Barely a day before advancing out of subcommittee this week, lawmakers released a revised version of the American Privacy Rights Act (APRA), the proposed federal data privacy law that overrides stronger data protections of Californians and states across the country. The bill then advanced unanimously out of the House Innovation, Data, and Commerce Subcommittee to the full Energy and Commerce Committee on May 23 with no amendments.

The average person using the Internet spends almost seven hours a day in front of a device, whether it be a laptop, desktop, tablet or phone. That’s about 17 years spent checking the Internet beginning at age 18 until the age of 80. We check our phones on average of 144 times a day. This generates a lot of data.

We need good federal privacy legislation, but APRA contains a preemption provision that would take away years of progress made in California, which has established stronger protections with landmark legislation such as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA)

There was, however, no discussion amongst legislators regarding preemption during the markup. Rep. Jane Schakowsky (D-IL) said she was “disappointed” that biometric data such as fingerprints weren’t protected under APRA, but she and the rest of the subcommittee voted to move the bill forward. Under APRA, Illinois’ Biometric Information Privacy Act, which enshrines protections surrounding fingerprints and facial scans, would largely be preempted. 

And while a lack of protections surrounding certain sensitive information, profiling, and government service providers remain unchanged, the revised bill has grown from 53 to 174 pages.

Here are some notable changes from the original draft:

• Protections from targeted advertising. APRA’s initial draft already loosened protections around targeted advertising, an unregulated industry worth billions that has held our attention spans hostage, but now it goes a little further. For example, covered data, except for sensitive data, can now be collected “over time and across websites” to be used for target advertising. And under APRA, data collectors for government entities will still be able to combine different sets of data to execute targeted advertising. Energy and Commerce Ranking Member Frank Pallone (D-NJ) and Tim Walberg (R-MI) expressed concern about the definition of targeted advertising and how it can be a potential loophole. California’s law around targeted advertising protections are stronger.

• Weaker protections for children. Portions of the Children and Teens’ Online Privacy Protection Act, or COPPA 2.0, extending privacy rules to underaged people, have been folded into APRA. COPPA raised protections to children 16 and under, and banned targeted advertising to covered minors. Walberg, the bill’s co-sponsor, expressed concern about watered-down incorporations of the bill. “It has the skin but not the meat and bones.” Kathy Castor (D-FL), COPPA’s co-sponsor, had similar criticisms.

• Adding a mechanism to delete data not directly collected by data brokers. This is similar to California’s “Delete Act” directing data brokers to delete a person’s data, which is in effect in California right now.

Even any positive changes to the substance of APRA misses the point. With preemption still intact, states like California won’t be able to build upon or enforce their own data privacy laws. The authority of State Attorney Generals and California’s privacy agency would be greatly reduced. The law will be locked in, vulnerable to legislative change, but in California only the will of the voters can change laws like CPRA. There is no reason federal privacy legislation such as APRA can’t work in tandem with state laws that provide strong privacy rights. Congress should eliminate preemption and allow states to use the protections already at their disposal.

APRA still has a long journey before hitting the president’s desk for final approval. Stay tuned.

For more, read Consumer Watchdog’s letter to Congress detailing the weaknesses of the proposed legislation here.