Congress outsources privacy rules to regulators—leaving citizens waiting for protection

What it does

This bill establishes a federal data privacy and security framework that requires companies to protect consumer personal data and gives the Federal Trade Commission (FTC) enforcement authority. It explicitly preserves existing privacy laws (HIPAA, FERPA, FCRA, etc.) and exempts FCC regulations from applying to data companies, while requiring the FTC to hire at least 440 new staff members and coordinate with foreign governments on data protection standards.

Why we flagged it

The bill creates enforcement authority and procedural requirements but delegates all substantive privacy rules to future FTC rulemaking. It is a governance structure, not a privacy standard—the actual protections citizens receive depend on regulations not yet written.

• Section 10 exempts covered entities from FCC laws/regulations on data collection and security, except for 911/emergency lines. This is substantively unrelated to the bill's stated privacy-protection purpose and appears to carve out telecom companies from existing regulatory oversight.

What the text implies

• The bill's substantive privacy protections are entirely absent—no rules on data collection, use, retention, deletion, or consumer rights are specified. All standards will be written by FTC rulemaking, which may be weaker than what Congress could mandate directly.
• The FCC exemption (Section 10) may allow telecommunications companies to avoid FCC data-security oversight while still claiming compliance with this Act if they follow other sector-specific laws. This creates a potential regulatory gap for telecom data practices.

The full analysis lists 5 implications of this text.

Who stands to gain

technology and social media companies; telecommunications companies; data brokers