Pacific Northwest voters overwhelmingly support proposed American Privacy Rights Act of 2024, NPI poll finds

Bipar­ti­san leg­is­la­tion pro­posed by U.S. Sen­a­tor Maria Cantwell and U.S. Rep­re­sen­ta­tive Cathy McMor­ris Rodgers that would cre­ate a ground­break­ing fed­er­al data pri­va­cy law is extreme­ly pop­u­lar with vot­ers in the Pacif­ic North­west, who favor it by a more than sev­en-to-one mar­gin, a recent tri-state sur­vey con­duct­ed for NPI has found.

67% of 1,012 like­ly Novem­ber 2024 vot­ers sur­veyed last month by Civiqs for the North­west Pro­gres­sive Insti­tute in Wash­ing­ton, Ore­gon, and Ida­ho say they sup­port the pro­posed Amer­i­can Pri­va­cy Rights Act of 2024, while only 9% are opposed. 

A sig­nif­i­cant per­cent­age, 24%, say they aren’t sure.

The leg­is­la­tion nego­ti­at­ed by Cantwell and McMor­ris Rodgers is cur­rent­ly in what’s known as the dis­cus­sion draft stage. That means it’s been put into the form of leg­is­la­tion, but it has­n’t been for­mal­ly intro­duced yet. Cantwell is the Chair of the Sen­ate Com­merce Com­mit­tee in the Demo­c­ra­t­ic-con­trolled Sen­ate and McMor­ris Rodgers is the Chair of the House Ener­gy and Com­merce Com­mit­tee in the Repub­li­can-con­trolled House, so they are well posi­tioned to try to get this leg­is­la­tion to Pres­i­dent Biden’s desk. It won’t be easy giv­en the dynam­ics in this Con­gress, but there is a path. 

Past efforts to pass a fed­er­al data pri­va­cy law may have foundered, but this effort ben­e­fits from the lead­er­ship of Sen­a­tor Cantwell, who is wide­ly con­sid­ered to be of the Sen­ate’s sharpest minds on tech­nol­o­gy issues. Cantwell has a lot of trust and cred­i­bil­i­ty with tech com­pa­nies and pri­va­cy advo­cates because of her long track record of push­ing for FISA reforms and oppos­ing bad bills like SOPA and PIPA, which NPI was heav­i­ly involved in work­ing to defeat twelve years ago. 

The basics of the Amer­i­can Pri­va­cy Rights Act of 2024, accord­ing to Cantwell and McMor­ris Rodgers, are as follows:

Estab­lish­es Foun­da­tion­al Uni­form Nation­al Data Pri­va­cy Rights for Americans 

• Puts peo­ple in con­trol of their own per­son­al data. 
• Elim­i­nates the patch­work of state laws by set­ting one nation­al pri­va­cy stan­dard, stronger than any state. 
• Min­i­mizes the data that com­pa­nies can col­lect, keep and use about peo­ple, of any age, to what com­pa­nies actu­al­ly need to pro­vide them prod­ucts and services. 
• Gives Amer­i­cans con­trol over where their per­son­al infor­ma­tion goes, includ­ing the abil­i­ty to pre­vent the trans­fer or sell­ing of their data. The bill also allows indi­vid­u­als to opt out of data pro­cess­ing if a com­pa­ny changes its pri­va­cy policy. 
• Pro­vides stricter pro­tec­tions for sen­si­tive data by requir­ing affir­ma­tive express con­sent before sen­si­tive data can be trans­ferred to a third party.
• Requires com­pa­nies to let peo­ple access, cor­rect, delete and export their data.
• Allows indi­vid­u­als to opt out of tar­get­ed advertising. 

Gives Amer­i­cans the Abil­i­ty to Enforce Their Data Pri­va­cy Rights

• Gives indi­vid­u­als the right to sue bad actors who vio­late their pri­va­cy rights—and recov­er mon­ey for dam­ages when they’ve been harmed. 
• Pre­vents com­pa­nies from enforc­ing manda­to­ry arbi­tra­tion in cas­es of sub­stan­tial pri­va­cy harm.

Pro­tects Amer­i­cans’ Civ­il Rights

• Stops com­pa­nies from using people’s per­son­al infor­ma­tion to dis­crim­i­nate against them.
• Allows indi­vid­u­als to opt out of a company’s use of algo­rithms to make deci­sions about hous­ing, employ­ment, health­care, cred­it oppor­tu­ni­ties, edu­ca­tion, insur­ance or access to places of pub­lic accommodation.
• Requires annu­al reviews of algo­rithms to ensure they do not put indi­vid­u­als, includ­ing our youth, at risk of harm, includ­ing discrimination.

Holds Com­pa­nies Account­able and Estab­lish­es Strong Data Secu­ri­ty Obligations

• Man­dates strong data secu­ri­ty stan­dards that will pre­vent data from being hacked or stolen. This lim­its the chances for iden­ti­ty theft and harm.
• Makes exec­u­tives take respon­si­bil­i­ty for ensur­ing that com­pa­nies take all actions nec­es­sary to pro­tect cus­tomer data as required by the law.
• Ensures indi­vid­u­als know when their data has been trans­ferred to for­eign adversaries.
• Autho­rizes the Fed­er­al Trade Com­mis­sion, states and con­sumers to enforce against violations. 

Focus­es on the Busi­ness of Data, Not Main­street Business

• Small busi­ness­es, who are not sell­ing their cus­tomers’ per­son­al infor­ma­tion, are exempt from the require­ments of this bill.

Read the dis­cus­sion draft:

Although the leg­is­la­tion would pre­empt past as well as future state law­mak­ing on data pri­va­cy, there may not be much of a prac­ti­cal effect. That’s because many states have yet to leg­is­late in this area at all, while key pri­va­cy pro­tec­tions from the few states that have passed data pri­va­cy laws — like Cal­i­for­nia, Indi­ana, or Mary­land — have been rolled into this pro­posed fed­er­al law, which would cov­er the entire country.

In our sur­vey, we did our best to quick­ly sum­ma­rize the key aspects of the law while also not­ing that it would pre­empt states from poten­tial­ly pass­ing stronger data pri­va­cy laws in the future. As you can see, that’s not a deal­break­er for PNW vot­ers. Here’s the exact text of the ques­tion that we asked and the respons­es we received:

QUESTION: Demo­c­ra­t­ic U.S. Sen­a­tor Maria Cantwell and Repub­li­can U.S. Rep­re­sen­ta­tive Cathy McMor­ris Rodgers are propos­ing bipar­ti­san leg­is­la­tion called the Amer­i­can Pri­va­cy Rights Act of 2024, which would cre­ate a first-of-its-kind fed­er­al data pri­va­cy law for the whole coun­try. The pro­posed law would require com­pa­nies to let peo­ple access, cor­rect, delete, and export their sen­si­tive and per­son­al data like bio­met­ric infor­ma­tion. It would also require com­pa­nies to obtain explic­it user per­mis­sion before sell­ing or trans­fer­ring data. Addi­tion­al­ly, Amer­i­cans would be able to com­plete­ly opt out of tar­get­ed adver­tis­ing and bring law­suits against bad actors who vio­late their pri­va­cy rights. How­ev­er, tougher data pri­va­cy laws at the state lev­el, like that of Cal­i­for­ni­a’s, would no longer be in effect. What is your view: do you sup­port or oppose con­gres­sion­al pas­sage of a new fed­er­al data pri­va­cy law that would pre­empt state data pri­va­cy laws?

RESPONSES:

• Sup­port: 67% 
  • Strong­ly sup­port: 34%
  • Some­what sup­port: 33%
• Oppose: 9%
  • Some­what oppose: 5%
  • Strong­ly oppose: 4%
• Not sure: 24%

Our poll of 1,012 like­ly vot­ers was in the field from April 13th-16th, 2024. 

The sur­vey was con­duct­ed entire­ly online, among select­ed mem­bers of the Civiqs research pan­el, and it has a mar­gin of error of ± 3.4% at the 95% con­fi­dence lev­el. 598 of the respon­dents inter­viewed were from Wash­ing­ton, 246 were from Ore­gon, and 168 were from Ida­ho. (Reflect­ing its larg­er pop­u­la­tion as mea­sured in the last nation­al cen­sus, Wash­ing­ton has as many elec­toral votes as Ore­gon and Ida­ho put togeth­er — twelve! — and that’s why the sam­ple has more Wash­ing­ton vot­ers in it.)

Results by state and political party

Sup­port for the Amer­i­can Pri­va­cy Rights Act of 2024 is strong through­out the region and spans the ide­o­log­i­cal spec­trum. Democ­rats, Repub­li­cans, and inde­pen­dents are all sup­port­ive, demon­strat­ing that there are still some issues that both draw bipar­ti­san agree­ment and have broad pop­u­lar appeal. 

By state

WASHINGTON

• Sup­port: 71% 
  • Strong­ly sup­port: 38%
  • Some­what sup­port: 33%
• Oppose: 8%
  • Some­what oppose: 4%
  • Strong­ly oppose: 4%
• Not sure: 22%

OREGON

• Sup­port: 65% 
  • Strong­ly sup­port: 32%
  • Some­what sup­port: 33%
• Oppose: 8%
  • Some­what oppose: 5%
  • Strong­ly oppose: 3%
• Not sure: 27%

IDAHO

• Sup­port: 60% 
  • Strong­ly sup­port: 29%
  • Some­what sup­port: 31%
• Oppose: 16%
  • Some­what oppose: 6%
  • Strong­ly oppose: 10%
• Not sure: 23%

By party

DEMOCRATS

• Sup­port: 71% 
  • Strong­ly sup­port: 34%
  • Some­what sup­port: 37%
• Oppose: 5%
  • Some­what oppose: 4%
  • Strong­ly oppose: 1%
• Not sure: 24%

REPUBLICANS

• Sup­port: 56% 
  • Strong­ly sup­port: 31%
  • Some­what sup­port: 25%
• Oppose: 15%
  • Some­what oppose: 5%
  • Strong­ly oppose: 10%
• Not sure: 30%

INDEPENDENTS

• Sup­port: 72% 
  • Strong­ly sup­port: 38%
  • Some­what sup­port: 34%
• Oppose: 10%
  • Some­what oppose: 5%
  • Strong­ly oppose: 5%
• Not sure: 18%

Of note is that inde­pen­dents are, by a slight mar­gin, the most sup­port­ive of the above three groups of vot­ers and have the most inten­si­ty of sup­port. Near­ly two out of five inde­pen­dent vot­ers are strong­ly sup­port­ive, and anoth­er third are some­what sup­port­ive, for a total of more than sev­en out of ten enthusiastic.

Cantwell and McMor­ris Rodgers also have stake­hold­er sup­port for the legislation.

Samir Jain, the Cen­ter for Democ­ra­cy and Tech­nol­o­gy’s Vice Pres­i­dent of Pol­i­cy, char­ac­ter­ized the bill as a renewed oppor­tu­ni­ty to fin­ish the long over­due job of pass­ing a fed­er­al pri­va­cy law. 

“APRA builds on the many pri­or pri­va­cy bills from both par­ties and includes crit­i­cal ele­ments nec­es­sary for an effec­tive pri­va­cy law: data min­i­miza­tion, effec­tive con­sumer rights, pro­hi­bi­tion of dis­crim­i­na­tion, restric­tions on data bro­kers, require­ments for data secu­ri­ty, and an enforce­ment regime with com­ple­men­tary roles for the Fed­er­al Trade Com­mis­sion (FTC), state Attor­neys Gen­er­al, and indi­vid­u­als,” said Jain. “CDT is encour­aged by the release of the bipar­ti­san and bicam­er­al draft of APRA, and thanks this Com­mit­tee for its bipar­ti­san work to con­sid­er and advance com­pre­hen­sive pri­va­cy leg­is­la­tion. The time for a com­pre­hen­sive fed­er­al pri­va­cy law is long overdue.”

Microsoft is also supportive.

“Con­sumers and busi­ness across the Unit­ed States have long deserved clear, strong, and com­pre­hen­sive pri­va­cy pro­tec­tions,” said Brad Smith, Microsoft­’s Pres­i­dent. “The pri­va­cy bill unveiled by Chairs Cantwell and McMor­ris Rodgers is a good deal.”

“Their will­ing­ness to work across par­ty lines on an issue of com­mon cause has led to a bill that would give all con­sumers in the U.S. robust rights and pro­tec­tions. It would also pro­vide clar­i­ty by estab­lish­ing a nation­al stan­dard. We applaud Sen­a­tor Maria Cantwell and Rep­re­sen­ta­tive Cathy McMor­ris Rodgers for their bipar­ti­san lead­er­ship, sup­port their efforts to pass a com­pre­hen­sive fed­er­al pri­va­cy law, and look for­ward to work­ing with the com­mit­tees as the bill moves forward.”

The Lawyers’ Com­mit­tee for Civ­il Rights Under Law is encour­aged too.

“[We] are encour­aged by the new Amer­i­can Pri­va­cy Rights Act (APRA), a bipar­ti­san and bicam­er­al effort to safe­guard data pri­va­cy and civ­il rights online,” said David Brody, Man­ag­ing Attor­ney of the Dig­i­tal Jus­tice Ini­tia­tive. “Pass­ing com­pre­hen­sive pri­va­cy leg­is­la­tion would be a major advance­ment for the pub­lic good. I would like to thank Chair McMor­ris Rodgers and Sen­a­tor Cantwell for pro­duc­ing this impres­sive achievement.”

Less enthu­si­as­tic is the Elec­tron­ic Fron­tier Foun­da­tion (EFF), a long­time cham­pi­on of dig­i­tal lib­er­ties and pri­va­cy. Their team does­n’t like the bil­l’s pre­emp­tion clause. 

“EFF is con­cerned that a new fed­er­al bill would freeze con­sumer data pri­va­cy pro­tec­tions in place, by pre­empt­ing exist­ing state laws and pre­vent­ing states from cre­at­ing stronger pro­tec­tions in the future,” staff attor­ney F. Mario Tru­jil­lo wrote in a post last month. “Fed­er­al law should be the floor on which states can build, not a ceiling.

“We also urge the authors of the Amer­i­can Pri­va­cy Rights Act to strength­en oth­er por­tions of the bill. It should be eas­i­er to sue com­pa­nies that vio­late our rights. The bill should lim­it shar­ing with the gov­ern­ment and expand the def­i­n­i­tion of sen­si­tive data. And it should nar­row excep­tions that allow com­pa­nies to exploit our bio­met­ric infor­ma­tion, our so-called ‘de-iden­ti­fied’ data, and our data obtained in cor­po­rate ‘loy­al­ty’ schemes.”

“Despite our con­cerns with the APRA bill, we are glad Con­gress is piv­ot­ing the debate to a pri­va­cy-first approach to online reg­u­la­tion,” Tru­jil­lo emphasized. 

“Rein­ing in com­pa­nies’ mas­sive col­lec­tion, mis­use, and trans­fer of everyone’s per­son­al data should be the uni­fy­ing goal of those who care about the inter­net. This debate has been absent at the fed­er­al lev­el in the past year, giv­ing breath­ing room to flawed bills that focus on cen­sor­ship and con­tent block­ing, rather than privacy.” 

If Con­gress had strong pro­gres­sive majori­ties in both cham­bers, hold­ing out for a stronger bill as EFF sug­gests would make sense — but that’s not the envi­ron­ment we’re oper­at­ing in. Any pol­i­cy that’s going to reach Pres­i­dent Joe Biden’s desk this Con­gress needs to be able to win bipar­ti­san sup­port and not get stymied by a Sen­ate fil­i­buster. Con­sid­er­ing that it is the prod­uct of bicam­er­al, bipar­ti­san nego­ti­a­tions between law­mak­ers on oppo­site ends of the polit­i­cal spec­trum, the Amer­i­can Pri­va­cy Rights Act is a strong, sub­stan­tive bill. In our view, it would be a big improve­ment over the sta­tus quo.

Tru­jil­lo warns of the down­sides of pre­emp­tion, assert­ing: “States are more nim­ble at pass­ing laws to address new pri­va­cy harms as they arise, com­pared to Con­gress which has failed for decades to update impor­tant protections.”

“For exam­ple, if law­mak­ers in Wash­ing­ton state want­ed to fol­low EFF’s advice to ban online behav­ioral adver­tis­ing or to allow its cit­i­zens to sue com­pa­nies for not min­i­miz­ing their col­lec­tion of per­son­al data (pro­vi­sions where APRA falls short), state leg­is­la­tors would have no pow­er to do so under the new fed­er­al bill.”

That may be, but we think it’s an accept­able trade­off to get a fed­er­al data pri­va­cy law that will pro­tect mil­lions more peo­ple than laws at the state lev­el can. 

Tru­jil­lo brought up Wash­ing­ton, NPI’s home state, in the dis­cus­sion quot­ed above, but Wash­ing­ton isn’t a great exam­ple for the point he’s mak­ing because, unlike Cal­i­for­nia, we haven’t been able to pass a com­pre­hen­sive data pri­va­cy law despite hav­ing had a Demo­c­ra­t­ic tri­fec­ta for over half a decade. And not for lack of try­ing: Many NPI allies have been work­ing on the issue with State Rep­re­sen­ta­tive Shel­ley Klo­ba (D‑1st Dis­trict: King + Sno­homish coun­ties), but haven’t been able to get a bill to the gov­er­nor’s desk. 

In 2023, Wash­ing­ton law­mak­ers did pass a repro­duc­tive health pri­va­cy law spon­sored by State Rep­re­sen­ta­tive Van­dana Slat­ter — My Health, My Data, which our team worked on with Attor­ney Gen­er­al Bob Fer­gu­son and found was extreme­ly pop­u­lar — but that impor­tant, pio­neer­ing law would­n’t be pre­empt­ed by the Amer­i­can Pri­va­cy Rights Act. 

The old proverb that a bird in hand is worth two in the bush seems applic­a­ble here. Cal­i­for­nia has done what it can to raise the bar on dig­i­tal pri­va­cy and prod Con­gress into action. It’s unlike­ly many oth­er states will fol­low suit in the near future. The Amer­i­can Pri­va­cy Rights Act has both sup­port and promise. It’s a way for­ward. We should take it.