SILICON VALLEY, CA – Today, Congresswomen Anna G. Eshoo (CA-18) and Zoe Lofgren (CA-19) introduced the Online Privacy Act of 2019, H.R. 4978, sweeping legislation that creates user rights, places obligations on companies to protect users’ data, establishes a new federal agency to enforce privacy protections, and strengthens enforcement of privacy law violations.

“Every American is vulnerable to privacy violations with few tools to defend themselves,” said Rep. Eshoo. “Too often, our private information online is stolen, abused, used for profit, or grossly mishandled. We’re proud to introduce the Online Privacy Act to restore and protect the American people’s right to privacy. Our legislation ensures that every American has control over their own data, companies are held accountable, and the government provides tough but fair oversight.”

“Our country urgently needs a legal framework to protect consumers from the ever-growing data-collection and data-sharing industries that make billions annually off Americans’ personal information,” said Rep. Lofgren. “Privacy for online consumers has been nonexistent – and we need to give users control of their personal data by making legitimate changes to business practices. The Online Privacy Act creates a robust framework that balances the actual needs of businesses with fair privacy rights and expectations for users.”

The Online Privacy Act protects individuals, encourages innovation, and restores trust in technology companies by:

Creating User Rights – The bill grants every American the right to access, correct, or delete their data. It also creates new rights, like the right to impermanence, which lets users decide how long companies can keep their data.

The bill grants every American the right to access, correct, or delete their data. It also creates new rights, like the right to impermanence, which lets users decide how long companies can keep their data. Placing Clear Obligations on Companies – The bill minimizes the amount of data companies collect, process, disclose, and maintain, and bars companies from using data in discriminatory ways. Additionally, companies must receive consent from users in plain, simple language.

– The bill minimizes the amount of data companies collect, process, disclose, and maintain, and bars companies from using data in discriminatory ways. Additionally, companies must receive consent from users in plain, simple language. Establishing a Digital Privacy Agency (DPA) – The bill establishes an independent agency led by a Director that’s appointed by the President and confirmed by the Senate for a five-year term. The DPA will enforce privacy protections and investigate abuses.

– The bill establishes an independent agency led by a Director that’s appointed by the President and confirmed by the Senate for a five-year term. The DPA will enforce privacy protections and investigate abuses. Strengthening Enforcement – The bill empowers state attorneys general to enforce violations of the bill and allows individuals to appoint nonprofits to represent them in private class action lawsuits.

Click here to read a one-page summary of the bill.

Click here to read a section-by-section breakdown of the bill.

Click here to download the full text of the bill.

The Online Privacy Act has received strong support from public interest organizations and privacy experts:

“The Electronic Privacy Information Center carefully reviewed the privacy bills pending in Congress and we have now rated the Online Privacy Act #1. The bill by Reps. Eshoo and Lofgren sets out strong rights for Internet users, promotes innovation, and establishes a data protection agency. This is the bill that Congress should enact.” – Caitriona Fitzgerald, Policy Director of the Electronic Privacy Information Center (EPIC)

“The Online Privacy Act of 2019 by Representatives Eshoo and Lofgren is a significant milestone as lawmakers around the world take critical aim at the surveillance-based economics that now dominate the internet. This legislation is a game-changer in several key ways. First, it reframes the privacy debate from the notoriously flawed regime of “notice and consent” to the human rights of users. Also, the Act establishes a long overdue Digital Privacy Agency with important new investigatory, legal, and law enforcement powers. This legislation helps to define a new era in our nation and around the world as citizens seek an alternative road to a digital future, one that is compatible with the rights of individuals and the aspirations of a democratic society.” – Shoshana Zuboff, Professor Emerita at Harvard Business School and author of The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power

“The Eshoo-Lofgren Online Privacy Act marks a major moment in the ongoing legislative debate around consumer privacy. It addresses the real harms people face from privacy invasions, like the chilling of free expression, stigmatization and reputational harm, and harmful price discrimination by business models reliant on pervasive and constant data collection. It gives people the legal tools necessary to protect themselves from practices that limit their economic opportunities based on their personal characteristics like race, gender, sexuality or disability. Safeguarding our right to privacy is an essential part of ensuring that the benefits of our connected age accrue to everyone - not just the powerful few.” – Gaurav Laroia, Senior Policy Counsel at Free Press Action

“Public Knowledge applauds the Online Privacy Act of 2019 as a serious effort to provide comprehensive privacy protection for all Americans. Representatives Eshoo and Lofgren have offered a roadmap for users to assert control of their lives online with a strong, federal baseline of much-needed privacy protections. Everyone deserves better protections online, and this bill charts a path toward achieving them.” – Dylan Gilbert, Policy Counsel at Public Knowledge

###