Most Americans have done it countless times: Sign up for a new online service, encounter a terms and conditions agreement (with eyes glazing over a wall of text), then click the “accept” button.
Hitting that button gives companies enormous power to gather information and use it as they see fit—often to create detailed, lucrative advertising profiles about users. Most consumers can’t exercise control over that data later or seek legal damages for violations of privacy.
Members of Congress want to change that. Despite little optimism about collaborating on major bills in such a divided atmosphere, lawmakers think they can work together on a comprehensive federal privacy law. And they have backing from the White House: President Joe Biden urged lawmakers to advance new privacy protections during his State of the Union address last month.
For decades, lawmakers have debated the merits of national privacy protections—but they have struggled to agree on how far such legislation should go and, in recent years, whether it should override existing state privacy laws.
What’s especially striking this year is the consensus that already exists in the House. Lawmakers advanced a sweeping privacy protection package, the American Data Privacy and Protection Act, out of the House Energy and Commerce Committee last summer with a vote of 53-2. That bill would broadly block providers from collecting, using, or transferring data beyond what is reasonably necessary to provide their services. It would also introduce explicit consent requirements for transferring sensitive consumer data to third parties, as well as disclosure rules for companies that make such data available to the authoritarian governments of China, Russia, Iran, or North Korea.
The bill also outlines consumer rights to access, correct, and delete their data, and it bans targeted advertising to people under age 17. You can read more details about the bill in this helpful Congressional Research Service report.
Members of the House Energy and Commerce Committee have spent the start of this Congress making the case for the legislation and signaling their plans to hammer out a version of it that can become law. One of the panel’s subcommittees held a hearing on the matter this week—the second in a series of three—where members and witnesses discussed the benefits of national privacy standards.
“We simply cannot go another Congress without passing comprehensive privacy legislation,” said Rep. Frank Pallone Jr., the New Jersey Democrat who chaired the committee in the last Congress and a lead sponsor of the House privacy bill.
But Sen. Maria Cantwell, who chairs the Senate panel that deals with consumer privacy issues, has criticized the proposal’s delayed rollout of its private right of action provisions. Two years after enactment, the bill would empower individuals and groups to sue entities for privacy violations, seeking damages, injunctions, litigation costs, and attorney’s fees. Cantwell wants to see that change go into effect immediately. She told The Dispatch last month she hopes the two chambers can reach consensus this year.
Critics have also expressed concerns about the legislation’s preemption of state laws (it would preempt most, but not all state laws). The House bill is stronger than provisions in most states, but some have comprehensive consumer privacy laws in place or are debating such laws, raising questions about conflicting with the potential federal version. The main bill in question is California’s 2018 Consumer Privacy Act, which granted consumers the right to know information that businesses have collected or sold about them, the right to opt out of sales of their personal information, and the ability to request deletion of information collected about them.
California Gov. Gavin Newsom and California Attorney General Rob Bonta sent a letter to Congress this week arguing against preemption of state privacy laws.
“The path forward to a robust data privacy law is one that sets a federal floor, not a ceiling, to allow states to continue to innovate and be nimble in protecting their residents,” they wrote.
If lawmakers can’t reach an agreement on a broader bill, this Congress could still advance some piecemeal privacy measures. My colleague Price reported last week about a push for standalone legislation protecting children online. Bills like that could see consideration this year.
And the House overwhelmingly passed a privacy bill this week requiring device manufacturers to disclose if their products contain cameras or microphones. It’s a real problem: Google faced backlash in 2019 when consumers learned its Nest home security devices had microphones, a feature the company didn’t disclose at first. Cantwell and Sen. Ted Cruz, the top Republican on the Senate Commerce, Science, and Transportation Committee, have introduced a companion version in their chamber, so it has a good chance of becoming law.
Still, advocates would see it as a missed opportunity if lawmakers don’t forge ahead with a broader package. Jessica Rich, an attorney who worked for more than two decades at the Federal Trade Commission, testified before the House panel on Wednesday that a comprehensive federal privacy law would protect consumers across jurisdictions and “clarify what privacy rights they should expect and demand as they navigate the marketplace.”
“Businesses—especially small and medium sized ones—need to know what the rules are without having to spend millions of dollars on attorneys and overly complex compliance schemes,” she added. “We have just the opposite now—a rolling wave of new and disparate privacy laws that confuse everyone and require an armada of experts to interpret.”
Please note that we at The Dispatch hold ourselves, our work, and our commenters to a higher standard than other places on the internet. We welcome comments that foster genuine debate or discussion—including comments critical of us or our work—but responses that include ad hominem attacks on fellow Dispatch members or are intended to stoke fear and anger may be moderated.