Will there be a federal privacy law?

There will probably be a federal privacy law, eventually. Most US consumers support federal regulation of data privacy, and the majority has grown stronger every year since 2020, according to a 2022 report from 451 Research.

Legislators are working on it. In 2022, Congress introduced a bill called the American Data Privacy and Protection Act (ADPPA). The bill made it farther than any of its predecessors but stalled after being approved by the Committee on Energy and Commerce. It’s restarting the legislative process with the new Congress, but it hasn’t died on the vine.

The ADPPA’s two big hurdles

Two things are standing in the way of the ADPPA’s adoption:

1. The preemption controversy. Typically, when state and federal laws conflict, federal law preempts, or supersedes, state law. Preemption is the key to solving the business challenges presented by the patchwork of state-level legislation. And while the ADPPA has bipartisan support and backing from advertising stakeholders and privacy advocates alike, California delegates have expressed concern that it would lead to less comprehensive protection than the CCPA and CPRA. Case in point, the ADPPA lacks the private right of action that Californians have under current state law.
2. The innovation conundrum. The ADPPA takes a data minimization approach to privacy and proposes 17 permissible purposes for collecting and using consumer data—including targeted advertising as long as there’s a “clear and conspicuous means to opt out.” But there are concerns that the scope of the bill is too narrow to enable tech innovation. After all, businesses would be prohibited from collecting consumer data, or even asking for consent to collect consumer data, for any purpose not explicitly included in the law.

But privacy-conscious consumers aren’t waiting for legislators to hold businesses accountable. In the absence of comprehensive federal consumer data protection legislation, lawyers are using older laws like the Video Privacy Protection Act (VPPA) of 1988 and anti-wiretapping statutes to litigate modern privacy issues.