Privacy bill funds research but skips actual consumer protections

What it does

This bill establishes a framework for online privacy protection by creating a Digital Privacy Agency and directing the National Institute of Standards and Technology (NIST) and National Science Foundation (NSF) to develop privacy standards, best practices, and research. It takes effect one year after enactment and explicitly preserves all existing federal and state privacy laws without superseding them. The bill funds privacy research and public education but does not appear to create new consumer rights or direct restrictions on data collection.

Why we flagged it

The bill's core function is to mandate NIST and NSF to develop privacy risk-management frameworks, technical standards, and research—not to regulate data collection or create consumer rights. It is a research-and-coordination bill, not a privacy-protection bill in the enforcement sense.

What the text implies

• The bill does not establish a Digital Privacy Agency—it references one as already existing, but no text creates it. This suggests either a prior bill or incomplete legislative text, creating ambiguity about enforcement authority.
• By explicitly preserving all existing federal and state privacy laws without modification, the bill avoids preempting state privacy regimes (CCPA, VMPPA, etc.), but also means it does not harmonize or strengthen baseline protections nationally.
• The research mandate on 'user interfaces, including design elements that deliberately obscure, mislead, coerce, or deceive consumers' may eventually inform regulation of dark patterns, but the bill itself does not ban or restrict such practices.
• Funding for NSF research on 'privacy implications of emerging technologies' and 'incentives to implement privacy protections' suggests the bill anticipates future tech risks but does not preemptively address them.

Who it affects

The bill funds valuable privacy research and education ($3M annually through 2030) and establishes a coordinating framework, which could eventually benefit consumers. However, the text provided does not establish new enforceable consumer rights, data-collection limits, or penalties—it is primarily a research and standard-setting mandate. Citizens may benefit indirectly if NIST/NSF standards are later adopted, but the immediate impact is institutional rather than protective.

Who stands to gain

• technology companies (indirect—standards may reduce compliance fragmentation)
• research institutions (direct—NSF awards)
• NIST (direct—research funding)

Named in the bill

Digital Privacy Agency, National Institute of Standards and Technology (NIST), National Science Foundation (NSF), Federal Trade Commission (FTC), House Committee on Science, Space, and Technology, Senate Committee on Commerce, Science, and Transportation

Where it stands

• Mar 19, 2026 — Introduced · Congress.gov: “Introduced in House”
• Mar 19, 2026 — Referred to House Committee on Science, Space, and Technology and House Committee on the Judiciary · Congress.gov: “Referred to the Committee on Energy and Commerce, and in addition to the Committees on the Judiciary, and…”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

1 lobbying clients named this bill on 1 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $50,000 in lobbying spend. A filing names 4 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 0% of bills with at least one filing.

Zoe Lofgren, the sponsor, reported $462,479 in PAC receipts in the 2026 cycle.

• Socure, Inc. — $50,000 on 1 filing

Lobbying Disclosure Act filings through Jul 17, 2026. A filing shows who paid to lobby on a bill it names, not what changed.