Congress quietly extends cybersecurity law without reviewing privacy safeguards

What it does

This bill extends the sunset date of the Cybersecurity Act of 2015 by ten years, from 2025 to 2035. It keeps in place the existing framework for voluntary sharing of cybersecurity threat information between private companies and the federal government without changing the underlying rules or protections.

Why we flagged it

The bill is a straightforward procedural extension of an existing statute. It does not create new policy, alter the substantive framework, or introduce novel mechanisms — it simply postpones the expiration date of the Cybersecurity Act of 2015 by ten years.

What the text implies

• The extension occurs without a reauthorization hearing or substantive review of the 2015 Act's effectiveness, privacy safeguards, or liability protections — the bill assumes the existing framework remains fit for purpose through 2035.
• Companies participating in the voluntary information-sharing program face no new transparency or accountability requirements; the extension preserves existing liability shields and safe harbors without clarifying their scope or limits.
• The ten-year extension may reduce congressional oversight pressure to revisit cybersecurity information-sharing policy, potentially delaying reforms to address privacy concerns or mandate stronger data-protection standards.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The extension preserves a voluntary information-sharing regime that may help detect and respond to cyber threats affecting critical infrastructure and private networks — a potential public benefit. However, the bill does not address or clarify the liability protections, privacy safeguards, or transparency mechanisms embedded in the 2015 Act, leaving unresolved questions about whether companies' participation in threat-sharing is truly voluntary and whether shared data is adequately protected fro

Who stands to gain

• technology and cybersecurity companies (beneficiaries of liability protections under the 2015 Act)
• critical infrastructure operators (beneficiaries of threat-intelligence access)

Named in the bill

Cybersecurity Act of 2015, Section 111(a), Senate Committee on Homeland Security and Governmental Affairs, Department of Homeland Security (implied)

Where it stands

4 cosponsors: 2 Republicans, 1 Democrats, 1 Independents.

• Apr 8, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• Apr 8, 2025 — Referred to Senate Committee on Homeland Security and Governmental Affairs · Congress.gov: “Read twice and referred to the Committee on Homeland Security and Governmental Affairs”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

40 lobbying clients named this bill on 57 disclosure filings across 3 quarters, Dec 2025 to Jun 2026. Those filings disclosed $83,262,208 in lobbying spend. A filing names 26 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 99% of bills with at least one filing.

Gary Peters, the sponsor, reported $-186,100 in PAC receipts in the 2026 cycle. $-7,500 of that came from 2 PACs tied to these lobbying clients.

• Chamber of Commerce of the U.S.A. — $37,710,000 on 2 filings
• Business Roundtable Inc — $6,950,000 on 1 filing
• Ncta - the Internet & Television Association — $6,870,000 on 2 filings
• Edison Electric Institute — $4,248,610 on 2 filings
• Fedex Corporation — $2,930,000 on 1 filing

Lobbying Disclosure Act filings through Jul 23, 2026. A filing shows who paid to lobby on a bill it names, not what changed.