PRIA Logo™
119-s-4211119th CongressWALLET

Consumer Data Privacy and Security Act of 2026

Sponsored By: Senator Moran, Jerry [R-KS]

Introduced

Summary

A national privacy law that gives people real control over their personal data. This bill would set rules for notice and consent, create access and deletion rights, require security programs, and empower the Federal Trade Commission to enforce them.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

5 provisions identified: 0 benefits, 1 costs, 4 mixed.

Enforcement, penalties, and federal preemption

If enacted, the Federal Trade Commission would enforce the law and could treat violations as unfair or deceptive acts. For knowing violations, the Commission could seek a civil penalty of up to $42,530 for each person affected. State attorneys general could sue in federal court but must notify the Commission before suing; private individuals could not sue under this law. The Commission would be required to add at least 440 staff and report to Congress on enforcement and resources. The bill would also preempt conflicting state or local privacy laws while preserving listed state and federal protections and require Commerce, the Commission, and GAO to report on cross-border rules and law consistency.

Rules on consent, notice, and sensitive data

If enacted, the bill would define what counts as personal and sensitive data and treat device IDs (like cookie numbers and device serials) as personal data. Covered entities would have to post clear privacy policies with data types, purposes, retention, and third-party sharing and must notify people about major changes. The bill would require express affirmative consent before using sensitive data in new ways, but it would also list specific situations where companies may process data without consent, such as to provide a service, follow the law, prevent danger, stop fraud, do limited research, or run internal operations.

Stronger privacy rules for large data firms

If enacted, firms that process personal data for more than 20,000,000 people or sensitive data for more than 1,000,000 would need to name a privacy officer, run a written privacy program, and document privacy impact assessments for new sensitive-data uses. All covered entities and service providers would also need a written data security program with staff, risk assessments, technical safeguards, vendor rules, and updates. The bill would exempt qualifying small businesses from certain access and correction duties (small-business tests include no more than 500 employees and under $50,000,000 average receipts plus lower data-volume limits).

New contracts and rules for service providers

If enacted, covered entities would have to use written contracts that limit a service provider to process data only as directed and that require the provider to delete, de-identify, or return data when the job is done. Service providers would have to help covered entities comply with verified rights requests when possible and give evidence of compliance. A service provider could not use a subcontractor without letting the covered entity object, and the subcontractor must follow the same rules. These contract and subcontractor rules would take effect one year after enactment.

New consumer data rights and requests

If enacted, you would be able to ask a covered company whether it has your personal data and get a copy. You would be able to correct wrong data and ask it to be erased, except for data kept for a permitted legal purpose. Companies would have to comply with at least two verified requests in any 12-month period and provide the first two free. Companies would verify your identity before acting and may refuse requests they cannot verify or for listed reasons; they must tell you why and how to appeal.

Sponsors & CoSponsors

Sponsor

Moran, Jerry [R-KS]

KS • R

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation