Consumer Data Privacy and Security Act of 2026
- Sponsor
- Sen. Moran, Jerry [R-KS]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Mar 25, 2026
Bottom line
The Consumer Data Privacy and Security Act of 2026 aims to create a national standard for consumer data privacy by establishing consent requirements, individual data rights, and security obligations for businesses, enforced by federal and state authorities, while preempting most state laws.
What it actually does
This bill establishes a comprehensive federal framework for consumer data privacy and security, requiring covered entities to obtain consent for data collection and processing, granting individuals rights to access, correct, and erase their personal data, and mandating robust data security programs. It also preempts most state-level privacy laws, creating a uniform national standard, and empowers the Federal Trade Commission (FTC) and State Attorneys General with enforcement authority, while explicitly prohibiting a private right of action.
Proponents argue
Supporters argue that this bill provides much-needed clarity and consistency for businesses operating across state lines by establishing a single, uniform federal privacy standard, thereby fostering innovation and reducing compliance burdens. They contend it empowers consumers with significant control over their personal data, enhancing trust in digital services, and ensures strong enforcement through the Federal Trade Commission and State Attorneys General.
Opponents contend
Critics may argue that while a federal standard is desirable, this bill's framework might not offer sufficiently robust consumer protections compared to some existing state laws, particularly due to the lack of a private right of action. Some may also contend that the broad 'permissible purposes' for data processing without consent could undermine individual privacy, and that the preemption clause could prevent states from enacting stronger privacy safeguards in the future.
The bill is moderately complex due to its detailed definitions and legalistic language, requiring careful reading to understand its full implications. The estimated reading time is appropriate for an informed reader.
Section 3
Collection and Processing of Personal Data
This section outlines when covered entities can collect or process personal data. Generally, it requires individual consent, which can be implicit for general data but must be 'express affirmative consent' for sensitive personal data or disclosure to third parties for non-permissible purposes. It also lists specific 'permissible purposes' for which data can be collected or processed without consent, such as providing a service, complying with laws, preventing fraud, or for internal operational analytics.
Supporters argue
Proponents argue this provision strikes a balance between consumer privacy and business needs by establishing clear consent requirements while allowing data processing for essential operational and service delivery purposes. They highlight the stronger 'express affirmative consent' for sensitive data as a key protection.
Critics contend
Opponents may argue that the scope of 'permissible purposes' is too broad, potentially allowing significant data collection and processing without explicit consumer awareness or control. They might also contend that 'implicit consent' for non-sensitive data is insufficient to truly protect consumer privacy.
Tradeoffs
This section balances the desire for strong consumer consent with the practical realities of data-driven business operations. The tension lies in defining what constitutes 'reasonably necessary' for permissible purposes and the distinction between implicit and express consent.
Section 4
Right to Know and Privacy Policies
This section mandates that covered entities make publicly available a clear, prominent, and easy-to-understand privacy policy. This policy must detail the types of data collected, purposes for processing, data retention periods, disclosure practices to third parties, and how individuals can exercise their rights. It also requires direct notification to individuals of 'material changes' to privacy policies, especially concerning sensitive personal data.
Section 5
Individual Control Over Personal Data
This section grants individuals several key rights: the right to access their personal data (including a copy and categories of third-party disclosures), the right to request correction of inaccurate data, and the right to erasure (deletion or de-identification) of data not processed for permissible purposes. These rights must be provided at no additional cost (for the first two requests in a 12-month period) and through reasonably accessible means. Small businesses are exempt from the access and correction rights.
Section 6
Data Security Program Requirements
This section mandates that all covered entities and service providers develop, document, implement, and maintain a comprehensive data security program. This program must include reasonable administrative, technical, and physical safeguards tailored to the entity's size, complexity, resources, and the sensitivity of the data. It requires risk assessments, employee training, and procedures for ensuring third-party and service provider data security.
Section 9
Enforcement by FTC and State Attorneys General; No Private Right of Action
This section designates violations of the Act as unfair or deceptive acts or practices under the Federal Trade Commission Act, granting the FTC broad enforcement powers, including civil penalties of up to $42,530 per individual affected, with considerations for harm, intent, and business size. State Attorneys General are also empowered to bring civil actions on behalf of their residents. Crucially, the bill explicitly states there is no private right of action, meaning individuals cannot directly sue companies for violations.
Section 10
Federal Preemption of State Privacy Laws
This section explicitly states Congress's intent to establish a uniform federal privacy framework that preempts and occupies the field with respect to state or local laws concerning the privacy or security of personal data. It supersedes state laws to the extent they relate to data privacy or security, but includes specific carve-outs preserving certain state laws, such as those related to data breach notification, criminal/civil procedure, fraud, public safety, student privacy (FERPA), financial information (GLBA), health information (HIPAA), employment data, and anti-discrimination laws.
The definition of 'personal data' explicitly includes persistent identifiers like customer numbers in cookies, static IP addresses, processor/device serial numbers, or other unique device identifiers, if they can be used to identify an individual over time and across services/platforms.
Section 2(9)(B)(ii)
Why it matters:This is standard legislative practice for defining scope, but its specific inclusion of persistent identifiers has broad implications for online tracking and advertising practices.
Case for: Supporters argue that explicitly including persistent identifiers ensures that common online tracking methods are covered by the Act, preventing companies from circumventing privacy protections by using indirect identifiers.
Case against: Some in the advertising or data analytics industries might argue that this broad inclusion could overly restrict legitimate business practices that rely on these identifiers for analytics, personalization, and fraud prevention, even when direct identification is not the primary goal.
Estimated impact: Significantly expands the scope of data subject to the Act's protections, impacting virtually all online businesses that engage in user tracking or analytics.
Defines 'small business' with specific thresholds: not more than 500 employees, less than $50 million in average gross receipts, and collects/processes personal data of fewer than 1 million individuals OR sensitive personal data of fewer than 100,000 individuals annually.
Section 2(16)
Why it matters:This is standard legislative practice for defining scope and applicability, but the specific thresholds determine which businesses qualify for exemptions later in the bill.
Case for: Proponents argue that these thresholds appropriately exempt smaller businesses from some of the more burdensome compliance requirements, recognizing their limited resources and lower data processing volumes, thereby preventing undue economic hardship.
Case against: Critics might argue that even small businesses can handle significant amounts of sensitive data or cause substantial harm, and that these exemptions could create loopholes in consumer protection. They might also contend that the thresholds are arbitrary.
Estimated impact: Provides significant relief from certain compliance obligations for a large number of small businesses, potentially impacting their competitive standing and operational costs.
Lists specific categories of state and local laws that are *not* preempted by this Act, including data breach notification laws, criminal/civil procedure rules, fraud/public safety laws, student privacy (FERPA), financial information (GLBA), health information (HIPAA), employment data, and anti-discrimination laws.
Section 10(b)(2)
Why it matters:This is standard legislative drafting to define the precise boundaries of preemption, but the specifics are critical for understanding the interplay between federal and state law.
Case for: Proponents argue that these carve-outs ensure that important existing state protections and regulatory frameworks in specific sectors (like health and finance) remain intact, preventing disruption and maintaining specialized safeguards where they are already effective.
Case against: Critics might argue that while necessary, the existence of these carve-outs still leaves a fragmented regulatory landscape in certain areas, potentially undermining the goal of a truly uniform federal standard. Others might argue the carve-outs are too narrow, leaving other important state laws vulnerable.
Estimated impact: Preserves the validity of numerous state laws in critical areas, preventing a complete overhaul of existing regulatory structures and maintaining specific protections.