• by Wendy Davis  @wendyndavis, May 9, 2024

A coalition of attorneys general are seeking revisions to the proposed American Privacy Rights Act, which would impose sweeping restrictions on data collection, and override state privacy laws.

“While we welcome new federal protections, any national privacy bill cannot foreclose the states from continuing to legislatively innovate to protect our consumers,” California Attorney General Rob Bonta and 14 others say in a letter sent to Congress on Wednesday.

The attorneys general are urging Congress to pass a baseline law that would set out minimum privacy standards and also allow states to pass more restrictive measures.

“States are better equipped to quickly adjust to the challenges presented by technological innovation that may elude federal oversight,” the officials write.

The American Privacy Rights Act, released in draft form last month by Senator Maria Cantwell (D-Washington) and Representative Cathy McMorris Rodgers (R-Washington), includes ambiguous provisions regarding online ad targeting based on data collected across sites and apps. Some language in the bill appears to require companies to obtain consumers' opt-in consent before transferring cross-site data, but other, potentially contradictory language in the bill could completely prohibit businesses from harnessing such data for ad targeting.

The Interactive Advertising Bureau, which opposed the bill, argued last month in a letter to Congress that the proposed measure would require opt-in consent for behavioral targeting.

“The opt-in concept could affect the entire ecosystem, creating a data-poor, much less functional, useful internet,” IAB executive vice president for public policy Lartease Tiffith wrote.

Tiffith elaborated to MediaPost that the draft language regarding targeted advertising could also be interpreted as banning online ad targeting based on cross-site data.

“I think at the very least, it requires an opt-in,” he said. “It's also fair to argue it's a complete ban.”

California and more than a dozen other states have passed comprehensive privacy laws since 2018, but none of those measures either require opt-in consent for behavioral advertising in all situations, or bans behavioral advertising altogether.