Key facts
- House Republicans are close to releasing a draft of a national data privacy law.
- The draft is expected to require companies to obtain consent before collecting sensitive data.
- New language on children's online safety is included in the proposal.
- Democrats have historically opposed federal privacy proposals that preempt state laws.
- The American Privacy Rights Act (APRA), a previous bipartisan effort, expired without passage.
House Republicans are finalizing a draft of a national data privacy law, with a hearing anticipated in May. The proposal aims to establish federal standards for data collection, requiring companies to obtain consent before gathering sensitive information such as health data, location data, and information belonging to children under 13. It also includes provisions for children's online safety.
However, the legislation faces potential opposition from Democrats, who have previously contested Republican efforts to preempt state privacy regulations. A Democratic spokesperson criticized the GOP's approach, stating a need for a strong federal standard and suggesting the draft may be derivative. This follows previous attempts at federal privacy legislation, including the American Privacy Rights Act (APRA), which expired at the end of the 118th Congress in January 2025 after facing controversy and revisions that removed some consumer protections.
The United States currently lacks a comprehensive federal data privacy law, with data regulation largely handled at the state level. Previous comprehensive federal bills have also stalled due to disagreements over issues like preemption of state laws and the extent of private rights of action for consumers.