Could privacy laws be changing? Here's what's brewing in Congress
Rep. Cathy McMorris Rodgers (center), a Republican from Washington state, has struck a deal for a comprehensive privacy bill with Sen. Maria Cantwell, a Democrat. (Tom Williams/CQ-Roll Call, Inc via Getty Images)
Congressional negotiations over data privacy and children’s online safety took a notable step forward this week as House and Senate leaders unveiled bipartisan proposals and started ramping up their consideration of the measures.
Most notably, Sen. Maria Cantwell (D-Wash.) and Rep. Cathy McMorris Rodgers (R-Wash.) struck a deal on a comprehensive privacy bill, and House lawmakers unveiled a companion to the Kids Online Safety Act, raising the prospects that both could still move this Congress.
The House is scheduled to debate those and other tech measures at a hearing next week, and the Senate could soon follow suit. But just like in years past, the same pesky friction points that have bogged down talks for years may surface again.
Here are some of the expected tugs of war to watch in the coming months:
California dreaming?
Cantwell and McMorris Rodgers may have finally agreed on a national privacy proposal that would override many state laws, but that doesn’t mean key congressional delegations will be on board, including California’s massive contingency on Capitol Hill.
Last Congress, former House speaker Nancy Pelosi (D-Calif.) and other state leaders spoke out against the chamber’s prior attempt to hash out a privacy bill because it would have preempted California’s watershed law, the California Consumer Privacy Act.
State officials are already signaling similar concerns with the new privacy proposal.
California Special Assistant Attorney General Eleanor Blume said in a statement that while her office is “glad Congress is taking seriously the need for privacy protections nationwide, we hope that anything enacted at the federal level would provide a floor but not a ceiling.”
Ashkan Soltani, executive director of the California Privacy Protection Agency, said in an email that the new bill “seeks to remove the CPPA’s authority and replace it with a federal structure, thus compromising the CPPA’s unique ability to protect California consumers.” It would “limit CPPA’s broad rulemaking authority” and omit other “key protections,” he added.
On Sunday, Cantwell offered a prebuttal of sorts to the California critiques, saying in an interview that the bipartisan proposal is “now stronger than theirs.”
“We have the same standard by which we protect them on these sensitive data like biometric,” she said. “And we’ve preserved their remedy, which was statutory damages.”
Rep. Anna G. Eshoo (D-Calif.), who opposed the House’s prior privacy bill, said Rep. Frank Pallone Jr. (D-N.J.) made a similar argument to her this week. She replied: “Well if it’s stronger, why are you preempting it?’” Eshoo said she’s still “perusing” the bill, though.
Are the kids all right?
House and Senate lawmakers for years have tussled over whether to prioritize broader privacy legislation or protections for kids, since taking up both has at times appeared unachievable.
Now both chambers are dialing up efforts on the issues simultaneously. But how they weave together the various proposals vying for attention could determine the fate of the push.
One issue to watch: The House’s new version of the Kids Online Safety Act includes key changes that could complicate negotiations with the Senate.
Under the Senate version, a broad swath of companies would be subject to a new “duty of care” standard requiring them to take steps to prevent harm to minors. But the House version only applies that standard to a smaller subset of “high impact” digital services, narrowing the scope.
The House version also tweaks the language on what kind of “compulsive usage” by minors that companies would need to address, focusing on “repetitive behavior reasonably likely to cause a mental health disorder.” By contrast, the Senate version targets repetitive behavior “likely to cause psychological distress, loss of control, anxiety, or depression,” arguably a broader pool.
Asked about the changes Wednesday, Rep. Kathy Castor (Fla.), the bill’s lead Democratic sponsor in the House, stressed that it’s still “early” in the legislative process.
“I like the idea of having them identical in the House and Senate, but it’s just imperative that we move legislation that can protect kids online and protect our privacy,” she said.
How is the ‘trial bar’ faring?
Republicans have long resisted efforts to give consumers a right to directly sue companies over privacy violations, known as a private right of action. Doing so, they have argued, would only serve as a gift to trial lawyers and a burden on businesses.
But to strike a deal with Democrats, they have agreed to such provisions with some limitations. Where to draw the line on those limits has been one of the most contentious parts of the negotiations in the past. Sen. Ted Cruz (Tex.), the top Republican on the Senate Commerce Committee, suggested after Cantwell and McMorris Rodgers released their discussion draft that he may not be happy with their compromise on that. If other Republicans agree, it could threaten the deal.
“I cannot support any data privacy bill that empowers trial lawyers, strengthens Big Tech by imposing crushing new regulatory costs on upstart competitors or gives unprecedented power to the FTC to become referees of internet speech and DEI compliance,” he said in a statement.
Cantwell said the bill was about making “privacy a consumer right” and ensuring there are “policemen on the beat” to enforce the standards.
