• by Wendy Davis  @wendyndavis, January 14, 2022

The Association of National Advertisers, Interactive Advertising Bureau, U.S. Chamber of Congress and other business groups are asking lawmakers to pass a privacy law that would override state measures.

“A growing patchwork of state laws are emerging which threaten innovation and create consumer and business confusion,” dozens of organizations said in a letter sent to Congress this week.

The groups add that Virginia and Colorado passed privacy laws last year that differ from California's newest privacy bill, the California Privacy Rights Act, while 26 other states and the District of Columbia considered new legislation last year.

“As the Federal Trade Commission considers a privacy rulemaking that would add a further layer of complexity to the state patchwork, it is critical that Congress pass one single national standard,” the groups write.

The FTC said in December that it was considering crafting regulations to “curb lax security practices, limit privacy abuses, and ensure that algorithmic decision-making does not result in unlawful discrimination.”

The groups signing the letter say a federal privacy standard should “provide meaningful and robust protections for consumers,” but do not offer details. The organizations also say the standard should only be enforceable by federal agencies and state attorneys general -- which would preclude consumers from suing over violations.

The letter was signed by 15 national organizations and dozens of local business groups throughout the country.

Federal lawmakers have put forward numerous privacy bills in the last several years, but none appear to have gained traction. Two of the major sticking points are whether a national bill should override state laws, and whether consumers should be able to sue over violations.

The online ad industry has been urging Congress to pass privacy legislation since 2018 -- the year that California passed a sweeping bill that gives consumers the right to learn what personal information about them is held by businesses, request deletion of that information, and opt out of its sale. 

An update to that measure, approved by voters in 2020, expands it in several ways -- including by making it harder for companies to use data about race, ethnicity, health, or finances for advertising. The update also clarifies that consumers have the right to opt out of online behavioral advertising.

Virginia's new privacy law requires companies to allow consumers to access, correct and delete personal data.

The measure also gives consumers the right to opt out of the use of non-sensitive data for targeted advertising, and requires companies to obtain consumers' affirmative consent before processing “sensitive” data -- including information about race, religious beliefs, health, sexual orientation or immigration status, as well as precise geolocation information and some biometric data.

The new law in Colorado requires companies to honor consumers' requests to opt out of targeted advertising -- including requests consumers make through browser settings or other global mechanisms.