A look at the bipartisan American Data Privacy and Protection Act, which privacy experts say might finally give the US a strong federal data protection law
Momentum is real: a House panel voted 53-2 to advance the bill, an unusually lopsided margin for anything touching tech's core ad business, and privacy experts read it as the closest the US has come to a genuinely strong federal data protection law. Two years later, lawmakers were still at it, posting a draft American Privacy Rights Act with a data broker registry — evidence the legislative push outlived this bill's own news cycle.
First-order effects
Tech companies whose revenue depends on ad targeting face direct constraints on how they collect and use personal data, the exact behavior the House panel vote put in scope.
Consumers immediately gain two levers the bill writes into law: an opt-out of targeted advertising and a private right of action against companies that improperly sell their data.
Second-order effects
Ad-funded platforms would need to rebuild targeting around provably consented data, shifting competitive advantage toward firms whose first-party collection survives the stricter rules.
The private right of action converts privacy violations into litigation exposure, raising compliance costs across the ecosystem and creating demand for audit and privacy-engineering services.
Third-order effects
If the pattern holds, a single federal statute displaces the state-by-state patchwork that made 'strong federal data protection' the long-sought fix, standardizing obligations nationwide.
The succession from ADPPA to the American Privacy Rights Act draft points to iterative lawmaking: each failed or superseded bill ratchets the baseline of consumer rights — broker registries, opt-outs, lawsuits — higher for the next attempt.
The trend: US privacy policy is moving from industry-drafted proposals toward comprehensive federal legislation, with each successive bill widening consumer rights over how their data is collected and sold.
🧵Here's a story of how far we have come on privacy regulations - and how far we still have to go. Most countries have baseline privacy laws that set minimum standards for data use. We do not. Most countries have data protection agencies that enforce privacy laws. We do not. /1
And the biggest catch: ADPPA pre-empts nearly all state privacy laws including California's landmark law. (The author's home state law - Illinois's Biometric privacy act, is carved out however). /9 https://www.ilga.gov/...
EFF is disappointed by the latest draft of the American Data Privacy Protection Act, or the ADPPA, a federal comprehensive data privacy bill. While we are still digesting the 132-page version released yesterday, we have three initial objections. https://www.eff.org/...
Recently, other states have been rushing to pass privacy laws as well, many of them weaker than the California law and heavily influenced by the tech industry. /6 https://themarkup.org/...
The California law established the nation's first-ever data protection agency called the California Privacy Protection agency. It launched last year with guaranteed funding of $10 million a year. /4 https://www.nytimes.com/...
Smart and informative thread on where we are with California privacy law about to be enforced and federal privacy bills speeding through Congress. https://twitter.com/...
Is it worth shutting down the US's first ever-privacy enforcement agency for a law that may be difficult to vigorously enforce? And why do we have to choose? What we decide matters when women's reproductive health is being newly criminalized - and privacy is a necessity. /end
The unique thing about the California privacy law is that because it was passed by ballot initiative, the California legislature cannot weaken the law or cut the agency's funding. This is a unique situation that doesn't exist anywhere else. /5 https://www.caprivacy.org/...
All this action has created momentum for a federal privacy law- finally! This week, the House @energycommerce committee marked up a federal privacy bill known as #ADPPA. It is much stronger than anything the Obama Administration could have dreamed of. /7
Ten years ago, the Obama Administration called for some fairly weak privacy standards in a Privacy Bill of Rights. But it satisfied neither industry or critics and was dead on arrival. /2 https://www.theatlantic.com/ ...
Excellent thread by @JuliaAngwin re: challenges, trade offs in federal privacy bill. Pre-empting CA law & enforcement mechanism is a bad idea; otherwise, the bill is an improvement in 49 states. Unfortunately, key elements of surveillance capitalism are untouched by bill. https:/…
But there's a catch: ADPPA doesn't set up or fund an agency to enforce the rules. It has no statutory fines and turns enforcement over to the FTC which is chronically underfunded and has limited fining authority.
In addition to baseline privacy requirements, it requires companies to assess whether their algorithms are discriminatory - and to fix them. It also allows individuals to sue companies directly for damages from privacy violations, with some limitations. /8 https://www.wired.com/.…
If you are not following developments with the American Data and Privacy Protection Act (ADPPA), drop everything and read up on it immediately. The bill was recently amended and may advance to the House floor for a vote. Good overview here: https://www.jdsupra.com/...
Congress is closer than ever before to federal privacy legislation. The #ADPPA passed put of committee 53-2. Next step is the full House, and we'll see if Sen. Cantwell will have an answer in the Senate. https://techpolicy.press/...
The ADPPA “isn't perfect,” as we heard members of Congress say repeatedly during yesterday's @EnergyCommerce markup. But it's still surprisingly good. @GiladEdelman with the clearest dissection of the big federal privacy bill here: https://www.wired.com/...
“...the most distinctive feature of the new bill is that it focuses on what's known as data minimization. Generally, companies would only be allowed to collect and make use of user data if it's necessary for one of 17 permitted purposes...” About time. https://www.wired.com/...
“The universal opt-out requirement is nice, but it won't mean much until the largest browsers, especially Chrome and Safari, add the feature.” #privacy Congress Might Pass an Actually Good Privacy Bill https://www.wired.com/...