How the APRA draft moved privacy compliance to the customer’s side of the counter
The American Privacy Rights Act draft never passed. Its distinctive features let individuals act directly, through requests, machine-readable opt-out signals and lawsuits. Those three channels, already arriving through state law, are where regulated organizations’ privacy programs are now judged.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On April 7, 2024, Senate Commerce Committee Chair Maria Cantwell and House Energy and Commerce Committee Chair Cathy McMorris Rodgers released a bipartisan discussion draft of the American Privacy Rights Act. It was the first serious federal attempt since the 2022 American Data Privacy and Protection Act stalled. Like its predecessor, it centered on data minimization and preempted most state comprehensive privacy laws. Entities complying with the Gramm-Leach-Bliley Act or HIPAA would be deemed compliant for data covered by those laws. The draft gave individuals rights to access, correct, delete and export their data. It required opt-outs for targeted advertising and data transfers, an FTC-defined universal opt-out mechanism, and a right to opt out of covered algorithms used for consequential decisions. Data brokers would register with the FTC and honor a central do-not-collect request. Individuals could sue directly, and arbitration clauses would not bind certain claims.
Earlier in this series we looked at the 2022 federal privacy bill and argued that its lasting contribution was data minimization: a design rule applied to data rather than to whole regulated institutions. The 2024 draft kept that rule and that carve-out structure. What it changed was who would act on them. Most American privacy compliance had been organized around regulators: policies, notices and audits written for an examiner or an attorney general. APRA added channels through which individuals could act directly and at scale. There were three of them. People could make requests, send signals that a website or app must honor, and bring lawsuits. Each one tests a different part of an organization, and each one was arriving through state law whether or not Congress acted.
Requests: people asking for their data
Access, correction, deletion and export rights were familiar from California and the states that followed. A federal baseline would have made them universal. For banks and health systems, the carve-out shaped what customers would actually experience. Account records under GLBA and medical records under HIPAA would follow those laws. Website analytics, marketing lists, event sign-ups and app data might fall under the new act. A customer who asks a bank for “my data” does not know or care which statute governs which table.
That makes the request front door a design problem. A single intake, through the app, the website and the branch or front desk, should verify identity, log the request and route it to every system that holds the person’s data. Identity verification is the hardest step. An access request is also an account takeover route: a fraudster who passes a weak check receives a complete profile. Requests should therefore use the same strength of verification as the channel’s other high-risk transactions.
The response should be one readable package, with a plain explanation where some data sits under a sector law and is handled differently. The service metrics are the ordinary ones for any customer channel: time to complete, rework rate and complaints. Data broker provisions added a further demand. A central do-not-collect request would have reached every registered broker at once, so organizations that buy marketing or identity data would see their sources change.
Signals: opt-outs sent by software
The second channel needs no human request at all. A universal opt-out mechanism is a signal sent by a browser or device, telling every site it visits that the person opts out of targeted advertising and data sales or transfers. Several states already required businesses to honor such signals. Colorado’s requirement took effect in July 2024.
Signals test the plumbing behind a website. Honoring one means the tag manager must suppress advertising pixels and third-party scripts for that visitor, consent records must store the signal, and downstream data feeds must exclude the person. For health systems, whose public websites have drawn regulatory attention for tracking technologies, the signal and the tracking question meet in the same code. A signal that is recorded but not enforced in the tags is worse than none, because it creates a record of a promise not kept.
The algorithm opt-out was the more unusual signal. It would have let a person decline a covered algorithm used to make or facilitate a consequential decision, such as credit, housing or access to health care. For a lender or a benefits-adjacent health program, that implies an alternative process with human review, and the capacity to run it. If many applicants opt out at once, an automated decision flow turns into a manual queue. The design question is how to staff that queue and how long applicants wait.
Suits: individuals as enforcers
The third channel was the most contested. The draft let individuals sue for many violations without first waiting for a regulator. It made pre-dispute arbitration agreements unenforceable for claims involving substantial privacy harm or minors. Financial institutions rely heavily on arbitration clauses, so this was a material shift in exposure.
Litigation changes what counts as evidence. Privacy notices, consent screens, tag configurations and request logs become exhibits. A delay in honoring an opt-out, or a pixel that fired after a signal, is no longer a finding to remediate quietly. It can become a claim. Regulated organizations already saw this pattern in suits under state wiretap and video privacy laws over website tracking.
The three channels are connected. A person whose request goes unanswered, or whose signal is ignored, has a reason to sue. Organizations that run requests and signals well reduce the third channel’s risk at its source. The investment case follows. Spending on request handling and tag enforcement is a predictable operating cost, while claims are not. The same spending also improves the customer experience that requests and signals measure, which gives it a sponsor outside compliance. Organizations should check with counsel on which state laws and private rights of action apply to them.
With hindsight
APRA did not pass. A revised draft followed in late May. A June 20 version dropped the civil rights and algorithm provisions, and the House Energy and Commerce markup set for June 27, 2024, was canceled minutes before it began. The bill expired with the 118th Congress, and no comprehensive federal consumer privacy law has been enacted since.
The three channels kept arriving through the states. Colorado’s universal opt-out requirement took effect in July 2024, and more states required businesses to honor such signals. California’s Delete Request and Opt-out Platform, a single deletion request reaching every registered data broker, opened to consumers in January 2026, with brokers required to process requests from August 2026. California also finalized rules on automated decision-making technology in 2025. Private litigation over website tracking continued. The customer-facing operations APRA anticipated are now required by a growing patchwork, which is harder to run than the single federal standard would have been.