Introduction
The American Privacy Rights Act (APRA) is a new bill introduced in Spring 2024 that seeks to implement a nationwide set of consumer privacy laws. Currently, no national framework exists. A previous bill with similar goals, the American Data Privacy Protection Act, failed to pass in 2022.
The APRA would, among other things:
- Restrict the data that large organizations (such as corporations, nonprofits, and third-party data brokers) would be able to collect about consumers
- Give consumers the ability to view and control any data being collected
- Create a “private right of action”, giving consumers (rather than only the government) the ability to sue organizations that violate the laws introduced by the act
- Prohibit data-collecting organizations from discriminating against customers based on their privacy decisions (for instance, by providing slower service to someone who opts out of data sharing)
- Restrict the use of “dark patterns”, or design methods used to manipulate consumer behavior, such as making the data sharing opt-out button very small
Support for the APRA
Supporters of the APRA argue that comprehensive privacy legislation is necessary, and that this act is well suited to fill that role. A study conducted by the Pew Research Center found that roughly 70% of Americans feel confused and concerned about the use of their data by private companies and the government. Another Pew study found that roughly 60% of Americans read privacy policies before agreeing to them, and one third of that group understands very little to none of the content. Additionally, many websites have nonexistent or difficult-to-access privacy policies. The APRA would address these issues by requiring organizations to make easy-to-read privacy policies readily available to users. Advocates of the bill emphasize its likelihood of passage, in contrast to previous failed attempts at nationwide privacy legislation, given that APRA has bipartisan support in both the House and Senate. Privacy advocates and technology industry leaders praise the bill for its balance of consumer and business interests. They hold that APRA increases protections while creating a uniform national standard that will be easier for companies to comply with.
Criticism of the APRA: Going Too Far
Criticism of the APRA generally comes from two angles, one of which is that it encroaches upon private sector revenue and autonomy. Some argue that there are benefits to collecting consumer data, such as contributions to health and energy efficiency research. Moreover, critics highlight that companies rely on ad data for revenue on platforms that are otherwise free to consumers; restrictions on data sharing might make this business model less sustainable. Others criticize APRA’s use of the vague term “dark patterns”, which they argue can lead to regulatory overreach. Critics also claim that the APRA would be expensive to implement and maintain. Private organizations covered by the act would have to spend money on compliance, which could disproportionately impact smaller businesses. Finally, opponents object to the inclusion of the private right of action, arguing it will empower private prosecutors over government regulators who may be better able to balance the interests of consumers and businesses.
Criticism of the APRA: Not Doing Enough
The other group of critics argues that the APRA does not go far enough to protect consumer data, and may actually force the regression of protections in states with already robust privacy laws. Some states, such as California and Illinois, have passed extensive data privacy acts that include protections that the APRA does not. For instance, unlike the APRA, the California Consumer Privacy Act (CCPA) protects data about sexual orientation and immigration status. Under the APRA, CCPA’s protections would be overridden and replaced with a less stringent national baseline. The head of the agency that enforces the CCPA criticizes the APRA’s limitations on state laws, asserting that “Congress should set a floor, not a ceiling”.
Conclusion
While most agree that a clearly defined national data privacy bill would benefit consumers and businesses alike, many disagree over whether the APRA is the right solution. Although bipartisan support makes the APRA’s passage a realistic possibility, any privacy legislation will have to face the challenge of balancing the interests of private enterprise with consumer protection.
