Congress moves to shield tech companies from wiretapping laws

What it does

This bill exempts companies engaged in digital commerce from federal and state wiretapping, eavesdropping, and privacy laws—including California's Invasion of Privacy Act—when they collect, process, or disclose customer information for commercial purposes. It also terminates any ongoing lawsuits or claims under these laws, even those already filed before the bill's enactment.

Why we flagged it

The bill's operative mechanism is a blanket immunity grant to companies collecting consumer data under the guise of 'digital commerce.' It does not regulate or clarify commerce law; it exempts commercial data collection from existing privacy and wiretapping statutes.

What the text implies

• Session replay, pixel tracking, and chatbot interactions—technologies that capture keystroke-level user behavior—are explicitly shielded from wiretapping law, which previously prohibited unauthorized interception of electronic communications.
• The immunity applies retroactively: lawsuits already filed before enactment are terminated and cannot proceed, eliminating remedies for conduct that occurred under the old legal regime.
• The definition of 'commercial purpose' is expansive and includes 'any commercial or business purpose as defined under law or regulation of a State'—creating a moving target that allows states to define the scope of immunity after enactment.
• The bill does not require consent, notice, or opt-out; companies need not disclose they are collecting communications data or give users a choice to refuse.
• Immunity applies to 'contractors to a business,' extending liability shields to third-party data brokers, analytics firms, and ad-tech vendors who process consumer data on behalf of merchants.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Ordinary people lose established privacy protections and the right to sue for unauthorized interception of their digital communications. Companies gain blanket immunity to collect, process, and disclose customer data—including through session replay, pixels, and tracking—without legal consequence, even for conduct that would have violated federal wiretapping law or state privacy statutes.

Who stands to gain

• digital advertising and ad-tech companies
• data brokers and analytics firms
• e-commerce platforms and online retailers
• session-replay and user-behavior tracking vendors
• marketing and customer-data service providers

Named in the bill

Federal wiretapping law (18 U.S.C. Chapter 119), California Invasion of Privacy Act (Cal. Penal Code § 630 et seq.), State privacy laws (general), digital commerce platforms, data brokers, ad-tech vendors

Where it stands

• Sep 3, 2026 — Introduced · Congress.gov: “Introduced in House”
• Sep 3, 2026 — Referred to House Committee on the Judiciary · Congress.gov: “Referred to the House Committee on the Judiciary”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.