U.S. Federal Privacy Law on the Horizon: What’s in the Proposed American Data Privacy and Protection Act (ADPPA)?

Last updated: October 9, 2024

In May 2022, the U.S. Congress introduced the American Data Privacy and Protection Act (ADPPA), which was amended and passed on for a House floor vote shortly thereafter.

While the bill is still a work in progress, companies managing data should take notice of the scope and requirements that could become federal law in the near future. Not unlike the existing and upcoming state laws, the federal bill has several requirements that will impact how companies can collect, process and share data, as well as what mechanisms they need to put in place to accommodate these requirements.

Below is a summary of the proposed bill’s impact:

Whom does it apply to?

Upgrade your privacy game: Watch the webinar with our VP who shares crucial security insights

Companies (including nonprofits and common carriers) that handle personal data, including information that identifies or can be reasonably linked to an individual.

What is covered?

The collection, processing and transfer of personal data reasonably necessary to provide a requested product or service or other specified circumstances.

What are the key provisions?

Established consumer data protections, including the right to access, correct and delete personal data.
Prohibits companies from transferring individuals’ personal data without their affirmative express consent.
Companies are required to provide individuals with a means to opt out of targeted advertising.
The bill additionally protects personal data of individuals under the age of 17 and is prohibiting companies from discrimination based on specified protected characteristics when using personal data.
Companies are required to implement security practices to protect and secure personal data against unauthorized access.

How would it be enforced?

Initially: The FTC and state attorneys general would enforce the above requirements.
Four years following the bill’s enactment: Individuals may bring civil actions for violations of the bill, following certain notification requirements.

How will it impact the existing state laws?

The bill preempts state laws that are covered by the provisions of the bill with certain exceptions, e.g. certain categories of state laws and specified laws in Illinois and California.

The proposed U.S. Federal Law sets a much lower data protection standard for U.S. data subjects than the EU’s General Data Protection Regulation (GDPR) by lacking:

Supervision by an impartial entity
Judicial compensation for data subjects
Necessity-based data processing restrictions
Protections from U.S. government surveillance

Below is a high-level outline of the areas covered in the proposed bill:

Consumer Data Rights

Unified Opt-Out Mechanism
Data Subject Rights & Awareness
Individual data ownership and control
Private Right of Action
Civil rights protections and algorithms
Data security and protection of covered data
Small business protections

Duty of Loyalty

Data Minimization/Prohibited Data Usage
Privacy by Design

Corporate Accountability

New Bureau of Privacy
Privacy Officer requirements
Technical compliance programs
Executive responsibility
Service providers and third parties

For a full version of the proposed ADPPA bill, please visit:

https://www.congress.gov/bill/117th-congress/house-bill/8152

Subscribe to our newsletter