Privacy experts ‘cautiously optimistic’ about federal bill’s prospects in Congress

The bill is a sweeping piece of legislation that seeks to establish national standards for how tech companies and other businesses use consumers’ personal information.

The move represents significant progress toward codifying consumer data protections federally in the US — something lawmakers have attempted for years to no avail.

Even with widespread support, however, the bill faces a long road ahead.

The bipartisan power of ADPPA

ADPPA is designed to appeal to both Democrats and Republicans in different ways, giving it a greater chance at success.

Historically, conservatives have rallied for a federal data protection bill that preempts state privacy laws — like those found in California, Virginia, Colorado and a handful of other states — in the hopes of simplifying compliance for businesses. On the other hand, the left has traditionally opposed such preemption clauses, arguing that states should be given leeway to enact more stringent privacy laws so long as they don’t interfere directly with federal law.

At the same time, Democrats have long advocated for a private right of action, which allows individual citizens to bring legal action against businesses that violate privacy regulations, while Republicans have opposed such measures. ADPPA includes both state preemption and a private right of action — the balance of which has given the bill more momentum in Congress.

Other significant elements of the bill entail restrictions on data-based tracking and targeted advertising. It would still allow targeted advertising — so long as companies give consumers the right to opt-out of tracking. But it includes new protections for minors and for the use of what’s known as ‘sensitive’ data.

The bill would put new restrictions on targeted advertising to minors under the age of 17. While the Children’s Online Privacy Protection Ruling (COPPA) has long set the standard for children’s data privacy, ADPPA goes further. “The ADPPA would place a greater obligation on social media platforms [to not exploit children’s data] … and would hold large data holders accountable [for knowing or acting] in ‘willful disregard’ of an individual’s age,” says Arielle Garcia, chief privacy officer at advertising agency UM Worldwide. She says this standard is a major departure from the more lax language of COPPA, which she says has “historically created loopholes for publishers, platforms and adtech companies” when it comes to handling children’s data.

In essence, she says, ADPPA aims to empower major tech companies to use their data capabilities for good. “The underlying sentiment,” Garcia says, “is that where social platforms, for example, routinely use their data to infer the age of individuals for their own commercial benefit, they are also well-positioned to do so in the interest of protecting children and teens.”

Further, ADPPA would ban ad targeting based on sensitive data — with an expanded definition of what is considered sensitive, now encompassing certain kinds of demographic and location data. Under ADPPA, sensitive data would also include “information identifying an individual’s online activities over time and across third-party websites or online services” — a move that seeks to limit cross-site tracking (practices that tech giants like Google and Apple are already cracking down on).

The hurdles that remain

Even with bipartisan support and the potential to provide vast new protections for Americans, it’s not all blue skies ahead.

“The ADPPA represents the best chance for a federal privacy law in years,” says Austin Mooney, a global privacy and cybersecurity associate at international law firm McDermott Will & Emery. “But that’s not saying much.”

For one, a number of Democrats have expressed concerns about the bill’s preemption language. Regulators from California — the state with the most comprehensive data privacy protections in place today — expressed wariness this week about the potential that ADPPA could override stricter state-level protections. “I recognize that this law would be an improvement for much of the country, but I can’t say the same for my constituents and all Californians,” said Democrat Anna Eshoo. The state’s attorney general has also raised objections.

Plus, even if the bill passes in the House, a key hurdle to the bill’s success in the Senate lies in converting Senator Maria Cantwell, the top Democrat on the Commerce Committee. A staunch privacy advocate, Cantwell in 2019 introduced a similar data protection bill. But she’s been outspoken about what she sees as faults in ADPPA — which include the limitations of enforceability for the private right of action — and has not yet expressed support for the measure, though her Republican counterpart has.

“Senator Cantwell’s absence on the Senate version of the bill presents a significant obstacle to passage,” says Mooney. “Presumably, she and her staff had ample opportunity to review and negotiate the language before the bill was unveiled, and were unable to agree to a compromise.”

Critics have also expressed concern over the enforcement of ADPPA if it were to be signed into law — an issue that New York’s data privacy bill the SHIELD Act also faced. ADPPA would grant enforcement authority to the US Federal Trade Commission without dedicated any additional resources to doing so, which could make it fundamnetally difficult to crack down on noncompliant organizations.

What’s more, businesses are largely against a federal private right of action like the one outlined in ADPPA, as it puts them at much greater legal risk. “Although businesses are desperate for a federal privacy law that preempts the ever-growing number of unique state privacy laws, they likely will fiercely lobby against the ADPPA so long as it has a private right of action,” predicts Marci Rozen, data security attorney and legal director at DC-based firm ZwillGen.

She says the bill in its current form would be “red meat” for plaintiff’s attorneys, who could potentially bring a class action lawsuit for even minor, inadvertent infringements — “something as small as a broken link to a privacy policy.” As such, it’s likely that the benefits of preemption won’t outweigh the risks of litigation for many businesses.

Assessing ADPPA’s prospects

Many experts agree that, despite the Congressional hurdles sure to come and opposition from businesses, ADPPA still has legs. “I’m cautiously optimistic,” says Walter Harrison, a privacy advocate and chief executive officer at Tapestri, an app that compensates consumers for their anonymized location data.

“This is certainly a pivotal moment, and one that’s been four-plus years in the works.” He points out that a number of events this year — including the reversal of Roe v. Wade, advances in privacy policy in Europe (some of which are fairly controversial) and ongoing changes to big tech’s data practices — have put the spotlight on data privacy and increased pressure on lawmakers to pass federal protections. “It certainly seems to have enough bipartisan support this time around, and no big tech company has launched a public campaign opposing it, which are both positive indicators it could succeed,” he adds.

Others are less optimistic. “In practice,” says ZWillGen’s Rozen, “it’s more likely that both [Democrats and Republicans] will be unsatisfied and demand that [some protections] be stripped out of the final bill, and we will end up at an impasse as has happened for years.”

But regardless of whether ADPPA passes during this legislative session, the bipartisan support behind it — combined with a wave of new state privacy laws set to go into effect next year — indicates that the tides are shifting at a more fundamental, cultural level, according to UM Worldwide’s Garcia. “The inevitability of change,” she says, is upon us.

For more, sign up for The Drum’s daily US newsletter here.