• by Wendy Davis  @wendyndavis, June 3, 2022

Federal lawmakers on Friday floated legislation that would require companies to obtain consumers' explicit consent before collecting data about their activity over time and across websites.

The 64-page discussion draft of the bipartisan “American Data Privacy and Protection Act,” would also allow consumers to opt out of ad targeting based on data about their activity over time and across sites. That opt-out provision appears to apply even if those consumers previously agreed to allow that information to be collected.

The draft bill, unveiled by Senator Roger Wicker (R-Mississippi), Representatives Frank Pallone, Jr. (D-New Jersey) and Cathy McMorris Rodgers (R-Washington), would impose numerous other prohibitions on companies' ability to collect and harness consumer data.

One provision would require companies to curb the amount of data they collect from consumers.

Another provision would require companies to obtain people's express consent before collecting or processing a broad range of sensitive data.

The draft bill's broad definition of sensitive data includes financial account numbers, government-issued identifiers, biometric information, precise geolocation information, messages (such as email, text and voicemail), certain demographic information (such as race, religion, ethnicity and sexual orientation), information about people's video viewing, and information about an people's activity over time and across websites.

The measure also addresses “dark patterns” by prohibiting companies from using interfaces that aim to dupe people into consenting to data collection.

The proposed law's definition of sensitive data also sweeps in any information about minors younger than 17.

A separate clause would prohibit companies from knowingly serving targeted ads to anyone under 17.

The bill's requirements don't apply to “de-identified” data, but do apply to pseudonymous data -- generally meaning information that could be tied to specific devices.

The proposed federal law would override many state privacy laws, but not all.

Among the state laws that would still be in force is the Illinois biometric privacy act, which allows state residents to sue companies for up to $5,000 for compiling faceprints.

It's not yet clear whether this bill will gain traction.

Senator Maria Cantwell (D-Washington), who chairs the Senate Commerce Committee, hasn't signed on to the draft.

The bill comes as states are increasingly passing their own privacy laws. Since 2018, California, Virginia, Colorado, Utah and Connecticut have enacted broad data-protection laws that regulate targeted advertising.