This bill creates a single federal privacy and security statute that defines personal and sensitive data, sets when covered entities may collect or process data, gives individuals access, correction, and deletion rights, and requires reasonable security programs. It distinguishes covered entities that set purposes and means from service providers who act at direction, and it requires transparency through public privacy policies and notice of material changes.
The measure centralizes enforcement at the Federal Trade Commission (with state attorneys general able to sue), prescribes per-person civil penalties for knowing violations, preempts most state privacy rules while preserving statutes (for example) that protect financial, health, student, and certain other categories of data, and phases in the law one year after enactment.
At a Glance
What It Does
Requires that covered entities collect or process personal data only with an individual’s consent or under enumerated permissible purposes; mandates deletion or de-identification of sensitive data when no longer necessary; compels public privacy policies and advance notice of material changes; and requires data-security programs and accountability measures for large data handlers.
Who It Affects
Applies to entities that determine the purpose and means of processing personal data (including certain common carriers and nonprofits) and to service providers who process data on their behalf; defines a small-business carveout by employee, revenue, and volume thresholds and sets stricter rules for entities processing very large volumes of personal or sensitive data.
Why It Matters
Replaces a patchwork of state regimes with a single federal rulebook for many commercial actors, changes contractual obligations between platforms and vendors, raises operational requirements around consent and deletion, and imposes steep per-record penalties for knowing violations — all of which will reshape compliance programs, vendor risk management, and product design.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill sets a nationwide baseline for how companies handle information that identifies or is reasonably linkable to a person. It codifies core terms (personal data, sensitive personal data, de-identification, pseudonymization), draws a legal line between ‘‘covered entities’’ that set purposes and ‘‘service providers’’ that act at direction, and lists specific permissible purposes that allow processing without individual consent (for example, to fulfill a request, comply with law, prevent imminent danger, fraud prevention, limited operational uses, and narrowly constrained research).
Sensitive categories—government identifiers, biometric data, health and precise geolocation, among others—trigger stronger protections and often require express affirmative consent.
Operational obligations sit on three pillars: transparency, individual control, and security. Covered entities must post clear privacy policies describing categories of data collected, retention practices, third-party disclosures, and how individuals exercise rights; they must notify individuals of material policy changes and, when feasible, give direct notice.
Individuals gain rights to confirm whether an entity holds their data, receive a copy in a usable electronic format (and where feasible portable and transmittable), seek correction, and require deletion or de-identification except where a permissible purpose applies. The bill defines how requests are verified, how often they may be made at no charge, and when an entity may decline (for example, where fulfilling a request would be impossible, would impair security, or would contravene legal obligations).Security and accountability get specific attention: covered entities and service providers must maintain comprehensive security programs scaled to their size and the sensitivity of the data; large-scale processors (those handling data for more than 20 million individuals or sensitive data for more than 1 million) must designate a privacy officer, document privacy-impact assessments for material changes involving sensitive data, and implement a written privacy program incorporating safeguards such as encryption and de-identification.
Contracts between covered entities and service providers must limit processing to instructions and require representations about privacy controls; subcontracting requires notice and equivalent obligations.Enforcement is primarily through the FTC (treated as unfair or deceptive practice authority), with state attorneys general authorized to bring parens patriae suits; the statute preempts most state privacy laws to create a uniform federal standard but preserves a list of sectoral and other state laws (breach notification, GLBA, HIPAA, COPPA, FERPA, ECPA, etc.). Civil penalties are available for knowing violations and are calculated on a per-individual basis, subject to mitigating considerations.
Implementation resources are addressed: the FTC must expand staff and report to Congress on resource needs, and the statute becomes effective one year after enactment (preemption takes effect immediately).
The Five Things You Need to Know
The bill defines an applicable-entity threshold requiring dedicated privacy officers and written programs for entities that process personal data of >20 million people annually or sensitive data of >1 million.
Express affirmative consent is mandatory for processing sensitive personal data or for disclosures to third parties for purposes not enumerated as permissible; otherwise, the bill allows implicit consent where notice is given and the individual does not opt out.
Civil penalties for knowing violations may be sought per affected individual up to $42,530 each, subject to considerations such as harm, intent, company size, mitigation, and self-reporting.
Covered entities must delete or de-identify sensitive personal data once it is no longer reasonably necessary to accomplish the stated purpose, unless deletion is impossible or demonstrably impracticable.
The law preempts most state privacy requirements but expressly preserves a set of federal and state sector laws (for example, COPPA, GLBA, HIPAA, FERPA, and state breach-notification statutes).
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions and scope: who counts and what counts
This section establishes the building blocks you must use when reading the statute: categories like personal data, sensitive personal data, service provider, covered entity, de-identification, and pseudonymization. Practical implications flow from those choices: device identifiers are explicitly treated as personal data, employee and certain employment-related data are carved out from personal-data protections, and de-identification requires technical steps, a public commitment not to re-identify, and contractual restraints on onward recipients. Compliance hinges on mastering these definitions because they determine which obligations attach and which exemptions apply.
When collection and processing are allowed
The statute generally bars collection or processing without either consent (explicit or implicit under the bill’s notice-and-opt-out model) or a listed permissible purpose. The permissible purposes list is operational: contract performance, legal compliance, imminent safety, fraud prevention, narrowly limited research, and internal operational functions. For third-party recipients (covered entities that receive data from another covered entity), the bill limits reliance on prior consent unless the original discloser provided notice and obtained consent; third parties also cannot rely on the permissive marketing/operational exceptions that primary controllers can use. In practice this means re-evaluating data flows, mapping third-party disclosures, and documenting the legal basis for each processing activity.
Transparency: privacy policies and notice of material changes
Covered entities must publish a plain-language privacy policy that goes beyond marketing prose to disclose categories of data, retention logic, third-party disclosures, and a notice mechanism for material changes. The bill requires preservation of prior policy versions and imposes timing and content rules for change notices—direct notice when feasible and public posting otherwise, with a hold on changed processing of previously collected sensitive data until consent is obtained. For compliance teams this creates recordkeeping and change-management obligations tied to product updates and vendor changes.
Individual rights: access, portability, correction, deletion
Individuals can verify whether an entity holds their data, obtain copies (electronic by default with portability where feasible), dispute inaccuracies, and request deletion or de-identification except when a permissible purpose applies. Requests must be verified, accessible, and free at least twice per year; entities can refuse manifestly unfounded or excessive requests. The statute balances ease of exercise with safeguards against fraud or impossible technical burdens by allowing reasonable identity verification and by listing specific grounds to decline requests (for example, public-safety or legal obligations).
Security program obligations
Both covered entities and service providers must maintain a documented, risk-based data-security program scaled to their size, operations, and the sensitivity of data. Required elements include designated personnel, regular risk assessments across people and systems, controls to mitigate identified risks, third-party oversight, and periodic reassessment when technology or threat landscapes change. Audits, encryption where appropriate, and documented remediation activities will be central to demonstrating compliance.
Accountability for large processors
Entities that cross high-volume thresholds must designate a privacy officer, perform privacy-impact assessments for material changes to processing sensitive data, and implement a comprehensive privacy program that aligns practices with published policies and vendor commitments. The privacy officer must approve impact assessments before new sensitive-data processing begins and act as the regulator-facing contact. These checks create governance obligations that will influence product road maps and M&A due diligence.
Service-provider rules and contractual controls
Contracts are the means by which covered entities delegate work to service providers: they must bind service providers to process only on instruction, specify purposes and technical measures, and include representations about compliance. Service providers bear duties to assist with individual requests, delete data after services conclude, notify controllers of legal-compulsion processing, and apply equivalent obligations to subcontractors. Controllers must perform due diligence and investigate credible noncompliance; the statute requires operational mechanisms to transmit, correct, or delete data held by vendors.
Enforcement, penalties, and preemption
The FTC enforces the statute as an unfair-or-deceptive-practice authority with the power to seek injunctive relief and, for knowing violations, civil penalties calculated per affected individual (subject to statutory maximums and mitigating factors). State attorneys general may bring parens patriae suits but must coordinate notice and may be constrained while federal enforcement is pending. The Act explicitly preempts most state privacy laws to create uniform federal standards but lists preserved laws (sectoral and certain state statutes) that remain operative.
Implementation requirements and reporting
The bill directs a significant expansion of FTC staffing (an express minimum number of hires) and annual reporting on resources and enforcement outcomes. It also mandates international engagement to reduce cross-border frictions, periodic GAO reviews of federal privacy statutes, and recurring Commission reports to Congress on the law’s effectiveness and resource needs—provisions that will shape enforcement capacity and rulemaking priorities.
This bill is one of many.
Codify tracks hundreds of bills on Privacy across all five countries.
Explore Privacy in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumers who want simpler control over their data: the law consolidates access, correction, portability, and deletion rights into a single statutory regime and requires clear notice before data collection and material policy changes.
- Individuals with sensitive attributes (health, biometrics, precise geolocation): the statute elevates protection for these categories by generally requiring express affirmative consent and limiting reuse or third-party disclosures.
- Privacy-focused researchers and standards bodies: the bill allows narrowly defined research exceptions if data stay internal and the work advances recognized public interests, while encouraging de-identification and privacy-enhancing technologies that facilitate legitimate research without exposing identities.
Who Bears the Cost
- Covered entities and platforms that operate large-scale profiling or cross-platform tracking businesses: they must rework consent flows, data-retention policies, and potentially redesign persistent identifiers and advertising models to comply with new limits on processing and sensitive data handling.
- Service providers and vendors: contractual obligations, new deletion and assistance duties, and stricter subcontracting rules will increase operational burdens and require expanded documentation and compliance tooling.
- Small businesses that cross the volume thresholds or lack resources: even with a small-business carveout for some notice and consent requirements, implementing security programs, vendor due diligence, and privacy-impact assessments can impose nontrivial technical and legal costs.
Key Issues
The Core Tension
The central dilemma is balancing a uniform federal framework that simplifies cross-jurisdiction compliance with the need for stronger, targeted protections in specific high-risk contexts: the bill standardizes rules for most commercial actors but preserves multiple sectoral and state protections, forcing regulators and courts to reconcile uniformity with the reality that some data types and uses may deserve tighter local or sector rules.
Several practical tensions and open questions arise on implementation. First, the bill permits implicit consent in many situations but reserves express affirmative consent for sensitive categories and certain third-party disclosures — that mixed model leaves compliance teams to make careful case-by-case decisions about when an opt-out suffices and when an opt-in is mandatory.
Ambiguity about what constitutes ‘‘reasonable’’ notice, ‘‘reasonable due diligence’’ of vendors, or ‘‘demonstrably impracticable’’ deletions will generate compliance risk and likely demand agency guidance or litigation to clarify.
Second, the statute's per-person penalty calculus and the Commission's discretion to consider harm, intent, company size, and mitigation create an enforcement regime that is both potent and fact-specific. Entities facing incidents will need detailed documentation to show they took reasonable steps, engaged in vendor oversight, and mitigated harm.
Third, the preemption design—wide federal occupation of the privacy field but an explicit preservation list for sectoral and state rules—could produce corner cases where state consumer protection laws intersect with the federal standard, particularly for areas the bill preserves (employment data, anti-discrimination, breach notifications), requiring careful legal mapping in compliance programs.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.