# Plain Language Summary: American Data Privacy and Protection Act

This bill creates the first comprehensive federal privacy law to give Americans control over their personal information and hold companies accountable for how they use it. Right now, there's no single national rule protecting your data—companies can collect almost anything about you with minimal restrictions. This law would change that by requiring companies to be transparent about what data they're collecting, get your permission before using it in certain ways, and let you access, delete, or move your information.

The law applies to most businesses that collect personal data, from tech giants to retailers and service providers. It defines "covered data" broadly to include anything that identifies you or can be linked back to you—your name, location, browsing history, health information, biometric data like fingerprints, and even inferences companies make about you based on your behavior. Companies would have to collect only the minimum data they actually need, design their systems with privacy in mind from the start, and be honest about what they're doing with your information. They can't use dark patterns or tricky interface designs to manipulate you into sharing data or agreeing to things you don't understand.

The bill gives you specific rights: you can ask companies what data they have about you, request they delete it, opt out of having your information sold or used for targeted advertising, and object to decisions made by algorithms that affect you. It includes special protections for children and teenagers, who would need parental consent before companies collect their data. Companies would also need to ensure their algorithms don't discriminate based on race, color, national origin, or other protected characteristics. If companies violate these rules, they face enforcement action from the Federal Trade Commission, state attorneys general, and potentially lawsuits from individuals harmed by violations.

American Data Privacy and Protection Act

Pallone, Frank

American Data Privacy and Protection Act This bill establishes requirements for how companies, including nonprofits and common carriers, handle personal data, which includes information that identifies or is reasonably linkable to an individual. Specifically, the bill requires most companies to limit the collection, processing, and transfer of personal data to that which is reasonably necessary to provide a requested product or service and to other specified circumstances. It also generally prohibits companies from transferring individuals' personal data without their affirmative express consent. The bill establishes consumer data protections, including the right to access, correct, and delete personal data. Prior to engaging in targeted advertising, the bill requires companies to provide individuals with a means to opt out of such advertising. The bill also provides additional protections with respect to personal data of individuals under the age of 17. It further prohibits companies from using personal data to discriminate based on specified protected characteristics. Additionally, companies must implement security practices to protect and secure personal data against unauthorized access, and the Federal Trade Commission (FTC) may issue regulations for complying with this requirement. The bill provides for enforcement of these requirements by the FTC and state attorneys general. Beginning four years after the bill takes effect, individuals may, subject to certain notification requirements, bring civil actions for violations of the bill. Finally, the bill preempts state laws that are covered by the provisions of the bill except for certain categories of state laws and specified laws in Illinois and California.