What is ADPPA (American Data Privacy and Protection Act)?
A proposed comprehensive federal privacy law that would create nationwide data privacy standards for the United States — including data minimization requirements, civil rights protections, and a limited private right of action — but has repeatedly stalled in Congress.
Also known as: American Data Privacy and Protection Act, Federal Privacy Law, US Federal Privacy Bill
The United States is the only major democracy without a comprehensive federal privacy law. The ADPPA would change that — if Congress could agree on it.
Why the US Needs Federal Privacy Legislation
The Current Patchwork
- No federal privacy law covers all personal data
- 20+ state privacy laws with different requirements (California, Virginia, Colorado, Connecticut, etc.)
- Companies must comply with a patchwork of inconsistent state laws
- Consumers in states without privacy laws have virtually no protections
What Exists Federally
- HIPAA — Health data only
- FERPA — Education records only
- COPPA — Children under 13 only
- GLBA — Financial data only
- ECPA — Electronic communications (outdated, from 1986)
- Nothing covers general consumer data, social media, data brokers, or advertising
What ADPPA Would Do
Data Minimization
- Companies could only collect data that is reasonably necessary for the service provided
- No collecting data "just in case" or for unrelated advertising purposes
Civil Rights Protections
- Ban using personal data for discrimination in housing, employment, credit, and education
- Address algorithmic discrimination — AI systems that produce biased outcomes
Private Right of Action
- Allow individuals to sue companies for violations (the most controversial provision)
- Industry lobby has fought fiercely against this
Data Broker Regulation
- Create a national data broker registry
- Require easy opt-out mechanisms
Why It Keeps Failing
State Preemption Fight
- California doesn't want federal law to override its stronger state protections
- Industry wants a single federal standard that preempts stricter state laws
- This is the fundamental impasse
Industry Lobbying
- Tech companies, advertising industry, and data brokers spend hundreds of millions lobbying against strong privacy legislation
- The private right of action is the primary target
Political Division
- Both parties claim to support privacy but disagree on enforcement mechanisms
- Republican versions tend to favor FTC enforcement over private lawsuits
- Democratic versions tend to include stronger civil rights and private action provisions
What This Means for You
Without federal privacy legislation, your privacy rights depend entirely on which state you live in. A California resident has dramatically more protections than a resident of Texas, Florida, or any state without a comprehensive privacy law. Until Congress acts, the patchwork continues.
Related Terms
CCPA
The California Consumer Privacy Act grants California residents rights over their personal information, including the right to know what data is collected, delete it, opt out of its sale, and not be discriminated against for exercising these rights.
Data Broker
A company that collects personal information from various sources, aggregates it into detailed profiles, and sells it to third parties. Data brokers operate largely in the shadows, compiling information about people who often don't know they exist.
Data Minimization
A privacy principle that organizations should collect only the minimum amount of personal data necessary for a specific purpose, and retain it only as long as needed. This reduces privacy risks by limiting exposure in case of breaches or misuse.
GDPR
The General Data Protection Regulation is a comprehensive data protection law in the European Union that gives individuals control over their personal data. It establishes strict requirements for how organizations collect, process, store, and transfer personal information.
State Privacy Laws
US state-level data privacy legislation that fills the gap left by the absence of a comprehensive federal privacy law — with California, Virginia, Colorado, Connecticut, and others creating a patchwork of consumer privacy protections.
Have more questions?
Use our guided flow to get the right next privacy step for ADPPA (American Data Privacy and Protection Act).
Open Guided Flow