R48667 — Preemption and Privacy Law

Under the U.S. Constitution’s Supremacy Clause, Congress may displace state law when it is acting within its enumerated constitutional powers. In the realm of consumer privacy, Congress has largely chosen to leave state laws in place. Rather than adopting a single comprehensive consumer privacy law, Congress has enacted various privacy statutes that apply to particular industries and subcategories of data. These laws, which are often described as “sectoral” privacy laws, apply to health data, financial data, children’s data, telecommunications data, and credit reports, among other areas. These federal sectoral privacy laws generally leave room for states to supplement the federal requirements with their own standards. States, consequently, have increasingly adopted their own privacy laws. Many of these laws either build on the federal sectoral privacy laws or apply to new industries or types of data not covered by the federal laws. For example, some states have adopted laws that provide additional protections for genetic data, biometric data, or reproductive health data; some states have passed laws requiring online platforms to configure their settings to better protect children’s privacy; and some states have passed laws aimed at entities like data brokers, who compile and sell consumer data. An increasing number of states have taken the step of adopting comprehensive privacy laws that apply to nearly all forms of personal data within their jurisdictions. Between 2018 and the time of this writing, at least 19 states have adopted comprehensive consumer privacy laws. These laws generally provide a similar set of consumer rights (e.g., the right for consumers to request that businesses provide a copy of their personal data or to correct or delete their data) and business obligations (e.g., the obligation to give consumers the opportunity to opt out of the sale of their data or the use of their data for targeted advertising). With the burgeoning landscape of state privacy law, preemption will be a key question in any future federal privacy legislation. Any new federal privacy law will either displace or maintain state laws, depending on Congress’s intent. Congress could choose to preserve state privacy laws unless they directly conflict with the federal law, or it could choose to preempt all or most state privacy laws. Congress could further cabin a law’s preemptive scope by including a savings clause that expressly preserves certain types of state laws or remedies. Congress could also delegate preemption decisions to a federal agency. Comprehensive privacy bills introduced in past Congresses have taken varied approaches to preemption, including preserving most state laws, preempting most state laws, and combining a general preemption provision with a detailed savings clause.

Curated by CRS — every bill listed in this report's relatedMaterials. Edge type cited_in_report, gold confidence.

• HR 8818 — American Privacy Rights Act of 2024 · 118th Cong
• HR 2701 — Online Privacy Act of 2023 · 118th Cong