What does Preamble of Online Privacy Act of 2026 do?

This bill, formally titled 'To provide for individual rights relating to privacy of personal information, to establish privacy and security requirements for covered entities relating to personal information, and to establish an agency to be known as the Digital Privacy Agency to enforce such rights and requirements, and for other purposes,' aims to address privacy of personal information. The bill intends to establish individual rights related to the privacy of personal information. It proposes to create privacy and security requirements for covered entities concerning personal information. The legislation seeks to establish a Digital Privacy Agency to enforce these rights and requirements.

What does DEFINITIONS. of Online Privacy Act of 2026 do?

Summary temporarily unavailable. Please try again later.

What does GENERAL PROVISIONS. of Online Privacy Act of 2026 do?

This section establishes rules of construction for references to individual information and communications, requiring a link or reasonable linkability to the individual. The provisions of this Act cannot be waived, and any agreement attempting to waive or modify them is considered void. Predispute arbitration agreements related to claims under this Act are not valid or enforceable. Covered entities engaged in journalism are exempt from certain obligations if those obligations directly infringe on their journalism and they have safeguards in place. The term 'journalism' includes collecting, maintaining, processing, and disclosing personal information for dissemination to the public, particularly concerning public figures or matters of public interest. A covered entity that loses small business status has nine months to comply with provisions previously exempted for small businesses. Covered entities may not collect, maintain, process, or disclose personal information through interstate commerce unless they are in compliance with all requirements of this Act.

What does LIMITATION ON DISCLOSING NONREDACTED GOVERNMENT RECORDS. of Online Privacy Act of 2026 do?

This section limits the disclosure of personal information from government records. Government entities are prohibited from disclosing personal information through interstate commerce unless there's an agreement preventing the recipient from selling the information without the individual's consent. An exception exists for disclosures to other government entities, which are not subject to the consent requirement.

What does CRIMINAL PROHIBITION ON DOXXING. of Online Privacy Act of 2026 do?

This section amends Chapter 41 of Title 18, United States Code, by adding Section 881, which addresses the disclosing of personal information with the intent to cause harm. It criminalizes the knowing disclosure of an individual's personal information via interstate or foreign commerce with the intent to threaten, intimidate, harass, incite violence, or place someone in fear. The law establishes a Digital Privacy Agency with support functions including receiving complaints, coordinating with law enforcement, and providing technical assistance. The Digital Privacy Agency is explicitly prohibited from prosecuting offenses under this section. The section defines key terms such as 'contents,' 'disclose,' 'government entity,' 'individual,' 'personal information,' 'publicly available information,' 'State,' and provides exclusions for personal information. ’Personal information’ means any information linked to a specific individual, but excludes publicly available information.

What does RIGHT OF ACCESS. of Online Privacy Act of 2026 do?

This section establishes a right of access for individuals to personal information held by covered entities. Individuals can access categories of personal information, contents of communications, and the source of information not directly collected from them. Covered entities must provide a list of third parties, subsidiaries, and affiliates with whom personal information has been disclosed or obtained. Entities must describe the business purposes for collecting, processing, maintaining, and disclosing personal information. Individuals have the right to request human review of automated decision-making processes, with descriptions of implications and effects. If information is publicly accessible, providing instructions to access it via a privacy policy satisfies the requirements, provided the instructions are easy and free. Subsection (a)(3) regarding business purposes is excluded for small businesses.

What does RIGHT OF CORRECTION. of Online Privacy Act of 2026 do?

This section establishes an individual's right to dispute the accuracy or completeness of their personal information held by a covered entity. Covered entities must provide a reasonable mechanism for individuals to dispute this information if its processing could increase privacy harms. Upon receiving a dispute, a covered entity must either correct/complete the information and notify the individual, or notify the individual that the information is correct, lacks sufficient information for correction, or is being denied due to an exemption. Small businesses are excluded from the requirements of this section.

What does RIGHT OF DELETION. of Online Privacy Act of 2026 do?

This section establishes an individual's right to request the deletion of their personal information and communications from a covered entity. Covered entities must provide a reasonable mechanism for individuals to make such deletion requests. Upon receiving a deletion request, a covered entity must either delete the information and notify the individual or deny the request citing an exemption or exception under section 109(g) and notify the individual.

What does RIGHT OF PORTABILITY. of Online Privacy Act of 2026 do?

This section establishes a right of portability, allowing individuals to download and transmit their personal information and communications from covered entities. The Director is required to annually determine and publish lists of 'portable categories' of products and services, based on criteria including user numbers, market concentration (Herfindahl-Hirschman Index), and the number of covered entities. Covered entities must provide a mechanism for individuals to download their data in a structured, machine-readable format and transmit it to another covered entity via an application programming interface (API). The API must be publicly documented, include a test version, and be of similar quality to internal mechanisms used by the covered entity. Access to the API is granted to requesting covered entities that self-certify to meeting certain requirements, including compliance with the Act and only using the API at an individual’s request. A covered entity can deny API access if it reasonably believes the requesting entity has not met the self-certification requirements, but denials can be reviewed by the Director. Small businesses are excluded from the requirements of this section. A 'portable category' is defined as one with over 10 million users, a high Herfindahl-Hirschman Index, few providers, or where increased competition is deemed beneficial.

What does RIGHT TO HUMAN REVIEW OF AUTOMATED DECISIONS. of Online Privacy Act of 2026 do?

This section establishes a right to human review for decisions made by covered entities based solely on automated processing of personal information. The automated processing must materially increase reasonably foreseeable significant privacy harms for an individual to trigger this right. Covered entities must inform individuals about the personal information used in the decision. Entities must provide a mechanism for individuals to request human review, either through a direct request or a publicly accessible location. If a review is requested, the covered entity must conduct it within a reasonable timeframe.

Back to bills

Online Privacy Act of 2026

Last updated: 3/19/2026 · Introduced: 3/19/2026

Author: Zoe Lofgren (D-CA)

AI TL;DR will appear after bill summary generation completes.

119th Congressin committeeOfficial page

Verified Votes

No verified votes yet.

Community Votes

No community votes yet. Be the first!

Voting as guest · Sign in for verified votes