# 119-hr-8014: Online Privacy Act of 2026 119-hr-8014, Online Privacy Act of 2026, is a 119th Congress bill sponsored by Rep. Lofgren, Zoe [D-CA-18] (D-CA); status introduced; PRIA reads it as touching household money (as of 2026-04-21). - Canonical: https://policyrisk.com/legislation/119-hr-8014 - As of: 2026-04-21 - Plain-text twin of the page above; the HTML and this file carry the same facts. ## Facts - Bill: 119-hr-8014 - Congress: 119 - Title: Online Privacy Act of 2026 - Status: introduced - Introduced: 2026-03-19 - Sponsor: Rep. Lofgren, Zoe [D-CA-18] (D-CA) - Cosponsors: 0 - Policy area: Science, Technology, Communications - Touches household money: yes - Last recorded action: 2026-04-21 ## Summary **This bill would create a new federal privacy regulator and a comprehensive privacy law** that gives people new control over their data and limits how companies collect, use, and share personal information. It focuses on individual rights, strict limits on behavioral personalization, data minimization, and a federal enforcement system headed by a Digital Privacy Agency. ## Provisions PRIA read - New consent, sharing, and ad limits: benefit, high. If enacted, companies would need consent before disclosing personal information to third parties and must name the buyer before any sale of data. Behavioral personalization that aims to change your behavior would be banned unless you give express consent that must be renewed annually. The bill woul… - Stronger limits on your private messages: benefit, high. If enacted, the bill would ban companies from collecting, processing, keeping, or sharing the contents of your private communications except for a short list of allowed reasons. Allowed reasons include delivering the message to intended recipients, stopping security threats, helping draft content,… - Small business privacy definition and relief: benefit, high. If enacted, the bill would define which covered entities qualify as small businesses using five tests: no revenue from selling personal data; less than 50% of revenue from targeted ads; kept data for fewer than 250,000 people for most months; under 200 employees; and less than $25,000,000 in annual… - Ban on discriminatory automated decisions: benefit, high. If enacted, the bill would forbid companies from processing personal data or message contents in ways that discriminate against protected classes for jobs, credit, housing, insurance, education, and related commercial opportunities. The Director would need to issue initial disparate-impact rules wi… - Data security, breach rules, and limits: benefit, medium. If enacted, covered entities would need reasonable written security programs, vulnerability assessments, access oversight, and breach response plans. Breaches that may harm people must be reported to the DPA, and typically a covered entity must notify the DPA within 72 hours and affected individual… - Easier identity checks and limits on government data sales: benefit, medium. If enacted, companies could not deny a Title I privacy request just because you refuse to provide extra identifying information when they can confirm your identity from data they already have or from a prior similar confirmation. Separately, a government entity could not disclose personal informati… - New private lawsuit and whistleblower pay: benefit, medium. If enacted, individuals harmed by violations could sue for injunctions and damages starting one year after enactment. Qualified nonprofits could bring claims for people and split damages evenly with those they represent; nonprofits may get fees for expenses. People who provide nonpublic evidence to… - Stronger individual data rights and timelines: benefit, medium. If enacted, you would be able to access categories of data held about you and who got it, and you could get copies of communication contents. You would be able to ask for deletion and to dispute and correct inaccurate data in cases that may cause serious privacy harms. If a decision about you is ma… - You choose how long data is kept: benefit, medium. If enacted, companies would need your express consent to keep your personal information and could not keep it longer than the duration you agreed. When asking for consent they must offer options like keeping data only to finish the transaction, keeping it until you revoke consent, or other set dura… - Bill preserves existing privacy laws: benefit, medium. If enacted, the bill would say it does not modify, limit, or supersede a long list of named federal privacy and security laws. It would also allow stronger state or local privacy or consumer-protection laws to continue to apply when they give consumers greater protection. The rule specifying non-pr… - Federal crime for malicious doxxing: benefit, medium. If enacted, it would be a federal crime to knowingly disclose someone's personal information across state or national lines with the intent to threaten, intimidate, harass, incite or facilitate violence, or to place them in reasonable fear of death or serious injury. A person who knowingly makes su… - Ban on re-identifying anonymized data: benefit, medium. If enacted, the bill would bar companies from using personal data to re-identify individuals from de-identified datasets. Companies that disclose de-identified data would have to contractually prohibit third parties from re-identifying people. The Director could allow narrow noncommercial research… - New federal privacy agency and funding: benefit, medium. If enacted, the bill would create a new Digital Privacy Agency (DPA) led by a Presidential appointee serving a six-year term. Congress would be asked to fund the DPA with $550 million per year for fiscal years 2026 through 2030. The DPA would take over Federal privacy rulemaking previously handled… - New privacy research and standards: benefit, medium. If enacted, the bill would direct NIST to create a voluntary privacy risk-management framework with standards and best practices. The NSF would get authority to fund competitive multidisciplinary privacy research. The bill would also authorize $3 million per year (2026–2030) for privacy education,… - Tighter rules on sending data abroad: benefit, medium. If enacted, the bill would bar companies from intentionally sending personal data to entities not under U.S. jurisdiction or not complying with the Act. A narrow exception would allow simple identifiers used only to route electronic messages. Companies could still transfer data under strict safe ha… - Behavioral personalization requires consent: mixed, medium. If enacted, companies would need your clear, affirmative consent before using your personal data to personalize behavior or target you. That consent would have to be renewed at least once every calendar year. If you refuse, companies must provide a non-personalized version of a product or service u… - Stronger enforcement, penalties, and coordination: mixed, medium. If enacted, the DPA would get civil investigative powers, administrative hearings, and authority to seek injunctions and civil penalties. Civil fines could be calculated using the FTC Act maximum (adjusted for inflation) multiplied by the number of people affected, with each continuing day treated… ## Related bills - 119-hr-3816: Weather Act Reauthorization Act of 2025 - 119-hr-7977: Energy Bills Relief Act - 119-hr-7481: Department of Homeland Security Appropriations Act, 2026 - 119-hr-7973: Momnibus Act - 119-hr-5089: Weather Act Reauthorization Act of 2025 - 119-hr-7273: NASA Reauthorization Act of 2026 ## Sources - [119-hr-8014 on Congress.gov](https://www.congress.gov/bill/119th-congress/house-bill/8014) ## Related - [119-hr-3816: Weather Act Reauthorization Act of 2025](https://policyrisk.com/legislation/119-hr-3816) - [119-hr-7977: Energy Bills Relief Act](https://policyrisk.com/legislation/119-hr-7977) - [119-hr-7481: Department of Homeland Security Appropriations Act, 2026](https://policyrisk.com/legislation/119-hr-7481) - [119-hr-7973: Momnibus Act](https://policyrisk.com/legislation/119-hr-7973) - [119-hr-5089: Weather Act Reauthorization Act of 2025](https://policyrisk.com/legislation/119-hr-5089) - [119-hr-7273: NASA Reauthorization Act of 2026](https://policyrisk.com/legislation/119-hr-7273) - [All bills in Congress](https://policyrisk.com/legislation) Source: PRIA, https://policyrisk.com/legislation/119-hr-8014 (as of 2026-04-21).