According to a Bloomberg Law report authored by several regulatory experts with Troutman Pepper, a coalition of 15 state attorneys general recently voiced their opposition to the American Privacy Rights Act (APRA). The group argues that the proposed federal legislation would undermine state authority and weaken consumer protections that have been established at the state level.

The Opposition Stance

The coalition, representing 15 states with established privacy laws, voiced their concerns through a joint letter addressed to Congress in May of this year. They assert the APRA, in its current form, would preempt state laws and dilute the enforcement power of state attorneys general, which could ultimately lead to weaker privacy protections for consumers.

According to the coalition, the attorneys general have been at the forefront of protecting consumer privacy through comprehensive state laws tailored to the unique needs of their states’ residents. The American Privacy Rights Act, while generally a step towards protecting consumer privacy, would impose a one-size-fits-all federal standard that preempts stronger state regulations and hampers their ability to enforce these protections effectively, the coalition believes.

The open letter was penned and signed by the California Attorney General and co-signed by the attorneys general of Connecticut, Delaware, District of Columbia, Hawaii (signed by the Executive Director of the Office of Consumer Protection), Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New York, Oregon, Pennsylvania and Vermont.

Key Concerns

The primary concern among the opposing attorney generals is the preemption of state laws. Many states, including California with its California Consumer Privacy Act (CCPA), have enacted stringent privacy laws that provide robust protections for consumers. These state laws often include provisions that go beyond what is proposed in the federal legislation.

California Attorney General Rob Bonta, one of the prominent voices against the APRA, emphasized that his state has set a high standard for privacy protections with the CCPA, and the proposed federal law should not weaken the rights and protections that the state authorities have worked so hard to establish.

“We encourage Congress to adopt legislation that sets a federal floor, not a ceiling, for critical privacy rights and respects the important work already undertaken by states to provide strong privacy protections for our residents,” the open letter reads. “A federal legal framework for privacy protections must allow flexibility to keep pace with technology; this is best accomplished by federal legislation that respects — and does not preempt — more rigorous and protective state laws.”

The Impact of the American Privacy Rights Act

If enacted, the APRA would establish a federal framework for data privacy, setting nationwide standards for how companies collect, use, and protect consumer data. Key provisions of the Act include:

1. Universal Consumer Rights: The APRA would grant all Americans rights to access, correct, delete, and port their personal data. These rights are designed to give consumers greater control over their personal information.

2. Strict Data Handling Requirements: The Act would impose stringent requirements on how businesses handle personal data, including limitations on data collection, processing, and sharing.

3. Federal Oversight and Enforcement: The Federal Trade Commission (FTC) would be granted significant authority to enforce the provisions of the APRA, including the power to levy substantial fines for non-compliance.

4. Preemption of State Laws: One of the most contentious aspects of the APRA is its preemption clause, which would override existing state privacy laws implemented since 2018 and establish a single federal standard. This clause is intended to simplify compliance for businesses operating across multiple states but has drawn criticism for potentially weakening stronger state protections.

State Enforcement vs. Federal Oversight

State attorneys general argue that their ability to enforce privacy laws is crucial to protecting consumers. They fear that the APRA’s centralization of enforcement power under the FTC would reduce the effectiveness of privacy protections.

APRA plans to set up an entirely new bureau at the FTC to engage in oversight and rulemaking, which could take years to get off the ground and build the professional relationships needed to enforce privacy protections at the highest level. These are years that state privacy regulators feel they don’t have, in light of the rapid development of new technologies and the massive impact of artificial intelligence.

The attorneys general also highlight that state laws can be more adaptive and responsive to the specific needs of their residents. The flexibility to tailor laws to address local issues is seen as a significant advantage that would be lost under a uniform federal standard.

Next Steps

The opposition from state attorneys general adds a significant hurdle to the passage of the APRA. As the debate continues, there is growing recognition of the need for a federal privacy law that provides consistent protections while respecting state authority and the advances already made at the state level.

As discussions continue, finding a balance that respects state authority and enhances national privacy standards will be crucial.