Congress gives you the right to own, access, and delete your data.

What it does

This bill establishes data ownership rights for individuals and restricts how companies can collect, use, and sell personal data. It prohibits companies from requiring users to surrender data as a condition of service, mandates that users can access and delete their data within 90 days, bans collection of contact information without written consent, requires opt-out mechanisms for tracking, and imposes a 60-day deletion requirement for browsing history and biometric data. The FTC and state attorneys general can enforce violations, and individuals can sue companies with over $50 million in revenue for $100–$750 per violation.

Why we flagged it

The bill's core mechanism is establishing and enforcing individual ownership and control of personal data, with restrictions on corporate collection, retention, and monetization. This is fundamentally a privacy and consumer protection measure, not a deregulation or carve-out.

What the text implies

• The 60-day deletion requirement for browsing history and biometric data may force companies to redesign data retention infrastructure, potentially increasing compliance costs that could be passed to consumers or reduce service quality.
• The $50 million revenue threshold for private right of action creates a two-tier system: large platforms face individual lawsuits, while smaller competitors may face only FTC enforcement, potentially shifting competitive advantage.
• The 'reasonably necessary' standard for data collection and retention is fact-dependent and may generate extensive litigation over what constitutes legitimate business purposes, creating uncertainty for compliance.
• Requirement that companies provide same services to users who opt out of tracking may conflict with ad-supported business models, potentially forcing companies to introduce paid tiers or reduce free service quality.
• The bill does not explicitly address data already collected and retained before enactment, creating ambiguity about retroactive application and potential grandfather periods.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Ordinary citizens gain enforceable rights to control, access, and delete their personal data; prohibitions on forced data surrender and mandatory tracking protect privacy and prevent exploitative data monetization. The private right of action with statutory damages ($100–$750 per violation) gives individuals direct recourse against large platforms.

Who stands to gain

• privacy-focused technology companies
• data deletion/privacy compliance software vendors
• consumer advocacy organizations
• plaintiff's bar (class action and individual litigation)

Named in the bill

Federal Trade Commission (FTC), State attorneys general, Commercial data operators, Data brokers, Large online operators, Covered entities, Gramm-Leach-Bliley Act (referenced)

Where it stands

• May 4, 2026 — Introduced · Congress.gov: “Introduced in House”
• May 4, 2026 — Referred to House Committee on Energy and Commerce · Congress.gov: “Referred to the House Committee on Energy and Commerce”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

1 lobbying clients named this bill on 1 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $540,000 in lobbying spend. A filing names 139 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 0% of bills with at least one filing.

Michael Cloud, the sponsor, reported $219,270 in PAC receipts in the 2026 cycle.

• National Association of Mutual Insurance Companies — $540,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.