American Privacy Rights Act of 2024

# American Privacy Rights Act of 2024: Summary The American Privacy Rights Act of 2024 (APRA) is a comprehensive federal privacy law that would establish a uniform national privacy standard in the United States, preempting most state privacy laws while preserving certain state protections. Key provisions include: ## Core Privacy Rights - **Individual rights**: Consumers gain the right to access, correct, delete, and port their personal data - **Data minimization**: Requires companies to collect only necessary data for specified purposes - **"Do Not Sell or Share" option**: Creates a national "Do Not Sell or Share" mechanism - **Sensitive data protections**: Includes specific requirements for biometric, genetic, and health information ## Key Definitions - **Covered data**: Personal information that identifies or relates to an individual - **Sensitive covered data**: Includes biometric information, health information, precise geolocation, financial account numbers, and more - **Covered entity**: Businesses that collect or process covered data ## Enforcement Framework - Creates a new FTC privacy bureau within the Federal Trade Commission - Allows both federal and state enforcement (with coordination) - Establishes a private right of action for individuals - Creates a Privacy and Security Victims Relief Fund - Includes a "pilot program" for privacy-enhancing technologies ## Children's Privacy Protections - **COPPA 2.0**: Major amendments to the Children's Online Privacy Protection Act of 1998 - Requires "verifiable consent" (not just parental consent) for collecting children's data - Prohibits targeted advertising to children without explicit consent - Establishes new requirements for educational applications - Creates a "common verifiable consent mechanism" option ## Data Broker Requirements - Requires data brokers to register with the FTC - Mandates a publicly available website with clear privacy notices - Creates a "Do Not Collect" and "Delete My Data" request system - Prohibits selling data for stalking, harassment, or fraud ## Preemption Provisions - Preempts most state privacy laws but preserves: - Consumer protection laws - Employee privacy laws - Student privacy laws - Data breach notification requirements - Health privacy protections - Certain criminal laws related to privacy The law would take effect 180 days after enactment, with most provisions phased in over time, and includes specific provisions for children's privacy protection that would supersede some existing state laws while preserving others.