Consumer Data Privacy and Security Act of 2026

Key Points

• This bill creates a single federal standard for how companies must handle personal information, covering everything from names and addresses to sensitive data like health records, biometrics, and precise geolocation. Companies must clearly explain what they collect and why.
• Americans would gain new rights to see what data companies hold on them, request corrections, and demand deletion. Companies must respond to at least two such requests per year at no cost to the individual.
• Collecting sensitive personal data like biometrics, health information, precise location, race, religion, or sexual orientation would require express affirmative consent that cannot be inferred from inaction.
• The bill explicitly blocks individuals from suing companies directly for privacy violations. Enforcement would be handled only by the FTC and state attorneys general, who could impose penalties of up to $42,530 per affected person for knowing violations.
• The law would preempt most state privacy laws, creating one uniform national standard. However, it preserves state data breach notification laws, financial privacy rules under Gramm-Leach-Bliley, HIPAA health data protections, and anti-discrimination laws.
• Small businesses with fewer than 500 employees, under $50 million in revenue, and handling data from fewer than 1 million people would be exempt from some of the tougher requirements like individual access and correction rights. The FTC would also hire at least 440 new staff to enforce the law.