Fighting for privacy rights remains a challenging endeavor. Despite public outcry and bipartisan discussions on the importance of protecting privacy, Congress has struggled to pass comprehensive legislation. Recent attempts, including the American Data Privacy and Protection Act (ADPPA) in 2022 and the American Privacy Rights Act (APRA) in 2024, have shown potential but ultimately failed.
In the 119th Congress, committee chairs have indicated interest in advancing industry-friendly bills that may not significantly alter current practices and could reduce state authority over privacy. Additionally, President Trump removed Democratic members from the Privacy and Civil Liberties Oversight Board during his first week in office. This action left the board without a quorum needed for investigations vital to civil liberties protections and affected cross-border data flows under the EU-U.S. Data Privacy Framework.
Despite these challenges at the federal level, there are positive developments at state levels and within technical standards. Maryland passed a law with meaningful data minimization requirements last year, inspiring other states to introduce similar bills. The Center for Democracy & Technology (CDT) supports two model comprehensive state privacy bills from partners Electronic Privacy Information Center (EPIC) and Consumer Reports.
State enforcement is increasing as more laws take effect. Texas has initiated actions against companies like Allstate and Arity for alleged unauthorized location data collection, while California has settled cases with DoorDash and Sephora for non-disclosure of consumer data sales.
As new laws are enacted to protect privacy from AI surveillance tools such as facial recognition, states continue their efforts in safeguarding privacy rights. If Congress decides to pursue comprehensive privacy legislation, it should support rather than undermine state initiatives.
Congress faces another significant task related to government surveillance with Section 702 of the Foreign Intelligence Surveillance Act set to expire next spring. Last year’s attempt fell short by one vote to implement a critical warrant rule after a district court deemed warrantless queries unconstitutional.
The World Wide Web Consortium's new Privacy Working Group aims to standardize the Global Privacy Control (GPC), allowing users to opt-out of data sales or sharing easily. Some U.S. states already require websites to respect GPC signals; however, leading browsers do not yet support it without additional user effort.
Privacy is essential not only on its own but also as an enabling right protecting other fundamental civil rights. In today's world where behavior generates extensive data trails subject to misuse by governments or private entities, CDT remains committed to advocating for strong privacy protections.
