Rep. Zoe Lofgren, D-Calif., took another stab Thursday at legislation aimed at regulating the way consumers’ data is collected and used online, reintroducing the Online Privacy Act for the fourth time since 2019.
The Online Privacy Act would prevent companies from using private communications for ad targeting and require them to articulate the need for collecting and maintaining user data. It would also criminalize doxxing, limit how much data can be shared with employees and contractors, and give users more control over how their data is stored, collected, and used.
“Privacy is a fundamental right, but for too long, Congress has failed to set clear nationwide rules to protect Americans’ personal data. The Online Privacy Act gives Americans the power to view, correct, and delete their information,” Lofgren said in a statement. “This legislation shifts power back to the people and ensures federal law finally catches up to the realities of the 21st century.”
Lofgren had previously introduced the Online Privacy Act in 2019, 2021, and 2023 alongside former Rep. Anna Eshoo, D-Calif.
Each bill was referred to House committees, where they stalled without being subject to any votes or markups before expiring at the end of each Congress. At least one committee held a hearing on the act reintroduced in 2021.
While this is the fourth version of the act, the legislation’s text has slightly changed over time. Most notably, the Digital Privacy Agency proposal appeared in the 2021 version of the act.
That inclusion – which appeared in the subsequent versions introduced – would task the new agency with enforcing data privacy laws and further shaping related policies.
Most bills don’t end up being enacted by Congress, and the ones that do pass are often by voice vote, according to Emory University. In fact, only about 6% of legislative proposals actually pass, the university said.
Data privacy has become an increasingly hot-button issue in Congress over the years, though, with other lawmakers introducing their own proposals to shore up data protections.
It’s also become tethered to cybersecurity issues. For example, a report from Sen. Maggie Hassan, D-N.H., last month found that breaches of four major data brokers’ systems over the past decade cost consumers an estimated $20 million.
Lofgren’s Online Privacy Act comes with backing from advocacy groups such as Public Knowledge and Free Press Action.
Amanda Beckham, government relations director at Free Press Action, said, “Especially now, when AI tools are being deployed by private industry and government to ingest and analyze massive amounts of data to make predictions about us, data privacy legislation with robust civil rights and anti-discrimination principles is critical. The Online Privacy Act would be an important step in that direction.”
The most recent version of the Online Privacy Act has until Jan. 3, 2027, to pass before it expires at the start of the next Congress.