Consumer Reports is celebrating Virginia Governor Ralph Northam's signing of the Consumer Data Protection Act.

“This is a historic moment for privacy rights,” said CR senior policy analyst Maureen Mahoney. “Virginia is now just the second state [after California] to pass a comprehensive privacy bill. While we're pleased that Virginians will have new privacy rights, legislators should continue working in the next session to strengthen it. This bill has some important privacy provisions, but consumers need more practical options for controlling their data.”

Also Read: Virginia Passes Consumer Privacy Bill

It establishes standards for data control and processing but does not apply to state or local governments and has exceptions for types of data and information governed by federal law. 

Consumers have the right to access, correct, or delete their personal information and obtain a copy of that information, as well as to opt out of the processing of personal data for targeted advertising. 

Also Read: Ad Group Proposes Privacy Bill

The bill does not go into effect until January 2023.

"In spite of growing bipartisan momentum in Washington and among technology companies about the need to act, the absence of a single federal privacy policy has encouraged states and international governing bodies to fill the vacuum and effectively dictate how Americans operate online." -Jonathan Spalter, USTelecom

Whether or not Congress flips blue or remains red after the election, there is a purple issue the next Congress must immediately tackle. It is bipartisan, affects America’s global leadership, and is a priority for every consumer who uses the internet: digital privacy.

In our hyper-connected digital lives, consumers across the political spectrum expect and demand strong internet privacy protections. Internet users should be certain that sharing images, exchanging messages, visiting websites, engaging in commerce and sending sensitive data are the types of acts the entire internet ecosystem is obligated to respect and protect.

We agree.

America’s innovative broadband providers are united by the principle that digital privacy is sacred and government has a role in ensuring that consumers can both confidently use the internet and maintain their privacy to the degree that they are comfortable.

In spite of growing bipartisan momentum in Washington and among technology companies about the need to act, the absence of a single federal privacy policy has encouraged states and international governing bodies to fill the vacuum and effectively dictate how Americans operate online.

Unless Congress steps up on privacy, others are going to keep stepping in with well-meaning but counterproductive privacy plans.

The new California Consumer Privacy Act (CCPA), for example, gives consumers the right to prevent their personal information from being sold to third parties. This seemingly innocuous provision does not distinguish between sensitive and non-sensitive information and could impact how consumers receive online advertising or valuable discounts associated with store rewards programs.

The European Union’s General Data Protection Regulation (GDPR) includes a similarly expansive definition of personal information and makes consent to use or share information more difficult to obtain.

These first-mover laws have made constructive contributions to the privacy conversation and deserve credit for responding to mounting consumer concerns. But at the end of the day these patchwork approaches risk creating consumer “confusion” in the name of consumer “protection” and turns the EU, or a single state, into the de facto regulator of digital privacy in the United States.

Instead, all players in our internet economy should be working together to avoid further policy fragmentation and build on the strengths of existing approaches to develop our own comprehensive, unified privacy blueprint that puts consumers first, builds digital trust and applies to all companies interacting with individuals on the internet.

Congress should lead that effort by developing a framework with privacy principles that include: effective security, ample consumer choice and flexibility, and reliable notifications when breaches occur – also applied uniformly to all companies operating on the internet. This framework should have mechanisms that are interoperable with existing multinational privacy regimes.

We know the ones and zeroes of our digital infrastructure are neither red nor blue. From our largest global enterprises to our smallest digital entities, millions of consumers are counting on Congress – regardless of who wins the midterms – to come together to develop a pro-investment and pro-innovation privacy plan that delivers peace of mind to consumers.

Our companies are committed to doing our part to shore up digital trust and give Americans the confidence that no matter what platform, device or network they choose, guardrails will be in place to protect their digital privacy and support our growing and interdependent internet ecosystem.

Jonathan Spalter is the president and CEO of USTelecom, a telecommunications industry trade association representing broadband service providers, manufacturers and suppliers in the world of internet-based communications and entertainment.

We expect regulators, at least those within a single administration, to speak with a common voice.

So when the Federal Trade Commission staff took the unprecedented action of criticizing proposed Internet privacy rules being considered by the Federal Communications Commission, it became clear we must hit the pause button.

The FTC is this nation’s leading privacy enforcer, with expertise based on decades of careful enforcement action. When the FTC speaks, we must listen carefully — not because the FTC gets every issue right, but because of its longstanding expertise.

The FTC’s main point is simple and compelling — it makes no sense to have one set of privacy standards for broadband providers and a different, inconsistent set for everyone else. With diplomatic understatement, the FTC comments call that patchwork approach to consumer protection “not optimal.” Inconsistent regulation creates barriers to competition and innovation. Why should one set of competitors be handicapped, like making them run while carrying a refrigerator on their back?

Consumers are obviously going to be confused if two different sets of rules apply to their data on different parts of the Internet. Recent survey data submitted to the FCC shows that 94% of Internet users believe “all companies collecting data online should follow the same consumer privacy rules.”

The FTC also explains how the FCC’s patchwork approach will distort markets for advertising and other services online, arbitrarily applying different rules to different competitors. Many companies are able to offer free or low-cost products by collecting data consumers don’t consider sensitive. The FCC approach destabilizes this market by creating an arbitrary patchwork of regulation.

Beyond this inconsistency, the FTC also questions the basic substance of the FCC rules, which abandon the bedrock FTC principle that the protection given consumer data should be based on consumer expectations regarding its sensitivity. Under the FTC approach, things like financial and medical information receive a higher level of protection, but more mundane data like the kinds of websites or ads a person clicks on receive somewhat less.

The FCC proposes to replace that system with much broader “opt-in” requirements that ignore the sensitivity of the data. But unmooring the level of data protection from consumer expectations is counterproductive and wrong — 83% of consumers believe online privacy should be based on the sensitivity of data, not the kind of company or organization gathering it. As one FTC commissioner put it, the FTC filing “politely recognizes that the FCC’s current proposal would impose more restrictions than are necessary to protect consumer privacy in many cases, and yet would fail to protect consumer privacy in others.”

When I was in the leadership of the FTC, we often filed comments guiding states or other regulators to recognize the need for regulatory humility. Regulations and legislation can become permanent impediments to competition.

When the nation’s leading consumer-protection enforcer says you’ve gotten it wrong, it’s time to rethink and return to the drawing board.

David Balto is a former policy director at the Federal Trade Commission and a former attorney in the Justice Department’s antitrust division.

RELATED:Stakeholders Go Public With Broadband Privacy Comments

A deeply divided FCC voted Thursday (March 31) to approve proposed new rules for broadband customers' private information, like what sites they surf to.

The FCC is proposing that a consumer's information can't be used for anything but the marketing of network services without their affirmative approval.

Agency chairman Tom Wheeler said the one indisputable fact is that consumers should have the right to decide how their own information is used.

GOP Republicans called it an overreach that stems from the FCC's inadvisable reclassification of ISPs under Title II, which gave it the authority over broadband CPNI (customer proprietary network information), the proposed regulatory framework for which it voted on Thursday.

"My position on this issue is pretty simple," Republican commissioner Ajit Pai said. "Online consumers should and do have a uniform expectation of privacy. That expectation should be reflected in uniform regulation of all companies in the Internet ecosystem. That’s the model we had during a decade of FTC regulatory oversight; that’s the model that gave us an Internet economy that’s the envy of the world. Because the FCC rejects restoring this approach in favor of corporate favoritism, I dissent."