We first wrote this in April 2024, a couple of weeks after the American Privacy Rights Act was unveiled. At the time it looked like the US might finally get one federal privacy law instead of a growing pile of state ones. It didn't happen.
Short answer
What happened to the American Privacy Rights Act
Senator Maria Cantwell and Representative Cathy McMorris Rodgers released the draft in April 2024. It went to the House as H.R. 8818 in June. A revised version dropped several consumer protections, privacy groups pulled their support, and the Energy and Commerce markup set for June 27, 2024 was cancelled. The bill died when the 118th Congress ended in January 2025.
The fight was the same one that killed every federal privacy bill before it. Should a national law override state laws like California's? And can individuals sue companies directly? Those two questions are still open.
The SECURE Data Act, APRA's 2026 successor
In April 2026, House Republicans introduced the SECURE Data Act (H.R. 8413), the output of a privacy working group the Energy and Commerce chair set up in February 2025. A subcommittee held a hearing on it in June 2026. As of this update it hasn't been marked up or voted on, so treat it as a direction of travel, not a rulebook.
What APRA would have asked of video conferencing
The draft is still worth reading, because every federal proposal since has borrowed from it. For a video platform, the parts that mattered were:
- Data minimization: collect only what the service needs. Recording every call "just in case" would have been hard to defend.
- Individual rights to access, correct, delete and export personal data. In a meeting tool that means recordings, transcripts, chat logs and attendance records, not just the account profile.
- Opt-outs from targeted advertising and from data transfers to third parties.
- Enforcement by the FTC and state attorneys general, plus a private right of action.
None of that is binding. But if you build your call setup around those four points, you're most of the way to what the state laws ask for already.
APRA compliance in practice: the rules that apply to your calls today
With no federal law, a US company running video calls is dealing with three layers:
- State comprehensive privacy laws. California's CCPA/CPRA is the strictest, and Virginia, Colorado, Texas and a long list of others now have their own.
- Sector laws. HIPAA if you handle patient data (see our guide to HIPAA-compliant self-hosted telehealth video), FERPA for schools, GLBA for financial firms.
- Recording consent. Some states need only one party's consent to record a call, others need everyone's. If your calls cross state lines, assume all-party consent.
If you also have users in Europe, GDPR sits on top of all of this, and it is stricter than any US state law. We cover that in GDPR compliance for WebRTC video. The EU's Digital Markets Act, despite the similar-sounding name, only binds a handful of very large platforms.
Where self-hosting helps (and where it doesn't)
Most of the compliance work on a video platform comes down to one question: where do the recordings, chat logs and transcripts live, and who can reach them? With a SaaS tool, the answer is "on the vendor's servers, under their retention policy." With a self-hosted Jitsi Meet server in your own AWS or GCP account, the answer is "in your account, under yours."
That's why Meetrix sells Jitsi as an image that runs in your own cloud account rather than as a hosted service. It doesn't make you compliant by itself. You still have to decide:
- How long recordings stay in storage before they're deleted.
- Who can start a recording, and how participants are told about it.
- Who on your team can open the server, the storage bucket and the logs.
- Whether calls need end-to-end encryption, which in Jitsi trades away recording and some other features.
Get those four written down and enforced, and you'll be in good shape whichever federal bill eventually passes. For the wider case for keeping call data in-house, see sovereign video conferencing.
Frequently Asked Questions
Is the American Privacy Rights Act law?
No. APRA was introduced as H.R. 8818 in June 2024, its committee markup was cancelled, and it expired in January 2025 at the end of the 118th Congress. There is still no federal privacy law covering most US businesses.
What replaced APRA?
Nothing has passed. In April 2026 House Republicans introduced the SECURE Data Act (H.R. 8413), built on the Energy and Commerce privacy working group's drafts. It had a subcommittee hearing in June 2026. Preemption and a private right of action are still the sticking points.
What is an APRA compliance solution for video conferencing?
There is nothing to certify against, since APRA never passed. What vendors sell under that label is really data minimization, retention limits and access controls, which state laws, HIPAA and GDPR already require. Self-hosting gives you direct control over all three.
Which privacy laws apply to US video calls today?
State comprehensive privacy laws such as California's CCPA/CPRA, Virginia, Colorado and Texas, plus sector laws: HIPAA for healthcare, FERPA for schools, GLBA for finance. Call recording consent rules also vary by state.
Does self-hosting video conferencing help with privacy compliance?
It helps, it doesn't finish the job. Running Jitsi Meet in your own cloud account keeps recordings, chat and logs on infrastructure you control. You still need retention rules, access control and a consent process.