Sweeping bipartisan comprehensive data privacy bill to be introduced by congressional leaders

A comprehensive data privacy bill unveiled Sunday would offer historic privacy protections and appears to have momentum on both sides of the aisle.

The sweeping bill envisioned by Sen. Maria Cantwell (D-WA) and Rep. Cathy McMorris Rodgers (R-WA) elevates privacy to a consumer right, preempts a patchwork of state laws that have been friendly to big tech and gives Americans the right to stop the transfer and sale of their data, the legislators said in a joint statement.

The newly unveiled bill would supersede McMorris Rodgers’ prior attempt at comprehensive data privacy legislation, the American Data Privacy and Protection Act (ADPPA), which has been stalled in committee.

The bill benefits from its origins with longtime Congressional leaders. Cantwell chairs the Senate Committee on Commerce, Science and Transportation and McMorris Rodgers leads the House Energy and Commerce Committee.

If passed, the bill also would force companies to minimize the data they can gather, store and use about people regardless of their age, requiring firms to only collect data needed to provide the product or service at hand. The legislation also allows people to opt out of data processing if a company updates privacy terms.

The bill would safeguard sensitive data by requiring affirmative and explicit consent before it can be transferred to a third party such as a data broker and allows people to opt out of targeted advertising, according to a draft of the legislation.

If the sweeping bicameral, bipartisan legislation is enacted it would become the first comprehensive national law to protect consumers’ data, would all but put data brokers out of business and would fundamentally change the practices of large tech platforms such as Google and Meta by gutting their targeted advertising business models. 

Critically, the bill includes a private right of action, which allows people to sue companies which violate their privacy rights instead of having to rely on overburdened state attorneys general offices to act. It also requires firms to let people see, correct, erase and export their data. 

The legislation also would establish a new data privacy-focused bureau at the Federal Trade Commission, which has recently shown new aggression in pursuing data privacy violations, particularly involving the sale of geolocation data.

Concerns over how comprehensive data privacy laws might impact small business has been a key concern for opponents of such bills in the past. Small businesses not peddling customers’ personal information are not regulated under the bill, a press release sent by McMorris Rodgers and Cantwell on Sunday said.

On Saturday, Maryland passed the strongest data privacy bill in the country, signaling the intensifying focus on the issue by both citizens and legislators. 

Members of Congress have long expressed worry about the way tech behemoths use personal data but have never been able to push legislation across the finish line.

"This landmark legislation gives Americans the right to control where their information goes and who can sell it,” McMorris Rodgers and Cantwell said in their joint statement. “It reins in Big Tech by prohibiting them from tracking, predicting, and manipulating people’s behaviors for profit without their knowledge and consent.”

Previous comprehensive data privacy legislation spearheaded by McMorris Rodgers passed out of the House Energy and Commerce Committee with a 53-2 bipartisan vote in July 2022 but was never brought to the floor for a vote. In September 2022, House Speaker Nancy Pelosi (D-CA) issued a press release expressing concern over how the bill would undermine California’s pioneering comprehensive data privacy law.

Privacy advocates cheered news of a second effort to achieve comprehensive data privacy for all Americans. 

“We’re encouraged to see news of this new bipartisan privacy bill from two key leaders,” a statement released by the Center for Democracy and Technology, an advocacy group that lobbies for digital rights, said. “The need for a comprehensive federal privacy law grows more urgent by the day.”

But a second privacy advocate, Cody Venzke, senior policy counsel at the ACLU, raised questions about how the bill will preempt existing privacy law.

“Without adequate privacy protections, both private and state actors can co-opt technology to surveil us and intrude on our private lives; however, we remain concerned this bill's broad preemption of state laws will freeze our ability to respond to evolving challenges posed by technology,” Venzke said in a statement. 

He added that the ACLU is eager to work with Cantwell and McMorris Rodgers to “strengthen the bill's protections for privacy and civil rights and to ensure state and local governments can adapt to the ever-dynamic technological landscape.”