The U.S. Legislature is the closest it has ever been to passing a federal data privacy law with the recent draft of the bipartisan American Data Privacy and Protection Act (ADPPA).

Americans are long overdue for a federal privacy law. While the ADPPA does contain some good policies – particularly for states that don’t already have strong online privacy regulation – the bill in its current form could weaken or even strip away existing privacy protections in states like California which have robust privacy laws.

Here’s what you need to know:

Who does the ADPPA regulate?

The ADPPA broadly applies to organizations and companies operating in the United States, including corporations and nonprofits. The draft bill defines “covered entities'' as anyone who “collects, processes, or transfers covered data and is subject to the Federal Trade Commission Act.” This means big tech giants, like Google, Facebook, and Amazon, that mine sensitive information from millions of Americans would theoretically see unprecedented federal regulations.

First, the good parts about the bill:

• It requires data collection to be as minimal as possible.
• It allows individuals to opt-out of “transfers of covered data,” limiting some forms of targeted marketing.
• It gives users the right to correct inaccuracies and potentially delete personal data collected by “covered entities.”
• It prevents some companies from using contract law to skirt the bill’s regulations.

But the bill falls short on what is needed for robust privacy protections:

• It has a broad preemption provision, which means it would override, and in some cases, roll back, existing state and federal privacy protections, including California’s Consumer Privacy Protection Act.
• It doesn’t provide enough protections for individuals who want to sue companies that violate their privacy rights.
• It has loopholes that would treat some companies as “service providers,” giving them more leeway for collecting data.
• It still broadly allows targeted advertising, which is a major driver of most commercial surveillance.

You can read more about the bill’s restrictions in EFF’s July 24, 2022 blog post about the bill.

What people/organizations in our space are saying about the ADPPA

“Federal privacy laws should not roll back state privacy protections. The ADPPA, as currently written, would override a broad swath of existing state laws and prevent states from future action on those areas, a structure called "preemption." We have expressed disappointment and called on Congress to do better.” –Hayley Tsukayama, senior legislative activist at EFF

“It seems like a good faith effort, but the details will be key. Basically every privacy expert and advocacy group is reading it right now.” –Evan Greer, director of Fight for the Future

“A lot’s being said about the American Data Privacy and Protection Act. But not nearly enough on how it dismantles current privacy laws, including over 50 years of work in California. There’s a reason Big Tech supports it. And it’s not because they care about our rights.” –ACLU of Northern California

What’s next for the ADPPA?

Now that Congress is back from recess, the future of the ADPPA looks uncertain. House Speaker Nancy Pelosi (D-Calif.) announced on Thursday, Sept. 4, 2022 that she is concerned about the bill’s preemption provisions, saying it "does not guarantee the same essential consumer protections as California’s existing privacy laws."

Whether the bill has any hope of moving forward or is simply dead in the water depends on whether some sort of agreement will be reached that – at the very least – softens the preemption provision.

You can read more about the political roadblocks ahead here in the International Association of Privacy Professionals' Sept. 6, 2022 Privacy Advisor post.

What you can do

The ADPPA still hasn’t reached the House floor so there is time to contact your representative and tell them that the bill doesn’t go far enough in protecting your online privacy. We deserve legislation that encourages more robust online privacy protections, not laws that weaken the protections that already exist.