Data Privacy

In recent years, the amount of personal information that is collected, used, shared, and sold has skyrocketed. Data-driven companies collect unprecedented amounts of personal information. This trend is only expected to accelerate. With the proper safeguards in place, the proliferation of personal information brings the promise of significant innovations that will benefit individuals, groups, and the broader society. But it also brings challenges, including the importance of providing consumers with robust privacy protections, especially people from groups that are discriminated against. Policymakers and the private sector play important roles in establishing the guardrails that allow data uses that bring lasting consumer benefits while providing consumer privacy protections aligned with AARP’s data privacy and security principles. 

Federal privacy laws: In contrast to many other countries’ comprehensive privacy laws, the U.S. has a patchwork of sector-specific federal privacy laws. For example, the Health Insurance Portability and Accountability Act, known as HIPAA, is designed to protect sensitive health information from being disclosed without a patient’s consent (see also Data Privacy policy). Other federal industry-specific privacy laws include the Fair Credit Reporting Act, Fair and Accurate Credit Transactions Act, Federal Educational Privacy Rights Act, Telephone Consumer Protection Act, and Graham-Leach-Bliley Act. The Children’s Online Privacy Protection Act protects the privacy of children under age 13. 

No federal agency currently has comprehensive authority to regulate consumer privacy. The Federal Trade Commission (FTC), however, regulates unfair or deceptive acts and practices related to privacy. It requires all companies to maintain reasonable privacy and security of personal information. The FTC’s jurisdiction has been extended through regulatory and court decisions to govern companies’ collection, storage, use, and sharing of personal information. Companies and organizations must properly disclose their privacy practices to consumers ahead of time. They must give consumers notice of their data practices and have consumers consent to those practices in advance. Generally, as long as they do so, they are protected from FTC enforcement, even if the practices they engage in cause consumer harm. As a result, companies and organizations typically have lengthy privacy disclosures. However, they do not always provide consumers with a meaningful ability to control how their data may be collected, analyzed, shared, and sold. 

State privacy laws: As of 2022, California, Colorado, Connecticut, Utah, and Virginia have enacted privacy laws. Some national companies are applying these consumer protection laws to consumers across the U.S. 

California has one of the strongest privacy laws. It provides California consumers with control over their personal information. The statue, known as the California Consumer Privacy Act, contains many provisions similar to the European Union’s General Data Protection Regulation. It allows California consumers to review, delete, and opt out of data sharing and sale. They also have a right to correct inaccurate information. Consumers also may limit the internal uses of sensitive personal information. The California law also includes a data minimization requirement. This limits data collection, use, retention, and sharing to what is “reasonably necessary” for a product or service to work. 

California now also has a dedicated privacy agency, the California Privacy Protection Agency. The agency has primary responsibility for enforcing the law. A private right of action exists only for security breaches. The creation of a single agency dedicated to protecting consumer privacy increases the likelihood that it will have the resources and expertise it needs to effectively conduct rulemaking, oversight, and enforcement. 

Data brokers: Data brokers collect, collate, analyze, and sell billions of data points about consumers’ online and offline behavior. Such companies often collect information about financial, retail, recreational, and online browsing activities to create detailed profiles of individual consumers. These profiles allow data brokers to make inferences about people based on the data they collect. For example, they might infer consumer interests about potentially sensitive topics related to age, race and ethnicity, or health-related conditions. 

Data brokers are mostly unregulated. As of 2022, the only regulations that exist are the California privacy law and a Vermont law requiring that data brokers register with the state. Unlike consumer reporting agencies, commonly known as credit bureaus, federal law does not require data brokers to provide consumers with access to the information they have collected about them. As a result, most consumers are unaware that data brokers exist. They also generally do not know what kind of information is being sold to other companies. Even if they do, federal law does not provide them with core privacy rights to review their personal files; decide how data may be used, shared, or sold; correct inaccuracies; or delete data.