For years, the business community has been calling for a comprehensive federal privacy law, frustrated with operating under a patchwork of sometimes-conflicting state laws. Now Congress is considering one that's extremely wide-ranging and that observers say has a legitimate chance of passage.

The American Privacy Rights Act (APRA)—unveiled over the weekend by Senate Commerce Committee chair Maria Cantwell (D-Washington) and House Commerce Committee chair Cathy McMorris Rodgers (R-Washington)—would cover every company with annual revenue topping $40 million, along with nonprofits, a realm previously untouched by the privacy regime.

The measure would restrict how companies can collect, use, and transfer data and would give consumers the right to opt out of targeted advertising and the transfer of data to others. Companies would be severely limited in the amount of information they could collect and use, and would be barred from transferring sensitive data to a third party without express consent.