YODA
- Sponsor
- Rep. Cloud, Michael [R-TX-27]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- May 4, 2026
Bottom line
This bill fundamentally redefines data ownership and control, shifting power from commercial entities to individual users by imposing strict regulations on data collection, use, and sharing, with significant implications for the digital economy.
What it actually does
This bill, titled the "You Own the Data Act" or "YODA," establishes that users own their data and prohibits entities from conditioning services on the transfer or monetization of private data. It mandates written consent for collecting third-party contact information, grants users rights to access, correct, delete, and port their data, and requires data minimization and transparency from commercial data operators. The bill also includes robust enforcement mechanisms, including a private right of action.
Proponents argue
Supporters argue that the bill is a critical step to protect individual privacy and property rights in the digital age, empowering users to control their personal information and preventing its exploitation by large tech companies. They contend it will foster a more transparent and equitable online environment, aligning with fundamental civil liberties.
Opponents contend
Critics, particularly from the tech industry, would likely contend that the bill's stringent requirements, especially the prohibition on data monetization and the private right of action, would impose immense compliance costs, stifle innovation, and disrupt the ad-supported business models that provide many free online services, potentially leading to increased costs for consumers.
The bill is relatively concise and clearly structured, allowing an informed reader to thoroughly understand its provisions within a typical legislative review timeframe.
Section 3(a)
Prohibition on Sharing User Contacts Without Written Consent
This provision makes it unlawful for any covered entity to request or share a user's contacts or information about those contacts unless both the user and the contacts themselves provide explicit written consent for such use. This aims to protect the privacy of individuals who have not directly interacted with the service.
Supporters argue
Proponents argue this provision is essential for protecting the privacy of individuals who have not consented to data collection, preventing unsolicited communications and the unauthorized expansion of personal networks by third parties.
Critics contend
Opponents might argue that this provision could hinder the functionality of social networking and communication platforms, making it more difficult for users to connect with friends and grow their networks organically.
Tradeoffs
The provision balances user convenience in connecting with others against the privacy rights of individuals whose contact information might be shared without their direct consent.
Section 3(b)
User Rights to Access, Correct, Delete, and Port Covered Data
This section grants users comprehensive rights over their 'covered data,' including the ability to access a list of third parties with whom their data was shared, obtain their data in a readable format, correct inaccuracies, delete or de-identify their data, and port it in a machine-readable format. These rights must be provided free of charge at least twice annually, without retaliation. Additionally, browsing history and biometric data must be deleted within 60 days of collection.
Section 3(c)
Data Minimization and Contextual Use
This provision requires commercial data operators to limit the collection and sharing of user information with third parties to only what is 'reasonably necessary' to provide a requested service or for fraud prevention. Similarly, the use and retention of this information are limited to what is reasonably necessary for service provision or a related operational purpose. Crucially, the bill explicitly states that 'monetization of personal information shall not be considered reasonably necessary' for these purposes.
Section 3(d)
Consumer Choice and Direct Data Deletion
This section mandates that commercial data operators provide a 'prominently and conspicuously displayed icon' on every unique website or application, allowing users to easily opt out of data collection. Furthermore, within two years of enactment, covered entities must take reasonable steps to provide users with the ability to directly delete the covered data they have collected.
Section 3(g)
Prohibition on Tracking Cookies Without User Consent
This provision prohibits commercial data operators from tracking cookies, including on mobile applications, unless the user explicitly authorizes it. Furthermore, it mandates that these operators must provide the same quality of services to users who choose not to authorize tracking cookies as they do to those who do.
Section 3(j)
Multi-Layered Enforcement Mechanisms
This section establishes a comprehensive enforcement framework. Violations are treated as unfair or deceptive acts by the Federal Trade Commission (FTC). State Attorneys General are empowered to bring civil actions, including seeking injunctions, penalties, and damages, with prior notice to the FTC. Crucially, it creates a private right of action, allowing individuals to sue covered entities with over $50 million in global annual gross revenues for statutory damages ($100 to $750 per violation), attorney's fees, and other relief.
This subsection states that a covered entity 'may require, through terms of service or otherwise, that a user must consent to the transfer of covered data in order to use the service of the covered entity.'
Section 3(e)
Why it matters:This provision could be seen as a concession to industry, allowing businesses to maintain their service models even if they require data transfer, potentially undermining the broader intent of user data ownership. Its placement might reflect an attempt to minimize its prominence.
Case for: Supporters might argue that this clause provides necessary flexibility for businesses whose core services inherently rely on data transfer, preventing the complete disruption of certain online offerings and allowing for a balance between user rights and business viability.
Case against: Critics would contend that this provision significantly weakens the bill's core principle of user data ownership by allowing entities to effectively force consent for data transfer as a condition of service, rendering other opt-out and control mechanisms less meaningful for essential services.
Estimated impact: Potentially high, as it could limit the practical impact of other privacy protections by allowing core services to still demand data transfer, affecting user choice for essential platforms.
The definition of 'monetization' as 'the process of collecting, using, and storing data solely for economic benefit.'
Section 3(k)(11)
Why it matters:Definitions are inherently technical, but this specific wording is critical for interpreting the bill's prohibition on data monetization. The inclusion of 'solely' could be a point of contention and potential loophole, which might be less scrutinized in a definitions section.
Case for: Proponents might argue that defining 'monetization' provides necessary clarity for businesses to understand what activities are prohibited, ensuring that data collection primarily for economic gain is explicitly covered by the bill's restrictions.
Case against: Critics could argue that the term 'solely' creates a significant loophole, allowing entities to claim that data is collected for multiple purposes (e.g., service improvement, security) and not *solely* for economic benefit, thereby circumventing the bill's intended restrictions on data monetization.
Estimated impact: High, as the interpretation of 'solely' will directly influence the enforceability and effectiveness of the data minimization and contextuality provisions, particularly regarding ad-supported business models.
A covered entity may not collect, retain, or transfer the covered data of a user below the age of 18 without affirmative consent from their parent or guardian, 'where technically feasible.'
Section 3(f)
Why it matters:Qualifiers often serve to make a provision more palatable to industry by acknowledging implementation difficulties, but they can also create loopholes. Its placement might be to balance strong child privacy protections with practical industry concerns.
Case for: Proponents would argue that this provision is a crucial step to protect the data privacy of minors, recognizing their vulnerability online and giving parents/guardians necessary control over their children's digital information.
Case against: Critics might argue that the 'where technically feasible' clause could be broadly interpreted by entities to avoid implementing robust age verification and parental consent mechanisms, especially for services not explicitly targeting minors but used by them, thereby weakening the protection.
Estimated impact: Moderate to high, depending on the interpretation and enforcement of 'technically feasible.' It could significantly impact data collection practices for younger users and the services they access.