are reshaping our world and the public policy challenges and opportunities influencing their development and application. The course is open to congressional and federal staff only.
The Future of Online Safety for Kids: Legislative Changes on the Horizon
Ash Johnson speaks about children's online safety at an event hosted by the Congressional Internet Caucus Academy.
Tech Policy 202: Spring 2025 Educational Seminar Series for Congressional and Federal Staff
ITIF’s spring seminar course explores core emerging technologies and issues that are reshaping our world and, in the process, creating public policy challenges and opportunities. The course is open to congressional and federal staff only.
The Conservative Weaponization of Government Against Tech
Watch now for a panel discussion exploring how anti-tech conservatives would weaponize the government against technology, the legitimacy of conservatives’ anti-tech arguments, and the implications of their proposals for society.
Social Media and the First Amendment
Watch now for an expert panel discussion exploring the intersection between digital policy issues and the First Amendment, the free speech implications of proposals to address online problems, and how lawmakers could address these problems without infringing on users' or companies' speech rights.
Children on Social Media and the Multistate Lawsuit Against Meta
Watch now for a panel discussion on the facts of the case, the claims against Meta, and how this lawsuit fits into the broader discussion over content moderation, privacy, children’s safety, and the responsibilities of social media platforms.
Age Verification Tech for Social Media: Exploring the Opportunities and Pitfalls
Watch now for the panel dsicussion focusing on age verification technology for social media, AI age estimation, and current capabilities and limitations that policymakers should consider when crafting legislation designed to protect children.
AI, Education and Children’s Privacy Concerns
Gillian Diebold and Ashley Johnson moderate discussions about AI and education and children’s privacy concerns with emerging technology at the Children’s Advertising Review Unit (CARU) Annual Conference, hosted by BBB National Programs.
Big Tech & Speech Summit: The Fragility of Section 230
Ashley Johnson speaks at the Big Tech & Speech Summit, an exclusive forum addressing the red-hot controversies impacting Big Tech in Washington.

