Necessary and proportionate: the ADPPA test that outlived the bill

The week

On July 20, 2022, something rare happened in Washington: a broad privacy bill won overwhelming bipartisan support. The House Energy and Commerce Committee voted 53 to 2 to advance the American Data Privacy and Protection Act, H.R. 8152, usually shortened to the ADPPA. Comprehensive federal privacy bills had stalled for years, and commentators at the time called this the furthest one had travelled.

The bill had moved fast. A discussion draft, an early version circulated for comment, appeared on June 3. It carried the names of the committee’s Democratic chair, Frank Pallone, its ranking Republican, Cathy McMorris Rodgers, and Senator Roger Wicker, the ranking Republican on the Senate Commerce Committee. A subcommittee held a legislative hearing on June 14. The bill was formally introduced on June 21 and cleared the Consumer Protection and Commerce subcommittee by voice vote on June 23. The committee published a revised text, an amendment in the nature of a substitute, on July 19, the day before the markup.

The heart of the bill was a simple-sounding rule in its Section 101. Organizations would have been allowed to collect, process and transfer personal data only to the extent that was reasonably necessary and proportionate. Necessary and proportionate to what? The benchmark was a product or service the individual had actually requested, or one of seventeen listed permitted purposes. Those purposes included security, fraud prevention, legal compliance, product recalls and first-party marketing. If a customer asked you to ship them a parcel, you could collect their address; you could not collect their browsing history on the off chance it might be useful later.

The bill went further. It added heightened protections for sensitive data, such as health or precise location information. It covered nonprofits and telecommunications carriers, which the Federal Trade Commission usually cannot reach, but excluded government bodies and contractors acting as their service providers. It defined “large data holders” by revenue and data volume and gave them extra duties, including annual impact assessments for algorithms that posed a consequential risk of harm. It told the FTC to set up a Bureau of Privacy, and let state attorneys general sue.

It also included a private right of action, meaning individuals could sue organizations directly rather than relying on regulators. The July text shortened the delay before that right began from four years to two years after the law took effect. Would-be plaintiffs had to notify the FTC and their state attorney general first, and some claims required notice and a chance to cure.

The bill contained broad preemption of state comprehensive privacy laws, with listed exceptions. Preemption is the legal doctrine under which a federal law overrides state laws on the same subject, so that one national rule replaces many state ones. The exceptions preserved, among others, state breach notification laws, general consumer protection and civil rights laws, and Illinois’s biometric and genetic privacy statutes. The July text also let the California Privacy Protection Agency enforce the federal law in the same manner as it enforced California’s own.

Banks and health care organizations got special treatment, of a kind. The Gramm-Leach-Bliley Act (GLBA) governs how financial institutions handle customer information; HIPAA is the federal health privacy law. Entities complying with either would be treated as compliant with related ADPPA provisions for data those laws covered. The bill’s own data security section was carved out of that deal. The July text added federal rules on substance use disorder records and the Genetic Information Nondiscrimination Act to the list. Note the careful wording: for the data those laws covered, not for everything the organization held.

Not everyone welcomed the bill. California officials, including Governor Gavin Newsom and a group of state attorneys general led by California’s Rob Bonta, opposed the preemption terms. They argued that a federal law would override protections their states already had. At the markup, an amendment from Representative Anna Eshoo of California to make the bill a floor rather than a ceiling failed, 8 to 48. A week later, on July 28, the California Privacy Protection Agency’s board voted unanimously to oppose the bill.

The Senate was another obstacle. Maria Cantwell, who chaired the Senate Commerce Committee, had not signed on. The bill did not reach a House floor vote. But the committee vote showed how far the idea of data minimization had travelled.

Download a brochure from many organizations and you will be asked for your date of birth, your phone number, your employer and your household income. Most organizations collect data that way because, for decades, American privacy law asked them to explain what they collected, not to justify it.

American privacy law had long run on notice and choice: tell people what you collect, and let them opt out of some uses. The ADPPA began elsewhere. Its central duty asked whether each piece of data was needed at all, and consent could not cure a collection that failed that test. The bill died, but the test did not. It shaped state laws, enforcement theories and the federal drafts that followed.

For banks, health systems and agencies, the bill is worth reading in five parts that answer separate questions. The first is the idea itself: what changes when the law asks for justification instead of disclosure. The second is what the minimization test actually demands of systems and the people who run them. The third is how far it reached into regulated organizations despite their sector carve-outs. The fourth is why preemption sank the bill, and what that left organizations to plan for. The fifth is the price of minimization: what it costs, the strongest objections to it, and what it buys.

From “tell people” to “justify it”

Under the notice-and-choice model, an organization writes a privacy notice, the long document few people read, describing what it collects and how it uses it. As long as the notice is accurate and people have some way to opt out of certain uses, the organization is broadly within the rules. The burden falls on the individual to read, understand and object.

Data minimization flips that burden. It says that the organization must be able to show that each piece of personal data is genuinely needed for something the person asked for, or for a purpose the law specifically allows. If it cannot, it should not collect the data, however clearly it disclosed the collection. A good doctor works the same way, asking the questions needed to treat you rather than every question that might one day be interesting.

The phrase “consent could not cure” is important. Under notice and choice, a checkbox saying “I agree” often settles the matter. Under the ADPPA’s approach, a person’s agreement did not make an unnecessary collection lawful. That is a much harder standard to meet, because it cannot be satisfied by better wording. It has to be satisfied by better systems.

Two other terms are worth defining. Personal data means information that identifies, or could reasonably be linked to, a particular person. Sensitive data is a subset that carries more risk if misused, such as health information, financial account details or precise location. Laws built on minimization usually apply the strictest version of the test to sensitive data.

Where the idea came from

Minimization was not new in 2022. It is one of the Fair Information Practice Principles that U.S. agencies set out in the 1970s, and it shaped the federal Privacy Act of 1974, which governs federal agencies’ own records. Europe’s General Data Protection Regulation, in force since 2018, made data minimization one of its core principles. California’s 2020 ballot measure, the California Privacy Rights Act, wrote a similar “reasonably necessary and proportionate” standard into state law for businesses.

What the ADPPA changed was its weight. Under the GDPR, an organization can often rely on consent or on its own “legitimate interests” as a legal basis, then apply minimization within that purpose. The ADPPA made the purpose list itself the gate. Data had to serve the requested service or one of the listed purposes, and it had to be proportionate to that purpose. For sensitive data the bill went further, allowing collection only where strictly necessary or for a narrower set of purposes.

Why the burden shift matters to examiners

A justification standard changes the questions a regulator asks. Under notice and choice, an examiner or enforcement attorney compares the notice with what the organization actually does. Any gap is the violation. Under minimization, the examiner starts from the data and asks why it is there. The organization has to show its reasoning, and the reasoning has to exist before the question is asked.

Federal banking and health regulators already work this way for some things. A bank examiner asks for the risk assessment behind a control as well as the control itself. A HIPAA investigator asks for the risk analysis behind safeguards. A minimization duty applies the same habit to data collection itself. Organizations that already document risk decisions well tend to find it easier to adapt than those whose privacy work lives only in a notice.

What the test demands of systems

A duty of minimization is a design rule. It cannot be met by a better privacy notice. It requires each data element to be tied to a purpose, and each purpose to be one the law accepts. That has practical consequences across the data estate, the full collection of systems, databases and files in which an organization holds information.

Collection, use and retention

Collection is the obvious one. Forms, mobile apps and web pages collect fields because someone once thought they might be useful. A minimization review asks the product owner to name the purpose for each field and removes those without one.

Use comes next. Data collected to service an account may not be fair game for a new marketing model. Analytics teams need purpose tags on data sets and a review step before data moves to a new use. A purpose tag is simply a label attached to a data set that records why it was collected, so that anyone proposing a new use can see at a glance whether that use fits.

Retention is the third. Data that was necessary at onboarding may not be necessary five years later, and the schedule has to say when it goes. Retention is where minimization meets records law. A bank has record-keeping duties under the Bank Secrecy Act; a broker-dealer has SEC books-and-records rules; a hospital has state medical record retention laws. Those obligations set a floor. Minimization asks the organization to stop keeping data past that floor without a reason.

Copies are the part most programs miss. A customer record rarely lives in one place. It is copied into a data warehouse, a customer relationship management tool, test environments, analyst spreadsheets and backups. A retention rule that deletes the source record but leaves those copies does little. Mature programs trace the main flows of each high-risk data set and set deletion rules for each copy, including masked or synthetic data for testing in place of production records.

Models and training data

Models raise the stakes. By models we mean statistical or machine learning systems that learn patterns from historical data in order to make predictions. Examples include which customers might default on a loan or which patients might miss an appointment. Training data is usually assembled from whatever is available, and a model trained on data collected for another purpose carries that purpose problem into every prediction it makes.

A minimization regime asks model owners to document the source and purpose of their training sets. It asks them to drop fields that add risk without adding accuracy, and to consider whether aggregated or de-identified data would do the job. Aggregated data is summarized across many people, such as averages by region; de-identified data has had names and other direct identifiers removed.

The July text tightened the de-identification standard. Organizations would have had to take reasonable technical measures so that the data could not, at any point, be used to re-identify a person. This bar is harder than removing names, because combinations of age, postcode and dates can often identify people. A model team that relies on de-identification as its minimization strategy needs evidence that re-identification has been tested, not assumed.

Those steps cost some modeling convenience. They also make models easier to explain to examiners who ask what drove a decision. Banks already face that question under model risk management guidance and fair lending law. The ADPPA’s algorithm provisions would have added impact assessments for large data holders whose algorithms posed a consequential risk of harm, including to access to credit, housing, health care and employment.

The stricter tier for sensitive data

The bill’s sensitive data category was broad. It included health information, precise geolocation, biometric and genetic data, financial account and card numbers with their access codes, government identifiers such as Social Security numbers, and private communications. For a hospital nearly everything clinical falls in that tier. For a bank the obvious items are account numbers and identifiers, but the less obvious ones matter more.

Mobile banking apps are a good example. Many request location permissions for fraud checks or branch finders. Precise location collected continuously, rather than at the moment of a transaction, would have faced the stricter test. The same applies to voice biometrics in call centers and to device fingerprints used for login risk scoring. Each may be justified by fraud prevention or security. Each still needs a written rationale that says why that precision and that frequency are needed.

A sensible approach is to treat the sensitive tier as a separate review queue. Any new collection of a sensitive category goes to privacy and security together, with a named business owner. The review records the purpose, the minimum precision needed, the retention period and whether the data may be shared with vendors. That queue is usually small, which makes it manageable even for lean teams.

Evidence

Most organizations found the hard part was evidence. A regulator applying a necessity test asks why a field exists, and the answer has to be written down before the question arrives. A data inventory that records purpose, legal basis and retention for each major data set is the core artifact. Building it is tedious. It also pays twice, because the same inventory drives security classification, breach scoping and records management.

The inventory does not need to be perfect to be useful. A spreadsheet covering the twenty systems that hold most personal data beats a data catalog project that is still being scoped two years later. The fields that matter most are data set, system, owner, purpose, legal basis, sensitive categories, retention period, jurisdictions and main recipients. Examiners and auditors tend to ask for exactly those.

A mortgage application, field by field

Take a regional bank’s mortgage application. A minimization review goes field by field. Income and employment are plainly necessary to assess the loan. Some demographic fields are required, because the Home Mortgage Disclosure Act obliges many lenders to ask for and report them. Compliance can confirm which fields the law requires and which merely seem useful.

A field asking how the applicant heard about the bank is a marketing question. It may be fine if optional and clearly separate, but it does not belong in the required section. A free-text “additional information” box that invites people to volunteer medical details creates sensitive data the bank never needed. Each decision is small. Together they shrink what the bank must protect, retain and explain.

Who does what

Minimization sounds abstract until you see who does what. In most organizations it touches four groups, and the program works only when each knows its part.

Product and business owners decide what a form, app or service collects. Under a minimization approach they must name a purpose for each field before it goes live, in a short, standard template rather than a long legal memo.

Data and analytics teams move information between systems and build reports and models. They need the purpose tags to be visible where they work, in the data catalog or warehouse, and a simple request route when they want to use data for something new.

Privacy, legal and compliance set the rules, review new purposes and maintain the inventory’s legal fields. Their job shifts from writing notices to reviewing designs, which usually means getting involved earlier in projects.

Technology and records teams make retention real, by configuring systems to delete or archive data when its period ends, and by making sure backups and copies follow the same rules.

Ownership disputes are predictable. Marketing often buys its own tools, and nobody in privacy or security approved them. Data teams resist purpose reviews that slow a project. The most workable fix is a single intake step for any new tool, data feed or model, with a short form that privacy and security both review. The form should take minutes, or teams will route around it.

A sequence for a mid-sized lender

A sensible starting sequence for a mid-sized lender might look like this.

1. List the twenty or so systems that hold the most personal data, and record a purpose, owner and retention period for each.
2. Pick the highest-volume customer forms and run a field-by-field review.
3. Inventory the tracking and marketing tools on public websites, and record what each one sends and to whom.
4. Add a lightweight purpose check to the process for starting any new analytics or model project.
5. Configure deletion for one high-risk data set end to end, including its copies, and use it as the pattern for the rest.

No step on that list requires a new platform. All of them produce evidence the organization can show a regulator. A reasonable metric set follows from the list. It covers the share of high-risk data sets with a recorded purpose and owner, required fields removed, trackers removed or approved, and data sets with enforced deletion.

How far it reached into regulated firms

Banks and hospitals often assumed that a federal privacy law would pass them by. The ADPPA did not quite work that way. Its sector provisions applied to data covered by GLBA or HIPAA. They did not exempt the organization as a whole.

The difference between an entity-level and a data-level exemption is the crux. An entity-level exemption says, in effect, “if you are a bank, this law does not apply to you.” A data-level exemption says something narrower: “this law does not apply to the data your banking law already governs.” Everything else you hold is in scope.

State laws already split on the point in 2022. California’s law exempted data covered by GLBA and protected health information under HIPAA, a data-level approach. Virginia’s law, by contrast, exempted financial institutions subject to GLBA and HIPAA covered entities as organizations. A bank operating in both states had two different answers to the same question. The ADPPA chose the narrower, data-level design.

What falls outside the sector laws

That distinction mattered because regulated organizations hold a great deal of data outside their sector laws. A bank’s customer account records fall under GLBA. Its website analytics, prospect lists, event registrations and some marketing data may not. A hospital’s medical records fall under HIPAA. Its public website tracking, donor files and consumer wellness app may not. Under a data-level carve-out, all of that falls under the general privacy law, including the minimization test.

Consider a community hospital. Its electronic health record, the clinical system holding diagnoses and treatment, is squarely HIPAA data. But its public website uses tracking tools that record which pages visitors read, including pages about particular conditions. Its foundation keeps a donor database. Its marketing team runs a newsletter list. Its new wellness app lets members of the public log their exercise. HIPAA may cover none of those, and each would face the general law’s necessity test.

The website tracking is the most delicate, because page visits can reveal health interests. The issue was live that summer. In mid-June 2022, a month before the markup, the investigative newsroom The Markup reported that Meta’s tracking pixel was installed on the websites of about a third of the country’s top-ranked hospitals. In some cases it ran inside patient portals. Those findings made the gap between HIPAA data and everything else concrete.

How it differs by type of organization

The exposure was not uniform. A credit union is covered by GLBA through the National Credit Union Administration’s privacy rule, so its member account data is inside the carve-out. Its website, its youth savings club sign-ups and its branch event lists may not be. A broker-dealer has GLBA obligations through the SEC’s Regulation S-P, plus heavy books-and-records duties. Retention minimization there has to respect those duties, which often require keeping communications for years.

A wealth manager or fintech that collects data before any customer relationship exists, from prospects and app downloads, has more outside the carve-out than a traditional bank. A health system and an ambulatory network share the HIPAA core. The ambulatory network, though, often runs more of its patient acquisition through consumer-facing websites, scheduling apps and third-party marketing platforms, which sit outside the clinical record.

Public agencies were outside the ADPPA altogether, because government entities were not covered. Their contractors were also excluded when acting as service providers to government. That did not leave agencies untouched. Vendors that serve both agencies and private clients build one product, and a vendor redesigning its platform for minimization changes what agencies buy too. State privacy laws largely exclude government as well. Agencies remain subject to the Privacy Act at the federal level and their own state statutes.

Vendors and service providers

The ADPPA split obligations between covered entities, which decide why and how data is used, and service providers, which process data on their behalf. Service providers would have had to follow the covered entity’s instructions, keep data confidential, delete or return it at the end of the contract and help with consumer requests. That mirrors the controller and processor split in state laws and in the GDPR.

Regulated organizations already had a version of this. HIPAA requires business associate agreements with vendors that handle protected health information. Banking regulators expect oversight of third parties that handle customer data, and GLBA rules require contracts that protect it. Those contracts usually cover the sector-regulated data and stop there. The marketing agency running a hospital’s advertising, or the analytics vendor behind a bank’s website, often has a standard commercial contract with no purpose limits at all. Extending the existing vendor review to those contracts is one of the cheaper ways to close the gap at the edges.

Mapping the edges

Several states were already moving the same way, and more did later. For a compliance leader, the practical step was a map of every data set outside the sector law, with an owner for each. In most organizations the marketing technology stack was the largest item on that list. It was also the least governed.

The marketing technology stack is the collection of tools, often bought by marketing teams directly, that track website visitors, manage email campaigns and target advertising. Mapping it means scanning public websites and apps for scripts and software development kits, then asking each vendor what it receives and keeps. How the exemptions apply in each state where an organization operates is a question for its lawyers.

Why preemption sank it, and what that left

The bill’s main obstacle was its relationship to state law. California had a comprehensive law and a new privacy agency. Its officials argued that a federal ceiling would weaken protections Californians already had. Supporters answered that one national rule would protect people in every state and spare organizations a patchwork. Each side had a case, and the dispute was never settled.

The two sides of the argument

The case for preemption was strongest from the point of view of organizations operating nationally. Five states had comprehensive privacy laws by mid-2022: California, Virginia, Colorado, Utah and Connecticut. Each defined key terms slightly differently. A single federal standard, stronger than most state laws, would have replaced that drift with one rule and one set of definitions.

The case against was strongest from California. Its law had its own agency, its own rulemaking and a ballot-measure origin that limited how far the legislature could weaken it. Preemption would have swapped an active state regulator for a federal statute that a future Congress could amend. The July concession, letting California’s agency enforce the federal law, did not answer that concern. The agency would have enforced someone else’s rules.

The private right of action was the second fault line. Privacy advocates wanted individuals able to sue; many business groups wanted no private suits at all. The committee compromise, a two-year delay with notice requirements and limits, satisfied neither side fully. When preemption and private suits are traded against each other, any change to one reopens the other. The same pairing explains why the two issues sank the bill’s successor two years later.

Who would have enforced it

The enforcement design also mattered to regulated firms. The FTC would have treated violations as breaches of a trade regulation rule, which allows civil penalties for a first violation. State attorneys general could sue in federal court after notifying the FTC. Private plaintiffs would have followed two years after the law took effect. Three enforcers with different priorities means an organization cannot calibrate its program to one regulator’s habits. A written, consistent rationale for each data practice is the only evidence that works for all three.

Planning for a patchwork

The planning consequence was clear even in 2022: assume a patchwork. That means a program built on the strictest common requirements, with state-specific rights and definitions layered on top. Minimization is the most efficient common floor, because it reduces the data every other obligation applies to. Data that is not collected needs no access request process, no breach notice and no retention schedule.

A patchwork also changes the build. Privacy request handling, consent records and opt-out signals need to be configurable by state, not hard-coded to one law. An opt-out signal is a setting in a person’s browser or device that automatically tells websites they do not want their data sold or shared; some state laws require organizations to honor it. California enforced that point publicly a month later, in August 2022, when its attorney general announced a settlement with the retailer Sephora that turned partly on ignoring the Global Privacy Control signal.

Vendors that process personal data need contract terms that follow the strictest applicable rule, since a vendor cannot easily treat one state’s residents differently in the same database. Those terms should cover purpose limits, deletion on request, notice of subprocessors, help with consumer requests and a bar on combining the organization’s data with other clients’ data. The inventory described above needs a jurisdiction field, so that a new state law becomes a query and a gap list rather than a new project.

Choosing a baseline

The trade-off is cost. Applying the strictest standard everywhere means giving up some data uses that would be lawful in more permissive states. Most regulated organizations found that a reasonable price for a single program they could explain to examiners, auditors and customers.

There are exceptions. A national lender running targeted mortgage marketing in many states may find the strictest-standard approach removes too much reach. A middle path is to apply the strictest standard to sensitive data and to everything collected without a customer relationship, and to allow state variation only in rights handling and notices. Whichever baseline is chosen should be written down and approved, so that it is a decision, not a drift.

The price of minimization, and what it buys

The minimization idea turns each field on a form into a question with a price attached: why do we collect this, and what does holding it cost us? An honest answer has to weigh the costs and the objections alongside the benefits.

What it costs

The first cost is effort. Field-level reviews, an inventory with purpose and retention, and deletion that reaches copies all take time from people who already have full jobs. For a mid-sized bank or health system, the first pass usually takes several quarters of part-time work across privacy, data and business teams.

The second cost is lost optionality. Data kept “just in case” sometimes does prove useful, for a new product, a fraud pattern or a research question. Deleting it closes that door. The third cost is friction in analytics. Purpose reviews slow projects, and data scientists will say so.

The burden also falls unevenly by size. The ADPPA would have eased some duties for small businesses. Those were firms with average revenue of no more than $41 million, data on no more than 200,000 individuals a year and less than half of revenue from transferring data. Even those firms would have kept the core minimization duty. A community bank or credit union just above the thresholds would have faced the full set of duties with a compliance team of a few people. Lean institutions are where a field-level review costs the most relative to staff.

The strongest objections

The most serious objection comes from financial crime and security teams. Anti-money laundering programs, fraud detection and security monitoring all work better with more data and longer history. Know-your-customer rules require banks to collect and keep identity information. Security logs are full of personal data, and investigators often need months or years of them.

The ADPPA answered that objection with its permitted purposes. Security, fraud prevention and legal compliance were all on the list. The more difficult issue is scope creep: a purpose like “fraud prevention” can be stretched to justify almost anything. A credible program defines what each such purpose covers, which data sets feed it and how long they are kept, and does not let it become a general license.

The second objection comes from AI. Machine learning tends to improve with more data, and minimization looks like a brake. There is truth in that. But the data that most improves a model is usually relevant, accurate and well labeled. Volume alone rarely does it. Fields with no clear purpose are often the noisiest and the most likely to act as proxies for protected characteristics, which creates fair lending and civil rights risk.

The third objection is that minimization is unenforceable in practice, because “necessary” is too vague to apply. That has some force. Necessity tests do leave room for argument. Yet regulators applying vague standards tend to focus on the clearest excesses first, such as health-related tracking or sensitive data sold to brokers. An organization that has removed those and can show its reasoning for the rest is in a defensible position.

What it buys

Risk and cost. Every piece of data an organization holds is something that can be breached, subpoenaed, mishandled or requested by a customer. Less data means a smaller breach, a cheaper response and fewer obligations. Breach scoping, the work of determining whose data was exposed after an incident, is much faster when stale data has already been deleted.

Regulators. Even without a federal law, a necessity test has become a common lens for state regulators and enforcement agencies. Organizations that can answer “why do you hold this?” from a written inventory are in a far stronger position than those reconstructing the answer under pressure.

Customers. People increasingly notice when they are asked for more than seems reasonable. Shorter forms and clearer purposes can improve completion rates and trust.

Analytics and AI. Documented, purposeful training data tends to produce models that are easier to defend and explain, to examiners and to the people affected by decisions.

Reputation. Website tracking on health or financial pages, in particular, can become a public story quickly. Knowing what those tools collect is basic hygiene.

Where programs hold up, and where they stall

A mature program has a data inventory that people actually use, with purpose, legal basis, retention period, owner and jurisdiction recorded for each major data set. New collection goes through a short purpose review. Data moving into analytics or models goes through a documented check. Retention schedules are enforced by systems rather than written into policy and left there. And the marketing technology stack is governed with the same seriousness as core systems.

The programs that stall tend to make the same errors:

• Treating privacy as a notice-writing exercise. Better wording does not help if the underlying collection cannot be justified.
• Assuming the sector exemption covers everything. GLBA and HIPAA cover specific data, not every system a bank or hospital runs.
• Letting marketing tools grow ungoverned. Tracking scripts and campaign platforms are often added without review and collect more than their owners realize.
• Building for one state. Hard-coding a single law’s rules into systems turns every new state law into a new project.
• Keeping data forever “just in case.” Old data adds risk and rarely adds value.
• Training models on whatever is available. Without documented sources and purposes, models inherit every problem in their data.
• Letting broad purposes swallow the rule. “Security” and “fraud prevention” need defined scopes, or they justify everything.

A review that starts with inventory, trackers and retention

• Do we have a data inventory that records, for each major data set, why we collect it, on what legal basis, how long we keep it and who owns it?
• Which of our data sets fall outside GLBA or HIPAA, and who is responsible for each?
• What tracking and marketing tools run on our websites and apps, and what do they collect, especially on pages about health or finances?
• Which fields could we stop collecting tomorrow without any loss to the customer or the business?
• Are our retention schedules enforced automatically, including on copies and backups, or do they depend on someone remembering to delete?

The last question on that list is often the most revealing. Organizations that cannot easily answer it usually hold far more data than they need.

With hindsight

The ADPPA did not return in the next Congress. A successor, the American Privacy Rights Act, appeared as a discussion draft in April 2024 from Cathy McMorris Rodgers, by then the committee’s chair, and Senator Maria Cantwell. It also stalled over preemption and private enforcement. A subcommittee advanced it in May 2024, and a revised version was introduced as H.R. 8818 in late June. The full committee markup set for June 27, 2024 was cancelled with little notice. Civil rights groups had objected to the removal of algorithm protections, and the bill lacked support from House leadership.

The same two issues, whether a federal law should override the states and whether individuals should be able to sue, proved to be the sticking points both times. In February 2025, Energy and Commerce Republicans formed a privacy working group led by Vice Chairman John Joyce, and issued a request for information on a federal framework. Its questions returned to the same ground: scope, preemption and how to treat businesses of different sizes. Federal preemption remains unresolved in 2026.

States kept legislating, and by 2026 well over a dozen have comprehensive privacy laws. Maryland’s law, enacted in 2024, adopted a strict necessity standard for sensitive data, close in spirit to the ADPPA’s test. It allows sensitive data to be collected and processed only where strictly necessary to provide or maintain a product or service the person requested, and it bans the sale of sensitive data outright. Consent does not open either door. The law took effect in October 2025, with the attorney general’s enforcement beginning in April 2026. Maryland is the clearest sign that the bill’s central idea survived its defeat: the test moved from a federal draft into state law.

Health data outside HIPAA drew its own laws. Washington’s My Health My Data Act, signed in 2023 and largely effective from March 31, 2024, covers consumer health data that HIPAA does not, and gives individuals a right to sue. It applies directly to the gap described above: websites, apps and marketing data held by organizations that also run HIPAA-covered operations.

The Federal Trade Commission continued to bring sensitive data cases under its existing authority. In August 2022, weeks after the markup, it opened a rulemaking inquiry into commercial surveillance and data security, and sued the data broker Kochava over the sale of location data. In 2023 it used the Health Breach Notification Rule against GoodRx for the first time, and acted against BetterHelp over sharing health information for advertising. In early 2024 it reached orders with location data brokers that restricted the sale of sensitive location data. So even without a new statute, organizations faced a federal enforcer willing to ask whether their handling of sensitive information was justified.

Hospital tracking became the most visible test of the data-level gap. In the second half of 2022, several large health systems, Novant Health and Advocate Aurora Health among them, reported tracking pixel disclosures as breaches. In December 2022, HHS’s Office for Civil Rights issued a bulletin saying that tracking technologies on hospital websites could disclose protected health information. A federal court in Texas vacated part of that guidance in June 2024, in a case brought by the American Hospital Association, and HHS later dropped its appeal. The federal rule narrowed. The exposure did not disappear, because state laws, the FTC and private litigation still reached the same conduct.

What held up from 2022 was the shape of the problem. Minimization spread; data-level carve-outs left banks and hospitals exposed at their edges; and preemption stayed unresolved. What did not hold up was the expectation that a federal compromise was close. For regulated organizations the outcome is the one that was foreseeable in 2022: a patchwork that is cheapest to run from a single minimization-first program with a purpose-tagged data inventory at its center.

Waiting for a single federal rule has not been a viable plan, and it remains unclear when one will arrive. The organizations in the best position decided early to hold less data and to write down why they hold what they do. They also built their systems so that each new state law is a matter of configuration rather than reconstruction. For banks and hospitals in particular, the work starts at the edges of the sector exemptions, with the websites, marketing lists and consumer apps that their core compliance programs were never designed to cover.