# American Privacy Rights Act of 2024
This bill establishes the first comprehensive federal privacy and data security framework for the United States, creating uniform rules for how businesses collect, use, and share personal information.
## What the Bill Does
The legislation sets baseline privacy protections requiring companies to limit data collection to what is necessary for their stated purposes, obtain explicit consent before collecting sensitive information like biometric or health data, and delete information when no longer needed. It prohibits companies from using "dark patterns"—deceptive design tricks—to manipulate users into sharing data or waiving their rights. Companies cannot penalize people for exercising privacy rights, such as opting out of data sales or requesting deletion of their information.
The bill also strengthens protections for children and teenagers, restricting targeted advertising to minors under 17 and requiring parental consent before collecting data from children under 13. Data brokers must register with the Federal Trade Commission and allow individuals to request that their data not be collected or sold.
## Who It Affects
The law applies to most businesses, telecommunications carriers, and nonprofits that collect personal information, with exceptions for government agencies, small businesses (under $40 million in revenue), and certain nonprofits focused on fraud prevention. Large data holders—companies with significant data collection operations—face heightened requirements, including appointing dedicated privacy and security officers and conducting regular privacy impact assessments. Individuals gain enforceable rights to access, correct, delete, and port their personal data, with ability to opt out of data sales and targeted advertising.
## Key Funding and Timelines
The bill becomes effective 180 days after enactment. The FTC must establish a new privacy bureau within 180 days and promulgate various regulations within 1-2 years, including universal opt-out standards. A Privacy and Security Victims Relief Fund collects civil penalties to compensate affected individuals. The legislation preempts most state privacy laws to create uniform national standards, though it preserves state laws on employee privacy, student records, health information, civil rights, and criminal matters.