Online Privacy Bill Gains Momentum, but Hurdles Remain

“This is the best opportunity we’ve had to pass a federal data privacy law in decades,” said Rep.

Cathy McMorris Rodgers

(R., Wash.), the top Republican on the full committee. “I look forward to all our continued work together.”

Rep.

Jan Schakowsky

(D., Ill.), the subcommittee chairwoman, said later that she looked forward to passing the legislation out of her subcommittee, possibly before the end of the month. Rep.

Gus Bilirakis

(R., Fla.), the subcommittee’s top Republican, termed the developing legislation historic.

But the hearing also highlighted a range of lingering challenges that remain as key lawmakers seek to move the rapidly developing bill through Congress this summer.

Several witnesses at Tuesday’s hearing suggested changes to strengthen or weaken major protections in the legislation, showing that the effort could still run into trouble.

“We urge Congress to seize this moment confidently, but carefully,” said

Graham Dufault,

senior policy director of ACT / the App Association, a business group.

Lawmakers have tried off and on for decades to pass such a bill, without success, largely because of business opposition. But their efforts have been energized this year by a series of controversies over how people’s information is used.

Lately, some big technology companies have started pushing hard for privacy legislation, concerned that states are beginning to adopt their own approaches.

Under the draft bill, big tech companies would be limited to collecting, processing and transferring only the data that is reasonably necessary to provide their services. And for some sensitive categories of data, such as geolocation data or biometric information, the bill would prohibit transfer or restrict it to very limited circumstances.

The legislation also includes broad antidiscrimination protections, and requires large data holders to conduct assessments of their algorithms to show the steps they are using to limit harms.

For children, the bill would impose at least a couple of important new protections. Targeted advertising would be prohibited for anyone under 17. And all data related to individuals under 17 would be considered sensitive and subject to tougher restrictions.

The legislation would provide for stronger enforcement by the Federal Trade Commission and state attorneys general. It also would allow for consumer lawsuits over violations in some circumstances—a concern for some industry groups.

“Our members remain concerned that it’s too broad,” said

John Miller

of the Information Technology Industry Council, adding that some provisions appear to be “a recipe for a flood of lawsuits.”

Privacy protection for children is another issue. Some experts questioned whether the new protections would be effective without requirements to make tech companies determine which of their users are children.

Still other emerging conflicts involve whether industries such as the financial services sector and telecommunications companies should be carved out.

Those battles have held up other congressional efforts to pass federal data-security laws in the past.

Small businesses also want to make sure they aren’t hit with new regulatory burdens.

Yet another question mark is whether Senate Commerce Committee Chairwoman

Maria Cantwell

(D., Wash.) will line up behind the effort. She has been working on her own generally tougher version of comprehensive privacy legislation.

Earlier this month, she said, “For American consumers to have meaningful privacy protection, we need a strong federal law that is not riddled with enforcement loopholes.”

Rep. Schakowsky on Tuesday noted that the top Republican on the Senate Commerce Committee also supports the draft legislation being considered in the House, meaning that three of the four leaders of the House and Senate committees support that version.

“Hopefully we’ll have four very soon,” she said.

Write to John D. McKinnon at john.mckinnon@wsj.com