U.S. PIRG and the PIRG states oppose the American Privacy Rights Act

U.S. PIRG and the state PIRGs oppose Congress’ newest consumer privacy legislation, the American Privacy Rights Act (APRA). Though Americans urgently need stronger protections for their data – which companies currently collect at astonishing and unnecessary rates, and endanger through inadequate security measures and selling data widely to other entities, increasing the risks of personal information being exposed in a breach or a hack – the American Privacy Rights Act is not the legislation for the job.

The biggest problem with the drafts of APRA we’ve seen so far comes down to the states. APRA would both pre-empt existing state privacy laws, and bar states from passing new legislation on these issues in the future. This means landmark legislation we’ve worked hard to pass and protect in California, Illinois and Maryland would be wiped off the books. It would mean laws that can be strengthened in Colorado and Oregon would not get the chance. And it means in Vermont and Massachusetts where we worked this session to pass nation-leading laws, and will continue to fight for in 2025, there’d be no future for privacy and security legislation. 

States are an important part of our democracy. They can serve as testing groups for new policy ideas. They can help make sure people are protected when federal regulatory agencies are captured by special interests. And they can go above and beyond for consumers where federal laws have created a floor. 

Take for example our work on payday lending. The CFPB wrote rules that didn’t go far enough in protecting people from predatory payday loans, and so states stepped in. We’ve successfully passed legislation in Colorado, Illinois and Oregon to cap the interest rates of payday loans to 36%, helping consumers escape the debt treadmill that can ruin a person’s financial health. 

When it comes to regulation of technology, it’s particularly important to keep the states in the game. Congress is – for better or for worse – a slow-moving body. Passing APRA today would be putting issues of data privacy, and maybe even the regulation of AI, in the Congressional cryogenic freezer for the next 20-30 years. With tech moving fast, we can’t let regulation fall behind. 

We joined a number of other state and federal groups in expressing our concerns about APRA’s pre-emption in a letter led by the ACLU and its state groups. And we’ll continue fighting next year for stronger laws in the states – and federal consumer privacy & security legislation that lets states raise the bar for everyone.