DELETE Act
- Sponsor
- Sen. Cassidy, Bill [R-LA]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Apr 3, 2025
Bottom line
The DELETE Act aims to empower individuals with a single point of control over their personal data held by data brokers, requiring brokers to comply with deletion requests and cease future collection, while establishing FTC oversight and enforcement.
What it actually does
This bill, known as the DELETE Act, mandates the Federal Trade Commission (FTC) to establish a centralized online system allowing individuals to submit a single request to all registered data brokers for the deletion of their personal information and the discontinuation of future data collection. It requires data brokers to register annually with the FTC, provide details on their data practices, pay a fee for system access, and comply with deletion requests within 31 days, subject to triennial independent audits.
Proponents argue
Supporters argue that this bill provides a crucial, streamlined mechanism for individuals to reclaim control over their personal data from the often-opaque data broker industry. They contend it simplifies a currently fragmented and burdensome process, enhances consumer privacy, and fosters transparency by requiring data broker registration and public disclosure of practices.
Opponents contend
Critics may contend that the bill imposes significant and potentially unmanageable operational and financial burdens on data brokers, particularly smaller entities, due to the technical complexities of integrating with a new federal system, implementing rapid deletion processes, and undergoing frequent audits. Concerns might also be raised about the security and technical feasibility of a centralized system and its potential impact on legitimate data uses like fraud prevention.
The bill is relatively concise and its core mechanisms are clearly articulated, making it accessible for an informed reader to understand its primary intent and key provisions within a reasonable timeframe.
Section 2(a)
Data Broker Annual Registration
This provision requires any entity meeting the definition of a 'data broker' to register annually with the Federal Trade Commission (FTC). As part of this registration, data brokers must provide their contact information, details on how individuals can opt out of data collection or sales, the types of information they collect and their sources, and a description of any credentialing process they use. This registration information will be made publicly available by the FTC.
Supporters argue
Supporters argue this provision creates essential transparency, allowing individuals and regulators to identify and understand the operations of data brokers, which are often opaque. It provides a foundational step for consumer awareness and regulatory oversight.
Critics contend
Critics may argue that the registration requirements are overly burdensome, especially for smaller entities, and that disclosing certain operational details could be detrimental to business models or competitive advantage, potentially revealing proprietary information.
Tradeoffs
This provision balances the public's right to transparency and regulatory oversight against potential administrative burdens and disclosure concerns for data brokers, particularly regarding the detail of information required.
Section 2(b)(1)
Establishment of Centralized Data Deletion System
The bill directs the FTC to establish a secure, centralized system within one year of enactment. This system will allow an individual, through a single submission, to request that all registered data brokers delete their personal information and discontinue future collection. The system will use hashed registries of persistent identifiers (like email, phone, physical address) and allow registered data brokers to query these registries to identify deletion requests without accessing raw personal data.
Section 2(b)(2)
Data Deletion Requirements and Audit
This provision mandates that data brokers, within 31 days of identifying a match with the FTC's hashed registries, must delete all personal information related to the individual and discontinue future collection, sending an affirmative representation of deleted records to the FTC. It also requires registered data brokers to undergo an independent third-party audit every three years to ensure compliance with these deletion requirements, with audit reports submitted to the FTC and maintained for at least six years.
Section 2(b)(3)
Annual Subscription Fee for Data Brokers
This section requires registered data brokers who maintain persistent identifiers to pay an annual subscription fee to the FTC for access to the centralized data deletion system. The fee amount will be determined by the Commission but is capped at 1 percent of the expected annual cost of operating the system and hashed registries. All collected fees are to be used exclusively by the FTC for enforcing and administering the DELETE Act, including system maintenance and public awareness.
Section 2(e)
State Law Preemption
This provision states that the DELETE Act will preempt any State privacy law only to the extent that such State law is inconsistent with the provisions of this Act. Crucially, a State privacy law is explicitly deemed *not* inconsistent if the protection it affords any person is greater than the protection provided under this Act, as determined by the Commission.
This subsection defines several exclusions from the term 'data broker,' meaning certain entities are exempt from the Act's requirements. These exclusions include entities providing 411 directory services, using publicly available business information, providing data at an individual's express direction for a single-use purpose, assessing identity or preventing fraud, news gathering/publishing, and acting as a consumer reporting agency under the Fair Credit Reporting Act.
Section 2(f)(3)(B)
Why it matters:It is standard legislative practice to place definitions and exclusions in a dedicated section. However, the specific scope of these exclusions significantly impacts the reach of the bill, making it a consequential detail for those affected.
Case for: Supporters argue these exclusions are essential to avoid inadvertently burdening entities performing legitimate and necessary functions that are not the primary target of the bill's privacy concerns, such as public safety, journalism, or credit reporting.
Case against: Critics might argue that some exclusions are too broad and could create loopholes, allowing certain entities to operate outside the deletion system despite engaging in activities that impact individual privacy, potentially undermining the bill's comprehensive intent.
Estimated impact: Significantly narrows the scope of entities subject to the DELETE Act, exempting a range of businesses from registration, fee, and deletion requirements, thus reducing the number of entities individuals can request data deletion from via the centralized system.
This subsection provides a broad definition of 'personal information,' encompassing any information linked or reasonably linkable to an individual or consumer device. It explicitly lists financial information, various identifiers (e.g., name, address, IP, email, phone, government IDs), geolocation, biometric information, content of communications, web browsing history, genetic sequencing, device identifiers, and any inferences used to create profiles about an individual's characteristics or behaviors.
Section 2(f)(9)
Why it matters:Defining key terms is standard legislative practice, but the breadth and specific inclusions of 'personal information' are highly consequential. Its placement at the end of the bill means a casual reader might not fully grasp the extensive scope of data covered by the deletion requirements.
Case for: Proponents argue this broad definition is necessary to comprehensively protect individual privacy in the modern data ecosystem, covering various forms of data that can identify, track, or profile an individual, ensuring the deletion system is effective against evolving data practices.
Case against: Critics might argue that such a broad definition could encompass data that is not truly sensitive or personally identifiable in all contexts, leading to over-regulation and significant compliance challenges for data brokers, potentially increasing the cost and complexity of data management.
Estimated impact: Expands the scope of data that data brokers must delete and cease collecting under the Act, significantly increasing the privacy protections for individuals by covering a wide array of digital and personal identifiers and inferred characteristics.