American Data Privacy Act: What It Covered and Why It Stalled

The American Data Privacy and Protection Act is a bipartisan federal privacy bill, introduced in June 2022 as H.R. 8152, that would have created the first comprehensive national rules for how companies collect, use, and share personal data. It is not law. The bill cleared the House Energy and Commerce Committee but never received a floor vote, and it expired when the 117th Congress ended in January 2023.¹ A follow-on proposal, the American Privacy Rights Act, was introduced in 2024 and also stalled in committee.²

The bill still matters. Its definitions and structure keep resurfacing in newer federal proposals, and several state privacy laws passed since 2022 borrow directly from it. Everything below describes what the ADPPA would have required if it had passed, not what companies must do today.

What the Bill Would Have Required

Data Minimization as the Default

Section 101 was the heart of the bill. Companies could only collect, process, or transfer personal data when doing so was “reasonably necessary and proportionate” to deliver a product or service the person actually asked for, or to carry out a short list of permitted purposes.³ Those permitted purposes were mostly operational: completing transactions, system maintenance, authenticating users, detecting fraud, complying with legal obligations, and preventing serious harm.

Vague justifications such as “improving the user experience” or unspecified “future product development” would not have qualified. The practical shift is significant. Under current U.S. norms, many companies collect whatever data they can and justify it later. Under the ADPPA, the burden flipped: the company would need to explain why each data point was necessary before collecting it.

What Counted as Covered Data

“Covered data” meant information that identifies or is reasonably linkable to a person or to a device tied to a person, including derived data and persistent identifiers like advertising IDs and device fingerprints.³ Three categories were left out: de-identified data, employee data used strictly for employment-related purposes, and publicly available information. The employee exception was narrow. An employer that reused staff data for marketing or sold it to a third party would have lost the exemption for that data.

Sensitive Data and Express Consent

A broader “sensitive covered data” category triggered stricter rules. It reached well beyond the usual list:

Government identifiers: Social Security numbers, passport numbers, driver’s license numbers.
Health, medical, and genetic information.
Financial account numbers and the credentials that access them.
Biometric information, including fingerprints, voiceprints, retina scans, and facial recognition data.
Precise geolocation.
Private communications: emails, texts, direct messages, voicemails, and the metadata identifying who was communicating.
Race, ethnicity, national origin, religion, sexual orientation, and union membership.
Browsing behavior tracked across third-party websites over time.
Photos, videos, audio, calendars, and address books stored on a device for private use.
Any data from a person under 17.

Before collecting or transferring anything on that list, a company would have needed affirmative express consent. Pre-checked boxes and buried terms-of-service language would not count. Consent had to be specific, informed, and freely given.⁴

Your Rights Over Your Data

Section 203 would have given individuals four core rights:

Access to a human-readable copy of your covered data from the preceding 24 months, along with the categories of third parties and service providers who received it.
Correction of verifiable, substantial inaccuracies, with reasonable efforts to notify third parties who received the incorrect data.
Deletion, with similar third-party notification obligations.
Portability in a machine-readable format so you could take your data to another service.

Response deadlines scaled with company size: 45 days for large data holders, 60 days for midsize covered entities, and 90 days for qualifying small businesses. No fees.³ Individuals could also opt out of targeted advertising and restrict transfers of their data to third parties. The FTC would have studied whether a single browser-based opt-out signal, such as the Global Privacy Control, could be recognized as a valid way to exercise these rights across all covered entities at once, and would have been required to formalize such a mechanism through rulemaking if it found one workable.

Children Under 17

Section 205 imposed the bill’s strictest requirements on data from anyone under 17. Targeted advertising to minors was flatly prohibited. Transfers of a minor’s data to third parties required consent. And because all data from people under 17 was treated as sensitive covered data, the heightened minimization and consent rules automatically applied. The only narrow exception allowed collection and transfer solely to report child victimization to law enforcement or to a congressionally designated clearinghouse for missing and exploited children.

Who Would Have Been Covered

The ADPPA reached any person or organization that collects, processes, or transfers personal data and falls under FTC jurisdiction. Unlike most existing privacy frameworks, it extended to nonprofits and to common carriers.⁵ Government agencies and their contractors were excluded.

The Small Business Threshold

Section 209 offered reduced obligations to small businesses, but only if the entity met all three of these tests over the preceding three calendar years:

Average annual gross revenue below $41 million.
Data from no more than 200,000 individuals per year, beyond what was needed to process payments (payment data deleted or de-identified within 90 days did not count).
Less than 50 percent of revenue in any year of the period from transferring covered data.

Qualifying small businesses were exempt from data portability and several transparency requirements, and could satisfy correction requests by deleting the data instead of fixing it.³ Earlier summaries in circulation cited figures of $25 million and 50,000 individuals; the actual bill text sets the bar considerably higher.

Large Data Holders

At the top of the scale, “large data holders” were entities with at least $250 million in annual gross revenue that also handled covered data from more than five million individuals. They faced the shortest response deadlines, an annual executive certification to the FTC that internal compliance controls were in place, biennial audits, and dedicated privacy and security officers, with one of them reporting directly to the company’s highest-ranking official.

Data Brokers

The bill treated “third-party collecting entities,” meaning companies whose principal revenue comes from processing or transferring data they did not collect from the person themselves, as a distinct category. Any such entity handling data on more than 5,000 individuals or devices in a year would have had to register annually with the FTC by January 31, pay a $100 fee, and post a conspicuous notice on its website identifying itself as a data broker. On a deletion request, a registered entity had 30 days to comply and was then barred from collecting that person’s data again without affirmative express consent. Failure to register or post the notice carried penalties of $100 per day, capped at $10,000 per year, on top of unpaid fees.⁶

How It Would Have Been Enforced

The FTC would have been the primary federal enforcer, with a new Bureau of Privacy to handle day-to-day administration. State attorneys general and state privacy agencies could bring civil actions in federal court on behalf of residents, seeking injunctions, damages, civil penalties, restitution, and attorney fees.³

The bill also included a private right of action letting individuals or classes sue covered entities in federal court for damages, injunctive relief, litigation costs, and attorney fees. It was set to take effect two years after enactment rather than immediately, as a transition for businesses.⁵ Consumer advocates called the provision essential to real enforcement, arguing that federal and state agencies alone cannot police the entire data economy. Industry groups said it would invite frivolous suits. The two-year delay was the compromise, and it never fully quieted either side.

Why the Bill Stalled

Preemption of state law was the biggest obstacle. The ADPPA would have overridden most state privacy laws and replaced them with a single federal standard. Industry favored one set of rules; states with strong existing protections, California most of all, resisted. A savings clause preserved certain state laws of general applicability, data breach notification statutes, employee and health privacy laws, the Illinois Biometric Information Privacy Act, and California’s private right of action for data breach victims under the CCPA.⁷ Entities already complying with sector-specific laws such as HIPAA, the Fair Credit Reporting Act, and Gramm-Leach-Bliley would have been deemed compliant with the ADPPA for data covered by those laws, though the ADPPA’s cybersecurity requirements still applied.

California’s privacy agency formally opposed the bill, saying it would weaken the protections Californians already had and would prevent states from continuing to develop their own rules.⁸ The preemption fight, disputes over the strength of the private right of action, and disagreement over whether federal rules should be a floor or a ceiling combined to keep the bill off the floor.

What Actually Applies to You Now

Because the ADPPA never became law and its 2024 successor also stalled, the United States still has no comprehensive federal privacy statute. The rules that actually govern how companies handle your personal data are the state privacy laws that have passed in the meantime, including those in California, Colorado, Virginia, and Connecticut, along with the sector-specific federal laws that already exist for health information, credit reporting, and financial services. More than a dozen states now have comprehensive privacy laws on the books, producing the patchwork the ADPPA was designed to replace.

1
Congress.gov. H.R.8152 – American Data Privacy and Protection Act
2
Congress.gov. The American Privacy Rights Act
3
Congress.gov. H.R.8152 – American Data Privacy and Protection Act – Text
4
Congress.gov. H.R.8152 – American Data Privacy and Protection Act
5
Congress.gov. Overview of the American Data Privacy and Protection Act, H.R. 8152
6
Lawfare. Data Broker Registries in Bills: the ADPPA and the DELETE Act
7
Congress.gov. Preemption and Privacy Law
8
California Privacy Protection Agency. The California Privacy Protection Agency Opposes the American Privacy Rights Act