Federal privacy legislation update: the American Privacy Rights Act (APRA)

"Sen. Maria Cantwell, a Democrat who chairs the Senate Commerce Committee, and Rep. Cathy McMorris Rodgers, a Spokane Republican who leads the House Energy and Commerce Committee, have appeared at odds on data privacy since introducing competing legislation in recent years. But in interviews on Sunday, the two women said they have a compromise bill that can get to President Joe Biden’s desk before McMorris Rodgers leaves Congress at the end of the year."

– Cantwell, McMorris Rodgers strike bipartisan deal on landmark data privacy bill, by Orion Donovan Smith in the Spokane Spokesman-Review (CMR's hometown paper)

Big news in DC: a new bipartisan, bicameral proposal for a "compromise" federal privacy bill, the American Privacy Rights Act (APRA). The press release has a summary, and links off to a section-by-section analysis and the full text of the discussion draft. At this point, take it all with a grain of salt; in 2022, the initial draft of the bill was promising, but it got weakened substantially by the subcommittee and then weakened further by the committee.

In 2022, California's delegation opposed it because it preempted California's state privacy law (which was stronger in some key areas), Cantwell criticised the previous proposal as too weak in several important areas, and  Pelosi didn't bring it to the House floor.  The discussion draft of APRA still preempts California's law (as well as other state consumer privacy laws), although Cantwell says it incorporates some key points of legislation from California, Illinois, and Washington, so it looks like that was enough to get her on board.

Writing for IAPP, Jed Bracy calls it a "surprise development", but tbh I've been expecting this for a while.  Congress wants to do something to show they're listening to people's concerns about privacy, most big tech companies are fine with federal regulations as long as they preempt future stronger state-level laws, and the bill only regulatesbusinesses with more than $40,000,000/year revenue so there isn't likely to be pushback from small businesses either.  The Washington Post, Wired, and The Hill also have coverage.

Of course, the devil's in the details, and I haven't read the discussion draft yet so don't have a strong opinion.  In any case, expect a fierce legislative battle. Stay tuned!