What does Preamble of Consumer Data Privacy and Security Act of 2026 do?

This bill is formally titled 'A BILL To protect the privacy of consumers.'

What does DEFINITIONS. of Consumer Data Privacy and Security Act of 2026 do?

This section defines key terms used throughout the Act. “Biometric information” is defined as information resulting from technical processing related to an individual’s physical or biological characteristics. “Collection” means acquiring personal data by any means. “Covered entity” refers to entities that determine the purpose and means of collecting or processing personal data and meet specific criteria related to the Federal Trade Commission’s authority, being a common carrier, or being a nonprofit organization. “De-identify” means altering data to prevent linking to a specific individual. “Sensitive personal data” includes categories like social security numbers, biometric information, health information, and geolocation data. “Small business” is defined based on employee count, gross receipts, and the volume of personal data collected.

What does COLLECTION AND PROCESSING OF PERSONAL DATA. of Consumer Data Privacy and Security Act of 2026 do?

This section outlines requirements for the collection and processing of personal data by covered entities. Generally, a covered entity must obtain explicit or implicit consent from an individual before collecting or processing their personal data, or do so in accordance with a permissible purpose. Third parties receiving personal data from another covered entity may collect or process it without direct consent if the original covered entity provided notice and obtained consent, or if the third party's collection aligns with a permissible purpose. Consent can be implicit if an individual doesn't decline a request after being provided with notice and a reasonable time to respond, but express affirmative consent is required for sensitive data or disclosures to third parties for non-permissible purposes. Covered entities must provide clear and concise notices to individuals regarding data collection and processing, including access to privacy policies and information on exercising rights. Individuals have the right to withdraw consent at any time and without undue delay. Permissible purposes for data collection without consent include providing services, complying with laws, preventing immediate danger, fraud prevention, research (for covered entities only), and operational purposes. Covered entities must delete or de-identify sensitive personal data when it's no longer needed, unless deletion is impossible or impractical. In bankruptcy proceedings, covered entities must notify individuals of potential data disclosures and provide them with an opportunity to deny consent or request data deletion.

What does RIGHT TO KNOW. of Consumer Data Privacy and Security Act of 2026 do?

This section establishes a 'Right to Know' requirement for covered entities. Covered entities must make a privacy policy publicly available in a clear and prominent location, using easy-to-understand language. The privacy policy must include a description of the entity's data policies and practices, individual rights regarding personal data, and specific content details such as contact information, data categories, retention periods, and third-party disclosures. Entities must also make previous versions of their privacy policies publicly available. Exceptions exist for data collection reasonably necessary for in-person transactions, legal compliance, preventing imminent danger, or protecting data security. Material changes to privacy policies require notification to individuals, describing the changes and their implications. Sensitive personal data collected before a material change cannot be processed inconsistently with the previous policy without express affirmative consent. Entities should directly notify individuals of material changes if feasible; otherwise, they must publish the notice in a prominent location.

What does INDIVIDUAL CONTROL. of Consumer Data Privacy and Security Act of 2026 do?

This section establishes individual control over personal data collected or processed by covered entities. Covered entities must provide individuals with reasonably accessible means to exercise their rights regarding their data. Individuals have the right to access a copy of their personal data and a list of categories of third parties with whom it has been disclosed. Data must be provided in an electronic format unless otherwise requested or electronically providing the data is impossible or demonstrably impracticable. Individuals can request data export in a structured, machine-readable format and transmission to another entity. Covered entities must establish procedures to ensure data accuracy and allow individuals to dispute and correct inaccurate data. Individuals have the right to request erasure of their personal data, with exceptions for data collected for permissible purposes. Small businesses are exempt from certain requirements related to data access and correction. Covered entities can charge a reasonable fee for manifestly unfounded or excessive requests. The Commission will issue guidance on best practices for covered entities and service providers.

What does SECURITY. of Consumer Data Privacy and Security Act of 2026 do?

This section establishes security requirements for covered entities and service providers. Entities must develop, document, implement, and maintain a comprehensive data security program. Safeguards must be appropriate to the entity's size, complexity, resources, and the sensitivity of the data involved. The program must designate responsible employees and identify/assess risks to data security. Safeguards must be implemented to control identified risks and regularly assessed for effectiveness. Third parties and service providers receiving data transfers must also maintain reasonable safeguards. The program requires evaluation and adjustments based on technological changes, threats, and business operations.

What does ACCOUNTABILITY. of Consumer Data Privacy and Security Act of 2026 do?

This section establishes accountability requirements for 'applicable entities,' defined as covered entities or service providers processing a significant amount of personal data. Each applicable entity must designate a privacy officer responsible for overseeing policies and practices related to personal data collection and processing. The privacy officer must inform the entity of its obligations under the Act, monitor compliance, and act as a contact for authorities. Covered entities intending to make material changes in processing sensitive personal data must consider privacy implications and conduct privacy impact assessments. The privacy officer must approve findings from privacy impact assessments before changes can be implemented. Applicable entities must implement a comprehensive privacy program to safeguard personal data, including technical and operational safeguards. The program must ensure practices align with policies, representations to individuals (for covered entities), and representations to covered entities (for service providers).

What does RULES RELATING TO SERVICE PROVIDERS. of Consumer Data Privacy and Security Act of 2026 do?

This section outlines rules relating to service providers who handle personal data on behalf of covered entities. Covered entities must disclose personal data to service providers only through contracts binding on both parties and meeting specific requirements. Covered entities are required to take reasonable steps to identify if service providers have appropriate privacy and security procedures. Contracts between covered entities and service providers must require the service provider to only collect or process data as directed and establish the purposes and means of processing. Service providers must notify covered entities of legal requirements to process personal data and of changes to relevant policies or practices. Service providers must assist covered entities in responding to requests from individuals to exercise their rights regarding personal data. Service providers must delete, de-identify, or return personal data promptly after completing the service for which it was collected. Service providers must make information available to covered entities to demonstrate compliance, or provide a written representation if technically unavailable. Service providers cannot use subcontractors without providing the covered entity an opportunity to object and ensuring the subcontractor adheres to the same requirements.

What does ENFORCEMENT. of Consumer Data Privacy and Security Act of 2026 do?

This section outlines enforcement mechanisms for the Act. The Commission will enforce the Act similarly to the Federal Trade Commission Act (FTC Act), utilizing the FTC Act's jurisdiction, powers, and duties. Civil penalties may be imposed for violations, calculated based on the number of individuals affected, with a maximum of $42,530 per individual. The Commission will consider factors like the degree of harm, intent, size of the entity, and efforts to mitigate risk when determining penalty amounts. State Attorneys General can bring civil actions on behalf of residents to enjoin practices, enforce compliance, and impose civil penalties. State Attorneys General must notify the Commission before initiating a civil action, unless it's not feasible. The Commission can intervene in State actions and appeal decisions. If the Commission initiates an action, States cannot bring a separate action based on the same facts during the Commission's action's pendency. This Act does not create a private right of action.

What does RELATION TO OTHER LAWS. of Consumer Data Privacy and Security Act of 2026 do?

This section establishes a uniform federal privacy framework intended to preempt state and political subdivision laws relating to the privacy or security of personal data. The Act generally supersedes state laws regarding personal data privacy and security, but several exceptions are preserved. Specifically, state laws addressing data breach notification, rules of criminal or civil procedure, fraud, public safety, student privacy (FERPA), financial information (GLBA), protected health information (HIPAA), employment data, and discrimination based on suspect classifications are not preempted. This Act also supersedes other federal statutes or regulations relating to personal data privacy and security, with exceptions for laws like COPPA, CALEA, and GLBA Title V. Compliance with certain enumerated federal laws is deemed to satisfy requirements of this Act for covered data. The Federal Communications Commission’s laws and regulations generally do not apply to covered entities regarding personal data, except for those pertaining to emergency lines.

Back to bills

Consumer Data Privacy and Security Act of 2026

Last updated: 3/25/2026 · Introduced: 3/25/2026

Author: Jerry Moran (R-KS)

TL;DR (AI)

This bill establishes requirements for covered entities to obtain consent before collecting and processing personal data, with exceptions for permissible purposes like providing services or complying with laws.
Covered entities must make their data privacy policies publicly available, including details about data practices, individual rights, and contact information, and notify individuals of significant changes.
Individuals gain greater control over their personal data, including the right to access, correct, export, and request erasure of their data from covered entities.
The bill mandates that covered entities and service providers develop and maintain comprehensive data security programs to protect personal data from unauthorized access and breaches.
The Federal Trade Commission (FTC) and State Attorneys General are empowered to enforce the Act through civil penalties, while preempting most state laws related to personal data privacy and security, except for specific areas like data breach notification and health information.

119th Congressin committeeOfficial page

Verified Votes

No verified votes yet.

Community Votes

No community votes yet. Be the first!

Voting as guest · Sign in for verified votes

Other Sections

Includes provisions on preamble, definitions., and 12 more.

14 sections

Click "Show details" to explore individual sections. Use the community vote above or visit All Sections to vote per section.

Read official text

Want the full experience?

Create a free account to cast verified votes on each section, get a personalized summary, and track your voting history.

Create Free Account