Yesterday, CDT released its top-level analysis of the “Commercial Privacy Bill of Rights Act of 2011,” (S. 799) introduced in the Senate by Sens. John Kerry (D-MA) and John McCain (R-AZ). It is the first comprehensive privacy bill introduced in the Senate in over a decade. CDT previously called the bill “a solid foundation” from which to develop a strong privacy protection framework, but this was the first time we drilled down into the bill to identify the things we like about it, and the things we’d like to see revised:
The highlights of what we see as the strengths of the bill:
Implements the full range of Fair Information Practice Principles for all consumer data
Lets the FTC develop standards for reasonable notice
Provides for industry-specific “safe harbor” programs, subject to FTC approval
Lets the FTC and state Attorneys General enforce the law and get penalties from violators
Includes a reasonably scoped “Right To Be Forgotten”
On the other hand, there are few things we think should be improved:
Definition of “first party” should to be narrowed to exclude affiliates and “established business relationships”
Should provide stronger incentives to companies to join “safe harbor” programs
Should allow for greater FTC rulemaking to provide clarity and certainty for consumers and businesses
Should address the collection of data by third parties, not just usage
All sensitive information should receive stronger application of the Fair Information Practice Principles
Should not weaken existing prohibitions on retroactive material changes to privacy policies
Should require companies who collect or use “all or substantially all” of a consumer’s online activity to get opt-in permission for collection and use
Should provide narrow preemption of state laws only if the final bill provides sufficiently strong protections for consumer data.
CDT believes that the introduction of this bipartisan bill represents an historical opportunity to enact the comprehensive privacy law that American consumers increasingly need in a complex data ecosystem. We look forward to working with the members of the Senate Commerce Committee in this legislation.
CDT and Partners Urge Passage of the California Location Privacy Act of 2025 (AB 322)
Location data is particularly sensitive, and when collected across time it can reveal a broad range of intrusive insights such as medical conditions, sexual orientation, political activities, and religious beliefs.
CDT and Allies Urge FCC Not to Violate Privacy of Cell Phone Buyers
CDT and EPIC led a coalition of 15 organizations in urging the FCC not to require phone companies to collect government IDs, physical addresses, and alternate phone numbers from every phone subscriber in the country.
As Brussels starts emptying for the summer, the risks of frontier AI models continue to capture the attention of policymakers as a key chapter of the AI Act becomes enforceable, and disclosure rules around the use of AI systems and AI-generated content are further clarified.
