Consumer Online Privacy Rights Act Could Safeguard Data, but Tough Fight Lies Ahead
Consumer Reports has no financial relationship with advertisers on this site.
Sen. Maria Cantwell, D-Wash., has introduced a piece of comprehensive federal privacy legislation, called the Consumer Online Privacy Rights Act, or COPRA, that could expand individual rights when it comes to how all sorts of personal data is collected, shared, and used.
Among its many provisions, the bill would require companies to collect as little information as possible about consumers, require explicit consent when sharing consumer data with third parties, and make companies responsible for correcting or deleting inaccurate information.
“I think consumers want strong privacy protections,” Cantwell said in an interview with Consumer Reports. “They’re very concerned about private and personal information being leaked and sold and trafficked.”
A number of digital privacy bills have been introduced in Congress this year, but COPRA is notable for its comprehensive approach as well as its attention to detail, according to privacy advocates including Justin Brookman, director of privacy and technology policy at Consumer Reports.
“It’s a good bill to have out there,” Brookman says. “It gets a lot of things right—companies shouldn’t be collecting cross-site profiles about me and sharing that information—and it’s pretty aggressive on those things.”
The proposed law expands the definition of sensitive information to include biometric details such as facial recognition data, as well as geolocation data that is collected as individuals go about their day-to-day lives.
The bill also calls for the creation of a new bureau under the Federal Trade Commission charged with enforcing COPRA. The law would deem violations to be “harmful and deceptive practices,” language that would strengthen the FTC’s hand in protecting consumers in digital privacy matters, according to privacy experts.
“The bill not only codifies privacy as a right—a measure long overdue—but it also recognizes that ‘rights’ that are unenforceable are empty gestures,” Georgetown University law professor David Vladeck said in a published statement.
The bill, co-sponsored by Sens. Brian Schatz, D-Hawaii, Amy Klobuchar, D-Minn., and Ed Markey, D-Mass., provides protections for whistleblowers, gives companies the responsibility to safeguard the security of consumer data and includes a data portability provision, which would force online companies to make it easy for consumers to transfer data—such as emails, photos, and friend lists—to another platform.
“It’s hard and it takes time to write a bill in a thoughtful way,” CR’s Brookman says. “They’ve tried really hard to think through what the answers are.”
A Reaction to California
Cantwell’s bill is being introduced shortly before the California Consumer Privacy Act goes into effect Jan. 1, 2020. That legislation will be the most sweeping privacy law in the nation, and experts say it may have a national effect as companies adopt the provisions of the law nationwide, much as carmakers have been building cars that comply with California’s auto emissions laws, which are stricter than federal guidelines.
California is just one of several states that have introduced or passed consumer privacy legislation. All this action on the state level has helped drive interest in creating a uniform, federal law. A national law could preempt state measures, however, potentially leading to weaker protections overall, according to legal experts.
Cantwell’s bill is more expansive than the California law in several important ways. It requires companies to get consumers to opt in to data sharing, rather than simply providing them with a way to opt out. It also enables individuals to sue companies that violate their privacy under the law, without having to prove that they were harmed financially or in some other way.
“Give consumers their due,” Cantwell told CR. “People rushed to get that California law in place and now [others] have tried to rush the federal law because they wanted to preempt California and any other state.”
COPRA currently lacks a Republican co-sponsor, which limits its prospects of becoming law in the near future. Hearings on the bill will be held in early December, but experts suggest that without bipartisan support—and the likely addition of language to preempt state privacy laws—it’s unlikely to pass this year. “Without bipartisan support, the calendar moves to 2021,” says Gaurav Laroia, senior policy counsel at Free Press, an internet advocacy group based in Washington, D.C.
“There are going to be some hard conversations,” about enforcement and other issues, Cantwell acknowledges. “But we’ve had very good discussions on where this needs to go, and [introducing the bill] will be very helpful in that process.”
“COPRA establishes a beachhead,” CR’s Brookman says. “While recognizing that there’s a longer fight ahead.”
More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples
Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2019, Consumer Reports, Inc.
