PRIA Logo™
119-hr-8652119th CongressWALLET

YODA

Sponsored By: Representative Cloud, Michael [R-TX-27]

Introduced

Summary

User ownership of personal data. The You Own the Data Act would declare that people own the data they create and give them rights to access, correct, delete, and move that data.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

6 provisions identified: 5 benefits, 1 costs, 0 mixed.

Which data and companies are covered

This bill would define what counts as "covered data" and which companies must follow the rules. Covered data would include location tied to an address, phone and email, Social Security and government IDs, browsing history, call records, communications contents, financial nonpublic information, and biometric data. It would also define big online platforms, commercial data operators, and data brokers by firm size and revenue thresholds. If enacted, these definitions would determine which people and firms get new rights and duties under the bill.

Companies can require consent to use service

This bill would allow a covered company to require that you consent to transferring your covered data as a condition of using its service. In practice, that could mean you must agree to certain data sharing to get access to an app or website. This would give companies a clear legal basis to make data transfer part of their terms of service.

Limits on data collection, tracking, and minors

This bill would stop companies from keeping or using more personal data than needed for a requested service or for fraud prevention. Browsing history and biometric data would have to be deleted within 60 days. Companies generally could not collect, keep, or share covered data for minors under 18 without a parent's affirmative consent when it is technically feasible. Companies could not ask you to share other people's contact lists unless each contact and you give written consent. Tracking cookies would be banned unless you authorize them.

User access, fixes, deletion, and breach help

This bill would give users stronger access and repair rights for their covered data. You would be able to send a verified request and the company would have up to 90 days to give your data, a list of who got it, and why. You would be able to require corrections, request deletion or de-identification, and use these rights at least twice in any 12-month period for free. If your data is breached, companies would have to notify you and offer credit protection, fraud alerts, and credit monitoring, at no cost.

Enforcement and private lawsuits for violations

This bill would let the FTC enforce the rules using its full powers and treat violations as unfair or deceptive acts. State attorneys general could also sue companies on behalf of residents, with notice to the FTC and possible FTC intervention. Individuals could sue large covered companies (those with at least $50 million in global revenue) and, if they win, could get $100 to $750 per violation plus lawyer fees and other relief.

Clear notices and one-click opt-outs

This bill would require companies to show a short privacy notice of 1,000 words or less that says what data is collected and whether it is sold or shared. Websites and apps would also need a visible opt-out icon you can click to opt out of data collection. If you allow a company to sell your covered data, the company would have to send an annual report listing what was shared, why, and who received it.

Sponsors & CoSponsors

Sponsor

Cloud, Michael [R-TX-27]

TX • R

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation