AI AGENT Act of 2026
- Sponsor
- Sen. Warner, Mark R. [D-VA]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Jul 21, 2026
Bottom line
The AI AGENT Act aims to enhance competition and user control over personal data on large online platforms by enabling third-party agents to act on a user's behalf, potentially disrupting current platform dominance and fostering an interoperable digital ecosystem.
What it actually does
This bill establishes a right for users of large online platforms to designate 'custodial user agents' to manage their online interactions, electronic commerce decisions, user-generated content, and account settings. It mandates large online platform providers to maintain transparent, third-party-accessible interfaces for these agents on fair, reasonable, and nondiscriminatory terms. The bill also sets strict duties for custodial user agents regarding user data privacy, security, and acting in the user's best interest, while tasking the Federal Trade Commission (FTC) with regulation, registration, and enforcement.
Proponents argue
Supporters argue this bill empowers consumers by giving them greater control over their data and online interactions, reducing 'switching costs' between platforms, and fostering innovation by allowing new services to manage user data across platforms. They contend it promotes competition by breaking down data silos maintained by large online platforms, enabling a more open and interoperable internet ecosystem that benefits users and smaller businesses.
Opponents contend
Opponents may argue that mandating interoperability and third-party access could introduce significant security and privacy risks, as custodial user agents might become new vectors for data breaches or misuse. They might also raise concerns about the technical feasibility and cost of implementing these interfaces, potentially stifling innovation for platforms and leading to a fragmented or less secure user experience.
The bill is moderately complex due to its technical definitions and regulatory framework, requiring careful reading to grasp its full implications, which might exceed the time typically allotted for quick legislative reviews.
Section 3(a)
Individual's Right of Delegation
This provision grants every end user of a large online platform the right to authorize one or more 'custodial user agents' to manage their online interactions, e-commerce decisions, user-generated content, and account settings. These agents must operate transparently, within defined scopes, and with revocable authorization, acting on the user's behalf on the same terms as the user would directly.
Supporters argue
Supporters argue this provision is fundamental to user empowerment, giving individuals true ownership and control over their digital lives and data, rather than being locked into specific platforms. It fosters a competitive market for services that can optimize user experiences.
Critics contend
Opponents may contend that this broad right of delegation could introduce significant security vulnerabilities if not managed perfectly, as it creates many new access points to sensitive user data. They might also argue it complicates platform operations and user support.
Tradeoffs
This provision balances user autonomy and control against potential security risks and the operational complexities for platforms. It aims to shift power to users but requires robust safeguards for data protection.
Section 3(b)
General Duty of Large Online Platform Providers
This section mandates that large online platform providers must create and maintain transparent, third-party-accessible interfaces. These interfaces are specifically for users to delegate custodial user agents to manage their online activities, content, and settings, ensuring agents can interact with the platform on the same terms as a direct user.
Section 3(d) and 3(g)
Custodial User Agent Registration and Duties
Custodial user agent providers must register with the FTC, potentially through self-attestation or recognized certification bodies. Agents are bound by strict duties, including safeguarding user data, acting solely in the user's best interest, avoiding harm, and not using user data for advertising, behavioral profiling, sale, or any other secondary commercial purpose. They must also maintain records of actions and obtain explicit consent for any sub-delegation of authority.
Section 3(h)
Non-Discrimination for Agent Access
Large online platform providers must facilitate and maintain interfaces accessible to custodial user agents on fair, reasonable, and nondiscriminatory terms. This includes allowing reasonable thresholds and fees proportional to cost, complexity, and risk, with public notice of changes. Crucially, if a platform maintains interoperability for its own affiliated services, it must offer a functionally equivalent version of that interface to competing custodial user agents.
Section 4(a) and 4(f)
FTC Rulemaking and Enforcement Authority
The Federal Trade Commission (FTC), in coordination with other financial and security agencies, is mandated to promulgate regulations to implement the Act within one year. Violations of the Act or its regulations will be treated as unfair or deceptive acts or practices under the Federal Trade Commission Act. The FTC is granted broad enforcement powers, including the ability to levy fines, with each individual user affected by a violation counting as a separate violation.
Section 4(c)
NIST Technical Standards Development
The Director of the National Institute of Standards and Technology (NIST) is required, within 180 days of enactment, to identify existing open protocols or develop and publish model technical standards. These standards are intended to make popular online services, including messaging, social media, e-commerce, personal finance, and AI, more accessible to custodial user agents, covering aspects like verifiable delegation and real-time revocation.
For large online platforms that are social media services, the definition of 'user data' explicitly includes 'social graph data.' This data encompasses a person's connections and interactions, content generated, responses to others' content (excluding third-party content), public profile, and associated metadata, along with relational references to maintain these associations.
Section 2(13)(C)
Why it matters:This is standard legislative practice for defining terms that are foundational to the bill's scope. However, its specific inclusion here is highly consequential for social media platforms.
Case for: Supporters argue that including social graph data is essential for truly enabling user data portability and reducing switching costs on social media. Without it, users cannot effectively move their network and interactions to a new service, limiting competition.
Case against: Opponents (social media platforms) may argue that social graph data is proprietary, difficult to disentangle from third-party content, and its mandated portability could raise significant privacy concerns for other users in the graph, or lead to data scraping that harms their business model.
Estimated impact: This provision has a high impact on the business models and competitive landscape of social media services, potentially enabling new social platforms or services built around portable user networks.
This subsection explicitly states that the duties established for custodial user agents (e.g., safeguarding data, acting in user's best interest, no secondary commercial use) 'may not be waived, limited, or modified by contract, by terms of service, or by any form of user consent.' It also clarifies that a user's reasonable expectations are determined without regard to any inconsistent terms of service.
Section 3(g)(3)
Why it matters:While it's a standard legal drafting technique to include non-waiver clauses, its placement here is substantively important as it prevents companies from using fine print to circumvent the core protections for users.
Case for: Supporters argue this is essential to prevent powerful entities from coercing users into waiving their rights or from burying unfavorable terms in lengthy agreements. It ensures that the core protections for users are absolute and cannot be undermined by contractual loopholes.
Case against: Some businesses might argue that such a broad non-waiver clause limits contractual freedom and could make it difficult to innovate or offer specialized services that require different data handling agreements, even with explicit user consent.
Estimated impact: This provision has a high impact on the legal enforceability of user protections, significantly strengthening the position of users and the FTC against custodial user agents and potentially large online platforms.
When assessing fines for a violation of this Act, the Commission (FTC) 'shall consider each individual user affected by a violation of this Act as an individual violation.'
Section 4(f)(2)(D)
Why it matters:This is a common legislative technique to specify the severity of penalties. Its placement is standard but its impact is profound, making it a 'buried treasure' due to its potential financial implications.
Case for: Supporters argue this provision ensures that fines are proportional to the harm caused, especially by large platforms affecting millions of users. It acts as a powerful deterrent against widespread violations, making non-compliance prohibitively expensive.
Case against: Opponents (large platforms) would argue that this method of calculating fines could lead to astronomically high penalties that are disproportionate to the actual harm, potentially bankrupting companies for technical violations or minor infractions. They might advocate for caps on total fines.
Estimated impact: This provision has the potential to impose multi-billion dollar fines on large online platforms for widespread violations, significantly increasing the financial risk of non-compliance.