WASHINGTON (AP) — Lawmakers in Washington have unveiled a landmark proposal that would grant consumers unprecedented control over their personal data, marking a significant step towards national online privacy protections. The bipartisan agreement, negotiated by Senate Commerce Committee Chair Maria Cantwell (D-Wash.) and House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-Wash.), represents a breakthrough in the long-standing congressional debate on data privacy.
The proposed legislation, known as the American Privacy Rights Act, aims to establish a national standard for how tech companies like Google, Meta, and TikTok collect, use, and transfer data on the internet. It would grant users the right to opt out of certain data practices, including targeted advertising, and require companies to collect only the necessary information to provide specific products. Moreover, individuals would have the ability to access, delete, and transport their own data between digital services.
One significant aspect of the agreement is its resolution of the contentious issues of federal preemption and consumer lawsuits. The bill would override state privacy laws while allowing state regulations on targeted issues such as health or financial data. Additionally, it includes a provision for civil lawsuits, allowing individuals to seek financial damages if companies fail to fulfill data deletion requests or obtain consent before collecting sensitive data.
Senate Commerce Committee Chair Cantwell expressed the importance of “catching bad actors and policing the information age,” highlighting the need to set clear boundaries. The full details of the proposal were made public on Sunday. The legislation, currently in the discussion draft stage, will undergo input from other lawmakers and outside groups before formal introduction.
Despite the promising development, the passage of comprehensive privacy legislation faces uncertainty. The narrow window before the November elections presents a time constraint, particularly because McMorris Rodgers is set to retire from Congress in January. However, both Chairs are determined to meet the deadline and move forward with urgency.
Congress has held numerous hearings on data privacy in recent years but has not yet enacted a comprehensive privacy law. The previous Congress had proposed a privacy bill, which was met with opposition from key leaders due to concerns over enforcement and privacy disputes resolution. Privacy talks resumed when Cantwell and McMorris Rodgers renewed negotiations directly.
The new legislation builds on the previous House proposal, incorporating provisions such as data minimization, disclosure, and the prohibition of data discrimination. However, key differences include the absence of a delay on individual lawsuits and the limitation of arbitration agreements.
The proposal exempts companies with less than $40 million in annual revenue from its requirements while imposing additional obligations on larger data holders. It does not address the issue of targeting minors with ads or establish a youth privacy division at the Federal Trade Commission.
This comprehensive privacy compromise aligns with other bills on child safety and privacy expected to be addressed in the Senate. It terminates the Federal Trade Commission’s ongoing privacy regulation efforts and largely transfers privacy oversight in the telecommunications sector to the FTC.
The introduction of the proposed legislation comes amidst a surge in new internet policies. Several bills on child safety and privacy have gained support, and there is momentum for legislation to address the TikTok issue and data brokers selling user information.
Lawmakers aim to attach the child privacy and safety bills to an upcoming must-pass legislative package and plan to consider the House data broker bill. However, the support of minority leaders and state leaders affected by the federal preemption remains uncertain.
Lawmakers see comprehensive policy as the desired outcome as long as it is strong and thorough. The introduction of the American Privacy Rights Act marks a significant step towards that goal.