Federal agencies face new limits on collecting and sharing your personal data
S. 1208 — Privacy Act Modernization Act of 2025 · Filed by Ron Wyden (D-OR) · 3 cosponsors · Introduced Mar 31, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill updates the Privacy Act of 1974 to expand protections for individuals' personal data held by federal agencies. It broadens the definition of 'records' to cover all personally identifiable information (not just citizens/permanent residents), expands 'matching programs' to include any data-sharing between systems, extends privacy rules to contractor-operated systems, and adds new restrictions on how agencies can collect, use, and disclose personal information—requiring that collection be 'appropriate and reasonably necessary' rather than merely authorized by statute.
Why we flagged it
The bill's core mechanism is to expand the Privacy Act's scope and strengthen restrictions on federal agencies' data collection, use, and disclosure practices. It is a regulatory tightening, not a deregulation or carve-out.
What the text implies
- Expanding 'matching programs' to include 'any data from 1 or more systems' (not just 'two or more automated systems') may significantly increase the number of data-sharing activities that trigger Privacy Act notice and consent requirements, potentially slowing routine inter-agency data operations.
- The new definition of 'personally identifiable information' includes 'a device that identifies, or is linked or reasonably linkable to, an individual'—this may extend Privacy Act protections to IP addresses, device IDs, and similar identifiers, broadening the scope of what counts as a 'record' under the Act.
The full analysis lists 4 implications of this text.
Who it affects
The bill restricts federal agencies' power to collect, use, and share personal data on individuals without clear justification, and expands privacy protections to cover more people and more types of data processing. Citizens gain stronger legal grounds to challenge improper data collection and use by government.