With the 2024 election just a day away, we are taking stock of the federal and state data privacy landscapes with respect to legislative activity and enforcement and anticipating what is to come.
Federal Privacy Landscape: Legislation
The coming election will impact nearly every area of policy, including privacy. In this time of great political division, privacy is one area in which there is some bipartisan agreement: There is a general consensus among Democrats and Republicans that Congress should enact both comprehensive privacy legislation and kids’ privacy legislation. As we have seen, Congress has been very active in their efforts to do so over the past two years, with the consideration of the American Privacy Rights Act (“APRA”) and two key children’s privacy bills: the Kids Online Safety Act (“KOSA”), which would require specified “covered platforms” to implement new online safeguards, tools, and transparency for minors under 17; and the Children and Teens’ Online Privacy Protection Act (“COPPA 2.0”), which would amend COPPA’s existing protections for children under 13 and create new protections for teens under 17.
Looking forward beyond Inauguration Day, while the new resident of the White House will drive the policy agenda for many issues, we are likely to see the new 119th Congress have a bigger impact on privacy legislation than who takes the White House—and we are likely to see a continued focus on privacy carry over from the current 118th Congress.
Key Federal Privacy Legislation: State of Play
As the three key federal privacy bills stand, KOSA and COPPA 2.0 were approved in July by the full Senate, in a combined package, by a 91-3 vote. On the House side, the House Energy & Commerce Committee in September approved different versions of KOSA and COPPA, as individual bills—but did so after much debate and several sticking points, on KOSA in particular. The full House has not considered the children’s privacy bills. KOSA is led by Senators Richard Blumenthal (D-CT) and Marsha Blackburn (R-TN) in the Senate and by Representatives Gus Bilirakis (R-FL) and Kathy Castor (D-FL) in the House. COPPA 2.0 is led by Senators Ed Markey (D-MA) and Bill Cassidy (R-LA) in the Senate and by Representatives Tim Walberg (R-MI) and Kathy Castor in the House.
APRA was initially released in April —in a somewhat unusual fashion—as a bipartisan, bicameral discussion draft by retiring House Energy & Commerce Committee Chair Cathy McMorris-Rodgers (R-WA) and Senate Commerce Committee Chair Maria Cantwell (D-WA). It was formally introduced in the House in May, but the House Energy & Commerce Committee markup of the bill was cancelled last minute. It has not been formally introduced in Senate.
Prospects in the Lame Duck
Congress is likely to be very busy with other priorities between Election Day and the start of the new Congress on January 3, making enactment of federal privacy legislation in this short timeframe unlikely. For example, the annual defense bill will be on the table, as will government funding legislation. Theoretically, privacy legislation could be tacked onto one of these must-pass bills, as these large legislative packages typically provide vehicles for additional bills to be airdropped in without having to go through the regular process of full passage in both the House and Senate. However, this process is generally reserved for bills that have been blessed by the “four corners”—meaning the Republican and Democratic leadership of both the House and the Senate, or the Republican and Democratic leadership of the committee of jurisdiction in each chamber in some cases. Use of this process is less common with legislation that has not at least passed the relevant committees as a standalone bill.
With APRA in this category, and with other headwinds it faces, it is very unlikely to make it across the finish line this congress. The KOSA/COPPA 2.0 package is certainly more likely to make the cut, given the bills’ passage of the full Senate and the House Energy & Commerce Committee. That said, there are still substantive hurdles to enactment, as the text of the Senate and House versions of the bills differ in several ways, maybe most notably with respect to the House bills employing a tiered knowledge standard as to knowledge of a child or teen on a platform and with respect to KOSA’s “duty of care” provision. The Senate version would impose a duty of care on covered platforms as to mental health risks, among others, while the House version is focused on physical harms. There are fewer differences between the two versions of COPPA 2.0, and fewer sticking points on that bill among House Energy & Commerce Committee members.
Additionally, though House Energy & Commerce Committee advanced the bills by voice vote, multiple members, including KOSA’s lead Democratic sponsor, voted for the bill at the Committee markup but indicated they would not support it as currently drafted for final passage. Typically, absent the possibility of this package being added to must-pass year-end legislation, we would expect next steps to include full House passage, followed by a conference with the Senate to reconcile the differences between the bills prior to final passage. Even if the key players were all on board with such a plan, this type of process takes more time than is available before the 118th Congress concludes.
Prospects in the 119th Congress
Presuming that Congress does not surprise us and enact these bills in the next two months, we expect both comprehensive and children’s privacy legislation to be back on the table in the new 119th Congress. Though whether the bills, and APRA in particular, will resurface in their current forms is an open question.
Key factors impacting the content and progress of federal privacy legislation in the 119th will include: who holds leadership positions in each party in each chamber; who holds the gavel and ranking member titles in the committees of jurisdiction in each chamber; and the margin of the majority in each chamber. It seems likely that the margin will be very slim in both the House and the Senate. And if there’s a split congress—with Republicans controlling one chamber and Democrats controlling the other—that could make it harder to get privacy legislation (much less any other legislation) across the finish line.
Party Leadership
Leadership will have a significant impact on progress of any privacy legislation. By way of example, current Senate Majority Leader Chuck Schumer (D-NY) led the charge that resulted in the Senate passing the joint KOSA/COPPA 2.0 package in July. Schumer is likely to maintain his leadership of the Democratic caucus in the 119th. With Senate Minority Leader Mitch McConnell (R-KY) retiring as Republican Leader, the party is considering three new candidates for the post, each of whom voted in favor of the children’s privacy package but has not generally been vocal about APRA: Senators John Thune (R-SD), John Cornyn (R-TX), and Rick Scott (R-FL).
On the other side of the ledger, current House Speaker Mike Johnson (R-LA) and Majority Leader Steve Scalise (R-LA) seemed to play a key role in halting progress of APRA, as they reportedly warned APRA sponsor McMorris-Rodgers against pushing forward with a scheduled June markup, leading to its last-minute cancellation and stalling the legislation on the whole. Notably, there have been mixed reports on Johnson’s stance on the children’s privacy legislation.
If Republicans keep the House, Johnson and Scalise will likely maintain their posts—though that could be dependent on the margin of any Republican majority, as a very slim margin could result in a small portion of the party having a large influence over the leadership votes, which is what ultimately led to former Speaker Kevin McCarthy (R-CA) being removed from the job earlier in the 118th. On the Democratic side, Rep. Hakeem Jeffries (D-NY) currently holds the Leader position. His take on privacy legislation is less clear.
Committee Leadership
On the committee level, Senator Cantwell is the current chair of Senate Commerce, and we expect her to be the top Democrat on the panel in the 119th as well. Given that she worked together with McMorris-Rodgers to unveil APRA, it is possible that she will be motivated to pick that back up in the new congress. Of the three privacy bills that were top of mind this year, though, APRA likely will still face the strongest headwinds in the new congress.
Senator Ted Cruz (R-TX) is the current Ranking Member on Senate Commerce. He is likely to maintain the top Republican spot on the Committee in the 119th. Cruz has raised concerns with APRA, namely its private right of action and its vesting authority in the Federal Trade Commission (“FTC” or “Commission”), which Cruz and other Republicans see as wielding too much power, particularly under the current Chair Lina Khan. On the children’s privacy front, Cruz was supportive of both bills and touted the Senate’s passage of the combined package. Given his focus on “holding Big Tech accountable,” he may be inclined to push these bills forward in the new congress as well.
On the House side, McMorris-Rodgers’s impending retirement and her goal of leaving a legacy of protecting Americans’ privacy may have been the impetus behind the somewhat unusual processes underlying the legislative activity, from McMorris-Rodgers and Senator Cantwell initially releasing APRA in draft form, without their committee leadership counterparts, to the House Energy & Commerce Committee ultimately passing the children’s privacy legislation with several members voicing that the bills still needed significant changes.
As for House Energy & Commerce Committee leadership in the next Congress, there are a handful of Republican members in the mix for the gavel: Reps. Brett Guthrie (R-KY), Bob Latta (R-OH), and Richard Hudson (R-NC). At least two of them, Guthrie and Latta, reportedly oppose APRA. This, along with House Republican leadership’s posture as to APRA, suggests APRA may face an uphill battle if reintroduced in its current form in the 119th.
Rep. Frank Pallone (D-NJ) is the top Democrat on House E&C, and we expect he will retain that post. Though he wasn’t involved in the initial APRA draft, he ultimately cosponsored the bill. He has also signaled that children’s privacy is an important issue for him.
External Stakeholders
In any event, we expect robust debate and the opportunity for outside stakeholders to voice their positions if comprehensive privacy legislation is reintroduced next year. Notably, it appears that outside groups’ efforts on these bills has had an impact, which is a consideration to keep in mind in the new congress. At the markup of the APRA discussion draft in May, McMorris-Rodgers said the House Energy & Commerce Committee had considered hundreds of stakeholders’ input on the bill and would continue to do so. Pressure from outside groups also seemed to play a role in Speaker Johnson’s reported hesitations on APRA.
Federal Privacy Landscape: Enforcement
With the Federal Trade Commission (“FTC”) at the reins of federal privacy enforcement, we are also considering how the Commission may evolve in terms of leadership and enforcement priorities following the election. The five-person Commission is currently led by Democratic Chair Lina Khan and has a 3-2 Democratic majority, in line with the current Administration. Khan is generally aligned with the progressive end of the party, including with figures like Senator Elizabeth Warren (D-MA), especially with respect to her aggressive action on antitrust enforcement. It is unclear whether Vice President Kamala Harris, if she wins the presidency, would seek to replace Khan.
It is also unclear who President Trump, if elected, might appoint to lead the Commission, and new Administrations do not typically seek to promote a seated commissioner to the chair. In general, the average length of time for a new president to install a new FTC chair is about five months following inauguration. In the two most recent changes in Administration (Obama to Trump, and Trump to Biden), the new Administration appointed a sitting commissioner to serve as “Acting Chair.” That, however is a relatively recent phenomenon. In prior Administrations, the incoming Administration kept the existing Chair in place until a permanent Chair was selected. Vice Presidential candidate Senator JD Vance has spoken approvingly of Chair Khan, so it is entirely possible that she will stay at the helm for at least some period of time.
Were a new Chair to be designated, the next question is whether Chair Khan would stay on as a non-Chair Commissioner. There is little precedent for a Chair to remain at the Commission after a new Chair has been designated. But, were Chair Khan to leave, it would deadlock the Commission with two Republican and two Democratic members. If she were to stay on as a non-Chair Commissioner, the Democratic majority would continue, albeit under a Republican Acting Chair. Chair Khan’s term as a Commissioner expired on September 25, 2024, but under the terms of the FTC Act she can continue to serve until her successor is qualified.
In terms of enforcement priorities, the FTC has been active on privacy enforcement. In recent years, both Republican and Democratic Commissioners have emphasized holding “Big Tech” accountable, so we may see a similar cadence of privacy-related enforcement actions under a Republican-led FTC. We would expect, however, that the “commercial surveillance” rulemaking proceeding from which both Republican Commissioners dissented, would not be advanced under Republican leadership. Republican and Commissioners have historically been opposed to new “trade regulation rules” premised on the FTC’s authority to prohibit unfair and deceptive practices.
State Privacy Landscape
The state privacy landscape has evolved dramatically over the past few years, and we expect it will continue to do so following the election. In 2022, California was the only state with a comprehensive privacy law. Only two years later, 21 states have comprehensive privacy laws, and about as many could pass in the next couple of years.
This legal landscape has resulted in a much different enforcement environment. New privacy laws have only recently taken effect in about 10 states, but we have already seen active enforcement in multiple states—notably from states on both sides of the political aisle.
By 2026, all of the states with enacted privacy legislation will have taken effect. We are thus likely to see both more states enact comprehensive privacy laws and more privacy enforcement by state officials.
If you have any questions concerning the material discussed in this client alert, please contact the members of our Data Privacy and Cybersecurity practice.
Back
