The Personal Data Protection Act, which had been declared dead in committee twice over the last eighteen months, cleared the Senate floor on a vote that surprised even its sponsors.
The bill creates a federal baseline for data collection, gives consumers a private right of action for breaches involving sensitive categories of data, and pre-empts a patchwork of state laws that has frustrated industry for years.
Industry groups split. The largest technology trade association came out in support of the final language; smaller groups representing ad-tech firms warned of "compliance whiplash" for businesses that built their models around the older state-by-state regime.
