Consumer Reports and the Electronic Privacy Information Center unveil new model legislation to protect the privacy of American consumers

Washington, DC – Today, Consumer Reports and EPIC released the State Data Privacy Act, model legislation developed to provide lawmakers with a framework for protecting the privacy of American consumers. In the absence of a federal privacy law in the United States, the states have an opportunity to lead the way in safeguarding consumer privacy.

The State Data Privacy Act also received the endorsements of PIRG, the Center for Democracy and Technology, and Public Knowledge, which are united in advancing meaningful privacy rights as detailed in the State Data Privacy Act. 

The State Data Privacy Act is a pragmatic approach to privacy, designed to chart a realistic path toward a higher level of protection for consumers in state privacy laws. The base text of the bill is the Connecticut Data Privacy Act (CTDPA), legislation that industry often cites as a model for other states to adopt. In our view, CTDPA contains far too many loopholes that prevent it from offering strong privacy protections, but it is an established bill that many state lawmakers are already familiar with. Strengthening the CTDPA provides consistency for businesses while giving consumers meaningful privacy protections.

The goals of the State Data Privacy Act are to:

• Limit ubiquitous online tracking;
• Encourage more privacy-protective methods of online advertising;
• Protect the most sensitive data, including data about kids and teens;
• Use language from existing state laws; and
• Allow for meaningful enforcement of the law to ensure compliance.

“Without a comprehensive national law, states are attempting to fill the gap to protect the privacy of their constituents,” said Matt Schwartz, a policy analyst at Consumer Reports. “The State Data Privacy Act was developed in an effort to more meaningfully protect user privacy than we’ve seen in many state laws, while also retaining a format more familiar to state policymakers. We hope the State Data Privacy Act can  guide lawmakers who may be considering introducing a comprehensive privacy bill in their state but might not know where to start.”

“The State Data Privacy Act provides state lawmakers with an opportunity to build on existing state privacy laws and meaningfully protect privacy,” said Caitriona Fitzgerald, Deputy Director at the Electronic Privacy Information Center. “This proposal sets out rules allowing companies to collect and use data in ways consumers expect while putting a stop to the data abuses that happen outside of their view.”

Currently, there is no federal comprehensive federal privacy law, though 19 states have comprehensive privacy laws on the books that range in strength. 

Find the bill here, the Section-by-Section summary here, and the redline here.

Contact:

• Cyrus Rassool, cyrus.rassool@consumer.org

Experts:

• Margaret Oates
• Matt Schwartz