The "American Privacy Rights Act of 2024" comprises comprehensive guidelines on protecting consumer data privacy. It outlines various aspects such as data minimization, transparency, individual rights over personal data, data security, and enforcement measures by different entities. Additionally, it introduces the "Children’s Online Privacy Protection Act 2.0" which addresses the handling of children's personal information online.

The document provides detailed definitions of terms related to data privacy and usage, including what constitutes affirmative express consent, biometric information, covered data, service providers, and many others. It outlines how each term is applied in the context of data collection, processing, and sharing while specifying exclusions and conditions where applicable.

The section outlines rules to ensure that companies collect, use, and share personal data only when needed and with consent, especially when it comes to sensitive data like biometric and genetic information. It lists several specific reasons why data can be shared without consent, such as to protect against fraud or comply with legal obligations, but emphasizes that these actions must be necessary, appropriate, and not excessive.

Each company or service provider must create and maintain policies and procedures to handle personal data responsibly, especially for vulnerable groups such as minors, the elderly, and people with disabilities. They need to evaluate their privacy risks based on their business size and the sensitivity of the data, and they must follow the latest technological and security practices. The government will provide guidance on what these reasonable policies look like within a year of the law's enactment.

The section outlines requirements for covered entities and service providers to publish a clear and accessible privacy policy detailing their data practices, including data collection, retention, and sharing. It also mandates that privacy policies be accessible to individuals with disabilities, available in multiple languages, and that any material changes must be communicated to users with an option to opt out if desired. Additional transparency measures apply to large data holders, requiring them to retain and disclose previous privacy policies and provide concise short-form notices of data practices.

The section outlines the rights individuals have regarding their personal data held by companies. It details how people can access, correct, delete, and transfer their data, and sets rules for how quickly companies must respond, what exceptions exist, and what information companies must report annually.

A covered entity must provide individuals with the ability to opt out of their data being shared with third parties and used for targeted advertising. The law outlines that within two years, clear and easy-to-use universal opt-out mechanisms should be established, allowing individuals to exercise these rights through a single interface, ensuring accessibility for all, including those with disabilities.

A covered entity is not allowed to use "dark patterns," which are manipulative design techniques, to distract someone from important notices, hinder their rights, or trick them into giving consent. Additionally, they cannot mislead individuals with false or deceptive statements to make them waive their rights.

In Section 108, the bill states that companies cannot punish individuals for using their rights by changing the price or quality of goods and services. However, companies can offer different prices or services through genuine loyalty programs with customer consent, as long as the sale of personal data is not required, and can also provide incentives for market research, or decide not to offer a product if it's necessary to maintain privacy rights.

The section requires every organization handling sensitive data to establish and maintain strong security practices to protect the data from unauthorized access. It includes conducting regular risk assessments, taking preventive and corrective actions, following strict data retention and disposal practices, providing employee training, and having procedures for responding to security incidents.

A covered entity or service provider must appoint privacy and data security officers to ensure compliance with data privacy rules, while large data holders are required to designate specialized officers for managing privacy and security separately. Large data holders must conduct regular internal audits, establish reporting structures, and complete privacy impact assessments to evaluate and document the impact of their data handling practices on individual privacy.

Service providers must follow strict rules when handling data for other businesses, including adhering to specific instructions, deleting data after use, and ensuring compliance with various data protection laws. They also need to enter contracts with third parties to ensure data is used properly, exercise reasonable care in selecting service providers, and halt data transfers if they know a violation could occur.

Data brokers must create informative websites to help individuals exercise certain rights, are prohibited from engaging in harmful practices, and must register with the Commission if they handle data from over 5,000 people or devices. The Commission will maintain a public registry for data brokers, allowing individuals to submit "Do Not Collect" or "Delete My Data" requests, which must be honored within 30 days unless exceptions apply.

A covered entity or group that is not a large data holder can apply to the Commission to have their data compliance guidelines approved. The approval requires meeting certain criteria, including independent review and enforcement. If significant changes are made to the guidelines, they must be submitted for re-approval. Approved guidelines allow entities to self-certify their compliance, with a presumption of compliance if they follow the approved guidelines. If the guidelines fail to meet standards, they can be withdrawn but must be given a chance to fix any issues. Service providers, also not large data holders, are eligible to apply and participate in these guidelines similar to covered entities.

The section describes a pilot program encouraging the use of privacy-enhancing technologies to protect data, where eligible companies can join by meeting specific security standards. It outlines the program's establishment, requirements for participation, responsibilities of the overseeing Commission, evaluation through audits and studies, possible withdrawal from the program if standards aren't maintained, and offers legal protections for compliant participants.

The bill requires the Federal Trade Commission to establish a new bureau focused on consumer protection and competition, with a specialized staff that includes attorneys and technologists. It also creates a "Privacy and Security Victims Relief Fund" to help people affected by violations and mandates regular reports to Congress about investigations and plans related to enforcing the new rules.

In this section, states are given the power to take legal action if a company violates privacy or data security laws, but they must notify the federal Commission first. It sets rules for how states can legally pursue these cases, work with outside firms, and collaborate with the federal government, while ensuring all existing state powers are preserved.

In this section, individuals can file lawsuits against certain organizations for violating data privacy laws, with possible remedies including damages and legal fees. It explains the process for seeking injunctive relief or damages, conditions under which arbitration agreements may be invalid, and emphasizes that notification requirements may be waived in cases of substantial privacy harm.

The section establishes a national standard for privacy and data security, overriding most state laws to create consistency across the U.S. However, it allows states to keep laws on topics like consumer protection, civil rights, and data breach notifications. It also respects existing federal laws and does not interfere with assessing civil lawsuits based on common law rights or state statutes. Certain regulations from the Communications Act of 1934 and Telecommunications Act of 1996 related to FCC privacy don't apply to covered entities, although some exceptions exist, such as protection for emergency services and telecommunications confidentiality.

This section clarifies that nothing in the current title changes or removes any responsibilities or requirements that a company or individual may have under the Children’s Online Privacy Protection Act of 1998.

Covered entities and service providers are prohibited from showing targeted ads to minors and cannot share minors' data with third parties without consent unless certain legal exceptions apply. The Commission can set rules to help parents and teens manage their rights under this law, ensuring alignment with existing child privacy regulations.

This section states that as soon as this Act is enacted, the rulemaking process for the "Trade Regulation Rule on Commercial Surveillance and Data Security," which was initiated on August 22, 2022, will be stopped.

If any part of this title is found to be invalid, the rest of the title remains in effect and can still be applied to other people or situations.

The Commission can create new rules to add more types of data to the definition of "sensitive covered data," but it cannot expand a specific category of information already defined. It can also update the list of allowed reasons for handling this data.

This section states that, unless stated otherwise, the provisions in this title will become effective 180 days after the date when the Act is officially passed into law.

The section introduces the Children’s Online Privacy Protection Act 2.0, which is the official name for this part of the legislation.

The proposed amendments to the Children's Online Privacy Protection Act aim to update and clarify definitions and provisions regarding the collection, use, and safeguarding of children's personal information online. It establishes rules for operators of websites and services directed at children, ensuring they obtain proper parental consent and adhere to guidelines that protect children's privacy, while providing conditions for educational institutions to handle such data responsibly.

The section mandates that within specific timeframes, the Federal Trade Commission (FTC) must submit reports to Congress about its oversight and enforcement efforts concerning mobile and online applications that target children. These reports will cover compliance with children’s online privacy laws, details of enforcement actions taken, and policy recommendations, while the FTC's Inspector General will evaluate the effectiveness of existing safe harbor provisions meant to protect children's online privacy.

This section states that if any part of the bill or its amendments is found to be invalid, the rest of the bill and its amendments should still remain effective and applicable to other situations or people.