• by Wendy Davis , June 26, 2024

California's privacy agency on Wednesday urged lawmakers to reject the current version of the American Privacy Rights Act, which would impose nationwide restrictions on companies' ability to collect and process data, and would override many state privacy laws.

The House Energy and Commerce Committee is expected to mark up the bill on Thursday. The measure -- unveiled in draft form in April and revised twice since then -- was officially introduced late Tuesday night.

The California Privacy Protection Agency argues in a letter to lawmakers that a federal privacy law should allow states to pass and enforce stronger restrictions.

“Americans should have a strong floor of protections and states should be able to build on top of them,” executive director Ashkan Soltani writes.

The state privacy agency isn't the only critic of the bill. The proposed law is also opposed by ad organizations, privacy advocates and civil rights groups -- for different reasons.

As currently written, the measure would prohibit businesses from targeting ads to consumers based on their activity across unaffiliated sites and apps -- a common form of online behavioral advertising.

That proposed ban has drawn criticism from industry groups including the Association of National Advertisers, American Association of Advertising Agencies, Network Advertising Initiative and Privacy for America.

Despite the broad ban on targeting based on cross-site behavior, the bill would allow companies to use their own first-party data to retarget consumers with ads for previously viewed products.

Advocacy group Consumer Reports weighed in against the current proposal -- partly due to provisions that would allow retargeting.

More than 50 watchdogs including the Leadership Conference on Civil and Human Rights, Lawyers’ Committee for Civil Rights Under Law and Electronic Privacy Information Center have also criticized the current iteration of the bill because it no longer has a section specifically dealing with civil rights. The two prior versions of the bill would have prohibited companies from collecting or harnessing personal data in ways that discriminate based on race, color, religion, national origin, sex, or disability. The current version omits that provision.