House Commerce to Rework Bipartisan Privacy Bill

It was the subcommittee’s second hearing on privacy in 2023. Members spoke about the benefits of eliminating a patchwork of state regulation and the need for protections like a private right of action for consumers to sue, a right to cure for companies to avoid costly penalties, and stronger FTC enforcement.

“We simply cannot go another Congress without passing comprehensive privacy legislation,” said House Commerce Committee ranking member Frank Pallone, D-N.J. He noted the American Data Privacy and Protection Act (ADPPA) would create a youth privacy and marketing division at the FTC. It also requires data brokers to register with the agency and allows consumers to opt out of data collection by all registered brokers.

House Commerce Committee Chair Cathy McMorris Rodgers, R-Wash., noted the ADPPA’s 53-2 committee passage in 2022 (see 2207200061). There are new considerations in 2023, she said, so members need to continue to improve on the bill and build consensus. We’re going to “get it done this Congress,” she said. Rodgers noted she looks forward to testimony from TikTok CEO Shou Zi Chew on March 23 (see 2301300028).

Rodgers and House Innovation Subcommittee Chairman Gus Bilirakis, R-Fla., wrote the FTC Tuesday on concerns about a consolidation of power under Chair Lina Khan in light of the resignation of Commissioner Christine Wilson (see 2302140069). Wilson’s decision raises concerns about the “potential loss of integrity of the FTC, the jeopardizing of the independence and collegiality essential to the functioning of the FTC, and the increased risk of the public losing confidence in the FTC,” they wrote. The agency confirmed receiving the letter but didn’t comment.

Rodgers noted the ADPPA’s inclusion of a right to cure and the consumer’s right to sue. The right to cure is a “reasonable response” that allows companies to avoid onerous litigation, particularly companies that don’t have armies of attorneys, said Kelley Drye attorney Jessica Rich, a former FTC Consumer Protection Bureau director.

A private right of action is essential because the FTC and state attorneys general won’t be able to keep up with the pace of commercial activity, said Center for Democracy & Technology CEO Alexandra Reeve Givens. Consumers should be able to vindicate their rights when enforcers can’t. She noted the private right of action can’t be used against small businesses. It also can be used only for compensatory damages and injunctive relief, not statutory damages, which could remove incentive for the more speculative litigation, she said.

Consumers should have the right to opt out of targeted advertising, said Bilirakis. But he warned the FTC against “going rogue” and beyond the statutory authority provided by Congress. Ranking member Jan Schakowsky, D-Ill., said she looks forward to working with Republicans to pass comprehensive privacy legislation and build on “previous gains.” The state patchwork of regulation is unsustainable economically, and California continues to add layers to the regulatory framework, said Bilirakis. He asked Rich how the FTC’s current exploration of a potential privacy rulemaking could have further negative economic impact. Rich agreed a rulemaking would be “problematic,” especially since the FTC can’t work through preemption issues that Congress can handle. This patchwork of regulation, which the FTC might expand, hurts smaller businesses and publishers more than the incumbents, said Graham Mudd, founder of Anonym, a company that says it wants to “enable high performing, privacy-safe advertising.”

The ADPPA was a “substantial” step forward, but the bill favors dominant platforms and stifles digital advertising, said Network Advertising Initiative Vice President-Public Policy David LeDuc in a statement. Congress should be “mindful to not create policies that are unclear, ambiguous, or open-ended, which allow for regulators to interpret laws in ways that were not intended,” said LeDuc.

The current model of notice and consent is broken, Schakowsky and witnesses agreed. People don’t take the time to read the terms of service, and users feel they don’t have a choice anyway, said Givens. Because users don’t read the onerous terms of service, they don’t understand how their data is being handled, said Mudd.

Everyone agrees on the need to better protect children’s privacy, said Rep. Tim Walberg, R-Mich., noting he has introduced various bills to update the Children’s Online Privacy Protection Act (COPPA). Rich said that law is “very outdated.” Data collection practices have exploded, and there are all sorts of new marketplace tactics that weren’t envisioned when COPPA was last updated, she said.