H.R. 8014 — Online Privacy Act of 2026

This section requires a covered entity to provide individuals a reasonable mechanism to access (1) categories of their personal information and contents of communications maintained by the entity, including— for information not collected directly from the individual— how and from whom it was obtained; (2) third parties, subsidiaries, and corporate affiliates to which the entity has disclosed or from which it has obtained such information on or after the effective date of the Act; (3) business or commercial purposes for collecting, processing, maintaining, and disclosing the information to third parties; and (4) automated decision-making processes subject to human review under section 105, with concise descriptions of each process's implications and intended effects. Provides an exception deeming a covered entity compliant if it publicly posts the information (e.g., in a privacy policy) with easy, free access instructions. Excludes small businesses from the purposes disclosure requirement.

This section establishes a right of correction, requiring covered entities to provide a reasonable mechanism for individuals to dispute the accuracy or completeness of personal information linked to them if such information is processed (by the entity, a third party, or a service provider) in a manner that may increase reasonably foreseeable significant privacy harms. Upon receiving a dispute, a covered entity must either (1) correct or complete the information and notify the individual or (2) notify the individual that the information is accurate or complete, the entity lacks sufficient information to act, or the request is denied under an exemption in section 109(g). This section does not apply to small businesses.

This section requires covered entities to provide a reasonable mechanism for individuals to request deletion of their personal information and contents of communications maintained by the entity—including information acquired from third parties or inferred from other data—and, upon such request, to either delete the information and notify the individual or notify the individual of denial based on an exemption or exception in section 109(g).

This section establishes a right of portability, requiring covered entities offering products or services in Director-designated portable categories to enable individuals to download their personal information (provided to the entity and accessible under section 101, optionally by category) and the contents of their communications in a structured, commonly used, machine-readable format, and to transmit such data via a publicly documented real-time application programming interface (API) or similar mechanism of internal quality (with a fully functional public test version) to another covered entity at the individual's request. The Director must annually establish product/service categories by similarity, designate as portable those with over 10 million users (or estimated users) that either have a Herfindahl-Hirschman Index of 2,000 or greater, are offered by three or fewer covered entities, or would otherwise benefit from increased competition, and publish the list in the Federal Register after public comment on a draft. Covered entities must grant API access to requesting covered entities that self-certify (via Director-established procedures) as compliant with the Act (including for non-exempt small businesses), able to receive data under section 204, and using the API only at an individual's request; access may be denied based on a reasonable belief of non-compliance, subject to Director review and penalties for unreasonable denials. This section excludes small businesses.

This section requires a covered entity, for any decision based solely on automated processing of an individual's personal information that materially increases reasonably foreseeable significant privacy harms to such individual, to (1) inform the individual of the personal information used or that may be used for the decision; (2) make available a reasonable mechanism for the individual to request human review of the decision, either upon request or in a publicly accessible location; and (3) if requested, conduct the review within a reasonable amount of time.

This section prohibits a covered entity from collecting, processing, maintaining, or disclosing an individual's personal information without affirmative express consent to create, improve, maintain, process, or link the individual to an algorithm, model, or other means for behavioral personalization (i.e., tailoring a product or service based on behavioral data). It requires a covered entity to obtain express affirmative consent before providing a behaviorally personalized product or service—and annually thereafter—with the entity required to provide a non-personalized version if consent is denied, subject to exceptions: (1) if a substantially similar non-personalized version is infeasible, the entity must provide the greatest feasible core aspect without personalization; or (2) if a core aspect cannot function substantially similarly without personalization, the entity may deny the product or service. It permits processing of personal information for behavioral personalization algorithms using aggregated, representative data if the output is uniform across users and independent of any specific individual's characteristics, provided it increases usability (i.e., excluding optimizations primarily aimed at increasing engagement time unless benefiting the individual). This section excludes small businesses from these requirements.

This section requires a covered entity that collects personal information—including contact information—from an individual with whom it has no existing relationship to notify that individual within 30 days after receipt of the information, in writing if possible and at no charge, that it has collected the individual's personal information.

This section prohibits a covered entity from maintaining personal information longer than expressly consented to by the individual (Right to Impermanence). It requires express affirmative consent prior to maintaining such information for any duration, with options including at least (1) no longer than needed to complete the specific request or transaction (including a reasonable estimate); (2) until consent is revoked; and (3) one or more additional durations based on reasonable expectations and norms for the category of information. It excepts cases where long-term maintenance is obvious and a core feature of the requested product or service, and the information is maintained only to provide that product or service.

This section authorizes the Director to establish, by rule subject to notice and comment, procedural requirements and narrowly tailored exceptions governing the exercise of rights under this title, limited to (1) identity verification and authentication procedures; (2) standardized formats and reasonable mechanisms for submitting and fulfilling requests; (3) reasonable limits to prevent fraud, abuse, or excessive and duplicative requests; (4) timelines and recordkeeping requirements consistent with this title; and (5) narrowly tailored exceptions necessary to prevent a legitimate risk to the privacy, security, or safety of another individual or to protect free expression, consistent with section 110(b). The section prohibits the Director from creating any new substantive right or broadly waiving compliance with this title.

This section establishes exemptions from the title's requirements for personal information collected, processed, maintained, or disclosed for specified purposes (e.g., detecting security incidents or threats, protecting against fraud or illegal activity, complying with subpoenas or court orders, employer-employee records, and preventing service abuses), provided the covered entity limits such activities to those purposes, implements technical safeguards and business processes, and discloses the exemption and unavailable rights in its privacy policy. It further (1) permits covered entities to deny individual requests if they cannot verify identity (with limits on requiring additional information), if granting the request risks others' privacy or safety or free expression, or if the information is needed to complete a pre-existing transaction or contract; (2) exempts service providers and personal information secured by privacy-preserving computing (except for requirements under sections 101, 105, and 106); (3) requires compliance with or denial of requests without undue delay but no later than 30 days; (4) prohibits fees for requests except reasonable charges for unfounded or excessive ones (with 7-day notice to and potential rejection by the Digital Privacy Agency); and (5) provides rules of construction prohibiting requirements to create new personal information records or retain data otherwise not maintained.

This section establishes data minimization requirements for covered entities in collecting, processing, maintaining, and disclosing personal information. It requires a reasonable, articulated basis for such activities that balances business needs, the minimum information necessary for the service, privacy intrusions, potential harms, and individuals' reasonable expectations (subsection (a)). It prohibits covered entities from (1) collecting more personal information than reasonably needed for a requested product or service; (2) processing personal information for any purpose other than the original collection purpose (or, for service providers, directions from the covered entity); (3) maintaining personal information once no longer needed for that purpose; or (4) disclosing personal information for any other purpose (subsection (b)). Notwithstanding those limits, it permits ancillary collection, processing, maintenance, or disclosure if (1) no notice or consent is required when the activity involves substantially similar information and purposes without additional privacy harms; (2) notice is required when there may be additional (but not significant) harms with a substantially similar purpose, when the purpose is not substantially similar but without additional harms, or when there may be additional (but not significant) harms with a not substantially similar purpose if using privacy-preserving computing; or (3) notice and consent are required for all other scenarios (subsection (c)). It further requires substitution of personal information with artificial, de-identified, or random personal information when feasible without substantially reducing data utility or requiring unreasonable effort (subsection (d)).

This section requires covered entities to restrict employee and contractor access to personal information and contents of communications based on an articulated balance between potential privacy harms, individuals' reasonable expectations, and reasonable business needs. It further requires covered entities (except small businesses) to maintain records of each instance of such access where disclosure, a data breach, or data-sharing abuse could foreseeably increase privacy harms, including (1) a unique identifier for the accessor, (2) date and time of access, (3) fields accessed, and (4) affected individuals.

This section prohibits covered entities from intentionally disclosing personal information without obtaining the individual's consent for each category of third party recipient and providing notice of such categories, the information to be disclosed, and the business or commercial purpose. For sales of personal information, it requires additionally identifying the specific third-party buyer (with an exception for individual-directed disclosures of services procurable via reasonable withdrawal mechanisms) and including the original purpose of collection. It exempts from consent requirements non-sale disclosures using privacy-preserving computing or de-identified information limited to the narrowest scope with contracts prohibiting re-identification or combination processing that enables it. The section further prohibits disclosures for advertising or marketing of unique identifiers or linkable personal information, allowing truncated IP addresses (to first 24 bits for IPv4 or 48 for IPv6), geolocation to two decimal degrees precision, general device/browser/OS descriptions, or disclosure-unique identifiers.

This section prohibits a covered entity from intentionally disclosing personal information to any entity that (1) is not subject to U.S. jurisdiction or (2) is not in compliance with the Act, subject to specified exceptions and safe harbors. It excepts disclosures of identifiers created primarily for sending or receiving electronic communications where the sole purpose is to send or receive such a communication at the individual's request. It establishes two safe harbors for disclosures to a receiving covered entity not subject to U.S. jurisdiction: (1) where the recipient has an agreement with the Digital Privacy Agency (DPA), the disclosing entity reasonably believes the recipient is solvent and compliant via contract, and the contract prohibits non-contractual uses of the data; or (2) where the disclosing entity has a comprehensive contract with the recipient requiring compliance, indemnification, audit rights, assistance with orders, and other terms; has actual knowledge of the recipient's compliance and solvency; maintains an auditing program; files contract details with the DPA for approval; and agrees with the DPA to handle orders related to the recipient. For safe harbor (2), the disclosing entity is jointly liable for the recipient's violations of the Act regarding the disclosed data (severally liable if it first notifies the DPA of the violation), and each day of failing to report a known violation by the recipient counts as a separate violation. It directs the DPA, upon request, to enter agreements with foreign covered entities whose principal place of business is in a country allowing domestication of U.S. court decisions for fines and injunctive relief, requiring compliance, U.S. court jurisdiction and venue, responses to orders, payment of enforcement attorney fees, and automatic termination for defaults. It specifies that nothing in the section requires data localization.

This section prohibits a covered entity from using personal information—collected from an individual, acquired from a third party, or from publicly available sources—to re-identify an individual from de-identified information, except as required under title I. It further requires a covered entity disclosing de-identified information to a third party to prohibit that third party from re-identifying an individual using such information. The prohibition does not apply to qualified research entities, as determined by the Director, conducting non-commercial research.

This section prohibits covered entities from collecting, processing, maintaining, or disclosing the contents of any communication—regardless of whether involving individuals, other persons, or electronic devices—except for seven specified purposes: (1) transmitting, displaying, or maintaining the communication for the intended recipient or original sender; (2) detecting, responding to, or preventing security incidents or threats; (3) providing services to assist in drafting or creating communication content; (4) processing expressly requested by the sender or intended recipient, if terminable via reasonable mechanism; (5) disclosures required by law; (6) filtering communications whose primary purpose is commercial advertisement or promotion of the covered entity's products or services; or (7) detecting or enforcing terms-of-service violations resulting in temporary or permanent bans. This section further clarifies that a covered entity is not an intended recipient of a communication if at least one intended recipient is a natural person other than the entity's employee or contractor, another person, or if the service maintains content at the sender's direction for more than a transitory period. It defines the sender as the person directing disclosure of the communication on their behalf (with natural persons deemed senders of entire content regardless of original authorship, and other senders limited to their original or received content). The section exempts publicly available communications made accessible by the sender without access restrictions beyond general service authorization; prohibits covered entities from preventing user encryption that renders content unintelligible to the entity or requiring disclosure/circumvention of such encryption; and provides a safe harbor from liability for service providers acting at a covered entity's direction with reasonable belief of compliance.

This section prohibits covered entities from processing personal information or communications contents in a manner that discriminates against or makes unavailable opportunities based on protected class status in (1) economic areas such as employment, finance, health care, credit, insurance, housing, or education; and (2) public accommodations. The section further directs the Director to issue, not later than six months after enactment, requirements establishing a disparate impact standard that identifies additional harms, prohibits such actions, and provides enforcement mechanisms; and to promulgate, not later than one year after enactment, regulations implementing the section, including definitions of terms such as "discriminates against" and "otherwise makes opportunities unavailable."

This section establishes requirements for notice and consent processes and privacy policies used by covered entities under the Act. Specifically, it directs the Director to set minimum thresholds for individual understanding of such notices, consents, and policies—varied by types and scale of reasonably foreseeable privacy harms and accounting for individual expectations, potential harms, and awareness—and requires covered entities to provide a reasonable mechanism for individuals to revoke consent. It further creates a safe harbor under which (1) the Director approves covered entities' testing data demonstrating threshold compliance; (2) approved notices, consents, or policies receive a rebuttable presumption of compliance (by clear and convincing evidence); (3) the Director publicly posts approved processes, policies, and testing data online; (4) small businesses may adopt and freely use approved processes from similarly operating covered entities to gain the presumption (with an exemption from objective testing if no suitable approved process exists, though conciseness and clarity are still required; inapplicable to privacy policies); and (5) minor changes to approved processes or policies retain the presumption without retesting.

This section prohibits covered entities from intentionally using dark patterns (i.e., actions that substantially impair, obscure, or subvert) in providing notice, obtaining consent, or maintaining a privacy policy as required by this title, specifically with respect to an individual's ability to (1) understand the notice or policy contents; (2) understand the consent process; (3) decide whether to grant or withdraw consent; or (4) act on such a decision.

This section requires a covered entity to provide an individual with clear, concise notice of personal information the entity collects, processes, maintains, or discloses, using a process meeting standards set by the Director under section 208(a). The section generally prohibits a covered entity from collecting, processing, or maintaining personal information that creates or increases foreseeable privacy harms without the individual's express consent obtained through a similar process, with two exceptions: (1) implied consent is permitted if the activity is obviously necessary to provide a requested service and limited to that purpose (notice still required); and (2) no express consent is required for personal information secured by privacy-preserving computing, except for purposes of section 106 (notice still required). The section exempts service providers that reasonably believe the covered entity they assist complies with these requirements.

This section requires a covered entity to maintain and publicly disclose, in clear plain language from a prominent location, a privacy policy detailing its practices for collecting, processing, maintaining, and disclosing personal information—including (1) categories of personal information collected or obtained and business purposes for its use; (2) categories and lists of third parties to which it discloses or from which it obtains such information; (3) the basis for such activities under section 201(a); and (4) how individuals may exercise rights under title I. The policy is exempt from describing personal information used exclusively for purposes under section 109(a)(1); subsections (b)(7) and (d) do not apply to small businesses; and the section does not apply to service providers that reasonably believe their covered entity client complies.

This section requires covered entities to establish and implement reasonable information security policies, practices, and procedures to protect personal information they collect, process, maintain, or disclose, taking into account (1) the nature, scope, and complexity of their activities; (2) the sensitivity of the information; (3) the state of the art in administrative, technical, and physical safeguards; and (4) implementation costs. Those policies must include (1) a publicly available written security policy (except for compromising details); (2) a process to identify and assess vulnerabilities through regular monitoring; (3) a process to mitigate identified vulnerabilities; (4) a process to dispose of unneeded personal information; (5) oversight of persons with access to such information; (6) employee training and supervision; and (7) a written response plan for data breaches or data-sharing abuses. This section directs the Director, in consultation with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST), to promulgate implementing regulations and, further in consultation with CISA, NIST, the Small Business Administration, the Minority Business Development Agency, and small businesses, to develop compliance assistance materials (e.g., policy templates, toolkits, and configuration guidelines) for small businesses.

This section establishes notification requirements for covered entities regarding data breaches or data-sharing abuses involving personal information, unless unlikely to create or increase foreseeable privacy harms. It requires (1) notification to the Director without undue delay and, if feasible, within 72 hours of awareness (with reasons stated for any delay beyond 72 hours); (2) notification within 72 hours to any other covered entity from which the personal information was obtained, with chain notifications to upstream covered entities; and (3) notification within 14 days to individuals with whom the covered entity has a relationship whose personal information was involved or potentially involved, if such incident creates or increases foreseeable privacy harms, using the individual's routine interaction medium plus one additional feasible medium. This section does not apply if a person uses personal information obtained from a data breach or data-sharing abuse not involving the covered entity.

This section establishes an independent executive branch agency known as the Digital Privacy Agency to implement and enforce this Act. The section establishes the position of Director as the agency head, appointed by the President with Senate confirmation to a six-year term (with service until a successor is qualified), compensated at Level II of the Executive Schedule, and qualified by expertise in privacy, information security, technology, civil rights, and civil liberties; establishes a Deputy Director appointed by the Director; exempts the Director position from the Federal Vacancies Reform Act of 1998 and designates the Deputy Director (or designated senior officers) to serve in an acting capacity upon vacancy; prohibits the Director and Deputy Director from holding any office, position, or employment in a covered entity; and directs the Director to establish a principal office and field offices in locations with high covered-entity activity. The section amends 5 U.S.C. 5313 to add the Director of the Digital Privacy Agency to the list of positions compensated at Level II of the Executive Schedule.

This section establishes the powers and authorities of the Digital Privacy Agency, including for its Director to (1) set general policies and rules for agency business; (2) enter contracts; (3) establish divisions or offices; (4) oversee administrative, enforcement, and research activities; (5) adopt a seal; (6) obligate and expend funds; (7) appoint and supervise personnel; (8) distribute business among personnel and units; (9) implement the Act through rules, orders, guidance, interpretations, statements of policy, investigations, and enforcement actions; and (10) perform other authorized functions. The section further (1) prohibits the Director from delegating the power to appoint the Deputy Director; (2) ensures agency autonomy by barring requirements for pre-submission approval of legislative recommendations or testimony to Congress (provided such submissions disclaim presidential views); (3) authorizes issuance of regulations after notice and comment rulemaking under 5 U.S.C. § 553; (4) permits consultations with federal agencies, state officials, international bodies, foreign agencies, experts, and agency advisory boards; and (5) directs courts to defer to the agency's reasonable interpretations of the Act in judicial review.

This section requires the Director of the Digital Privacy Agency to submit reports every six months—beginning not later than six months after enactment—to the President and the Committees on Energy and Commerce, the Judiciary, and Appropriations of the House of Representatives and the Committees on Commerce, Science, and Transportation, the Judiciary, and Appropriations of the Senate, and to publish the reports on the agency's website. The reports must include (1) a discussion of significant privacy or security problems faced by individuals with respect to personal information; (2) a justification of the agency's budget request for the preceding year, unless previously provided; (3) a list of significant rules, orders, and other initiatives during the preceding six months, plus plans for the next six months; (4) an analysis of complaints received and collected in the database described in section 307(a) during the preceding six months; (5) a list with brief statements of issues for public enforcement actions to which the agency was a party during the preceding six months; and (6) an assessment of significant actions by state attorneys general or state privacy regulators relating to this Act or rules under it during the preceding six months. This section also requires the Director to order an annual independent audit of the agency's operations and budget.

This section requires coordination between the Digital Privacy Agency (DPA) and other federal agencies authorized to enforce federal privacy laws with respect to covered entities and service providers, including written referrals to the DPA to initiate enforcement proceedings. It transfers from the Federal Trade Commission (FTC) to the DPA, effective on the date of enactment, (1) all rulemaking, guideline-issuance, study, and reporting authorities under federal privacy laws previously vested in the FTC; (2) enforcement authority over FTC rules under federal privacy laws or the FTC Act (15 U.S.C. 41 et seq.) related to unfair or deceptive acts or practices involving privacy, information security, identity theft, data abuses, or related matters; and (3) all FTC employees in divisions, bureaus, offices, or subdivisions primarily responsible for administering, investigating, or enforcing such laws or FTC Act provisions, with substantially equivalent compensation and benefits. It preserves all other federal agencies' authorities under federal privacy laws or other laws, except as specified in this section.

This section establishes personnel authorities for the Digital Privacy Agency (DPA), authorizing the Director to appoint and direct employees—including privacy experts, technologists, computer scientists, user experience designers and researchers, data scientists, ethicists, attorneys, investigators, economists, civil rights experts, and others—without regard to competitive service appointment requirements under title 5, U.S. Code, provided recruitment and selection are fair, transparent, and equitable; to fix pay and benefits without regard to General Schedule classification (chapter 51) or pay rates (subchapter III of chapter 53) under title 5; and to apply labor-management relations under chapter 71 of title 5. The section further (1) designates a DPA chief information officer responsible for ensuring technology efficiency in implementing the agency's authorities; (2) establishes a DPA inspector general; (3) requires the Director to appoint an ombud to serve as a liaison for affected persons and ensure complaint safeguards and confidentiality; and (4) authorizes acceptance of federal detailees for up to three years on a nonreimbursable basis.

This section establishes an Office of Civil Rights within the Digital Privacy Agency. The office is responsible for (1) providing oversight and enforcement of this Act, related rules and orders, and federal privacy laws to ensure fair, equitable, and non-discriminatory collection, processing, maintenance, and disclosure of personal information, including through implementation of section 207; (2) developing and promoting practices to further equal opportunity and expand access in employment (including hiring, firing, promotion, demotion, and compensation), credit and insurance (including application denials or less favorable terms), housing, education, professional certification, and health care; (3) coordinating the agency's civil rights efforts with other federal agencies and state regulators; (4) working with civil rights advocates, privacy experts, and advisory board members to promote compliance; (5) liaising with impacted communities and consumers; (6) providing annual reports to Congress on the agency's civil rights efforts; and (7) such additional duties as the Director determines appropriate.

This section establishes a unit within the Digital Privacy Agency to create or utilize a toll-free telephone number, website, and database for the centralized collection, monitoring, and response to individuals' complaints regarding the privacy or security of personal information. The unit must coordinate with other federal agencies to route complaints appropriately; route complaints to qualified state agencies (including privacy regulators), which must demonstrate functional capacity, meet participation conditions, and adhere to federal data protection standards; and share complaint data with federal and state agencies (including attorneys general) and receive reciprocal data sharing from other federal agencies, all subject to federal standards for confidentiality, security, and integrity. The section further requires the agency to request consent from complainants to publish anonymized complaints in a public database on its website and to redact information as needed to protect privacy.

This section directs the Director of the Digital Privacy Agency to establish four advisory boards to advise on the agency's functions under the Act and provide information on emerging practices relating to the treatment of personal information by covered entities: (1) the User Advisory Board, composed of experts in consumer protection, privacy, civil rights, and ethics; (2) the Research Advisory Board, composed of individuals with academic and research expertise in privacy, cybersecurity, computer science, innovation, design, ethics, economics, law, and public policy; (3) the Startup Advisory Board, composed of representatives of small businesses and investors in small businesses; and (4) the Product Advisory Board, composed of technologists, computer scientists, designers, product managers, attorneys, and other representatives of covered entities. The Director must appoint members without regard to party affiliation; each board must meet at least twice per calendar year at the Director's call; and non-federal full-time employee members are entitled to compensation at a Director-fixed rate while attending meetings (including travel time) and travel expenses per 5 U.S.C. ch. 57 subch. I.

This section authorizes the Digital Privacy Agency (DPA) to conduct investigations and administrative discovery as follows: (1) joint investigations with other federal agencies, state attorneys general, or state privacy regulators; (2) subpoenas for witness testimony and relevant documents or materials in connection with hearings, enforceable by district courts (with contempt penalties for noncompliance); and (3) civil investigative demands, prior to instituting proceedings, for production of documentary material or tangible things, written reports or answers to questions, or oral testimony (with detailed requirements for description, return dates, service methods, and enforcement jurisdiction, including by the U.S. District Court for the District of Columbia for persons outside U.S. court jurisdiction).

This section authorizes the Digital Privacy Agency to conduct hearings and adjudicatory proceedings to enforce compliance with the Act, generally in accordance with the Administrative Procedure Act (5 U.S.C. ch. 5, subch. II). It establishes special rules for cease-and-desist proceedings, including (1) issuance of a notice of charges with a hearing 30-60 days after service; (2) issuance of a cease-and-desist order upon consent or finding of violation, effective 30 days after service (or 180 days for consent orders); (3) a decision with findings within 90 days after notice; and (4) exclusive judicial review by petition to a U.S. court of appeals within 30 days after service, with the agency filing the record as provided in 28 U.S.C. §2112, review under 5 U.S.C. ch. 7, and no automatic stay. This section further authorizes temporary cease-and-desist orders when a violation likely causes insolvency or prejudice to individuals' interests before completion of standard proceedings.

This section establishes litigation authority for the Digital Privacy Agency (DPA), authorizing it to commence civil actions in U.S. district or state court against violators of the Act or its rules or orders, seeking civil penalties or equitable relief (e.g., injunctions), subject to a three-year statute of limitations from discovery of the violation. The section further (1) permits DPA to compromise actions with court approval; (2) requires DPA to notify the Attorney General (AG) of actions and to consult on coordination, including negotiating an agreement within 180 days of enactment to avoid conflicts with federal criminal prosecutions; and (3) allows DPA to represent itself before the Supreme Court if the AG concurs with a timely request or fails to act within 60 days.

This section authorizes a state attorney general or state privacy regulator to bring a civil action in state or federal court, as parens patriae on behalf of state residents, against any person violating the Act or related rules or orders. Such actions may (1) enjoin further violations, (2) compel compliance, or (3) obtain relief under section 406. Before filing, the state official must notify the Digital Privacy Agency, which may intervene and appeal; if the agency files first, no state action may proceed against the same defendant for the same violation alleged in the agency's complaint.

This section establishes private rights of action for violations of the Act. Specifically, it (1) authorizes an aggrieved person to bring a civil action for declaratory or injunctive relief in any court of competent jurisdiction; (2) authorizes such a person to bring a civil action for damages in any court of competent jurisdiction, except via class actions under Federal Rule of Civil Procedure 23 or similar procedures; (3) permits an individual to appoint a qualified 501(c)(3) nonprofit organization (i.e., one with public-interest statutory objectives in protecting individual privacy and information security rights) to file complaints and exercise Act rights on the individual's behalf, including representing a class of aggrieved individuals, with prevailing nonprofits receiving reasonable expenses including attorneys' fees and individuals receiving an equal share of total damages; and (4) allows a state to designate such nonprofits or similar entities to independently file complaints with the Digital Privacy Agency if individual rights under the Act are infringed.

This section authorizes the Digital Privacy Agency (DPA), state attorneys general, or state privacy regulators in civil actions or adjudication proceedings for violations of this Act to seek legal or equitable relief, including (1) rescission or reformation of contracts, (2) refunds or restitution, (3) disgorgement, (4) damages or other monetary relief, (5) public notification, (6) limits on a violator's activities, and (7) civil money penalties as provided in subsection (c); prohibits exemplary or punitive damages; and allows recovery of prosecution costs if the DPA or state enforcer prevails. It further establishes civil money penalties of up to the maximum amount under FTC Act section 5(m)(1)(A) (15 U.S.C. 45(m)(1)(A)), as adjusted for inflation, multiplied by the number of affected individuals per violation (with each day of a continuing violation treated separately), considering mitigating factors such as the violator's resources and good faith, violation gravity and history, privacy harms (actual or potential) and disparate impacts on protected classes, and other equitable matters; grants authority to compromise, modify, or remit penalties; and requires notice and a hearing prior to assessment.

This section requires the Digital Privacy Agency to transmit to the Attorney General any evidence it obtains indicating that any person, domestic or foreign, may have violated federal criminal law, authorizing the Attorney General to institute criminal proceedings under applicable law. Nothing in this section affects the agency's other authorities to disclose information.

This section establishes a whistleblower enforcement mechanism for violations of the Act by covered entities. Any person aware of such a violation based on nonpublic information may request the Director to commence a civil action for penalties by submitting a written statement of grounds and making the information available upon request. (1) If the Director files suit within 90 days of receiving the request, no other action may proceed unless the Director's action is dismissed without prejudice; (2) if the Director does not file within 90 days, the requester may file a civil action; (3) the limitations period for the requester's action is tolled from the Director's receipt of the request until the Director's action is dismissed without prejudice or 150 days later, whichever is later. This section further specifies allocation of civil penalties from a judgment or settlement: (1) 15% to the requester if the Director brings the action; or (2) 25-50% (as determined reasonable by the court) to the requester if they bring the action.

This section establishes the effective date of the Act as one year after the date of enactment. It authorizes the Digital Privacy Agency to promulgate regulations and take other actions expressly required by the Act prior to that date.

This section provides that nothing in this Act modifies, limits, or supersedes the operation of specified federal privacy or security provisions, including those in (1) the Privacy Act of 1974; (2) the Right to Financial Privacy Act of 1978; (3) the Fair Credit Reporting Act; (4) title V of the Gramm-Leach-Bliley Act; (17) the Bank Secrecy Act (12 U.S.C. 1829b et al.); and approximately 25 others (e.g., Fair Debt Collection Practices Act, Family Educational Rights and Privacy Act, Stored Communications Act).

This section preserves state and local privacy and consumer protection laws from preemption by this Act except to the extent of any inconsistency, with state laws deemed not inconsistent if they afford greater consumer protections than this Act.

This section provides a severability clause, stating that if any provision of the Act or its amendments is held unconstitutional or otherwise invalid, the remainder of the Act and its amendments remain in effect.

This section directs the Director of the National Institute of Standards and Technology (NIST), in carrying out activities under subsection (c)(19) and in consultation with the Director of the Digital Privacy Agency, to (1) develop and periodically update, in collaboration with federal agencies, industry, state/local/Tribal governments, civil society, nonprofits, and the Information Security and Privacy Advisory Board, a privacy risk management framework covering data processing risks that identifies voluntary consensus-based technical standards, guidelines, best practices, methodologies, procedures, and processes for developing privacy-enhanced information systems and networks (including emerging technologies) and assessing/mitigating privacy risks; establishes common definitions and characterizations of privacy risk management; provides case studies and risk profiles; offers guidance for organizations to meet privacy requirements of federal/state/local/Tribal governments and international policymakers; incorporates voluntary consensus-based standards and best practices; facilitates regulator and market use to reduce trade barriers; and avoids prescribing specific information or communications technology products or services; (2) conduct research on mitigating privacy risks in information systems and networks to inform framework updates; (3) support development of guidance and risk profiles, in consultation with the Federal Trade Commission and sector-specific risk management agencies, to help organizations use the framework for adopting privacy requirements; (4) support activities improving privacy-preserving computing, de-identification techniques and processes, and other technologies enhancing predictability, manageability, disassociability, and confidentiality; (5) support development of voluntary consensus-based technical standards for privacy-enhanced systems and networks, including international standards, through open, transparent, consensus-based processes; and (6) conduct other activities as necessary to help public- and private-sector organizations mitigate privacy risks in information systems and networks.

This section directs the Director of the National Institute of Standards and Technology (NIST), in consultation with the Director of the Digital Privacy Agency and others, to carry out privacy-related education and public awareness activities, including (1) disseminating privacy-related technical standards and best practices identified by NIST; (2) making such standards and practices usable by individuals, small- to medium-sized businesses, educational institutions, and State, local, and Tribal governments; and (3) increasing awareness of privacy risks, individual privacy rights, and responsibilities; and (4) supporting development of technical standards and best practices to describe privacy-related tasks, knowledge, skills, competencies, and work roles to guide career development, education, training, and credentialing in industry, academia, nonprofit organizations, and the federal government. In carrying out these activities, NIST must leverage, to the extent practicable, the national cybersecurity awareness and education program (i.e., program coordinating dissemination of cybersecurity standards, public awareness, and workforce development). This section further requires NIST to brief the Senate Committee on Commerce, Science, and Transportation and the House Committee on Science, Space, and Technology biennially, beginning one year after enactment, on these activities; and authorizes $3 million for each of FY2026 through FY2030.

This section directs the Director of the National Science Foundation (NSF), in consultation with the Director of the Digital Privacy Agency, to make competitive awards to institutions of higher education or nonprofit organizations (or consortia thereof) for multidisciplinary and transdisciplinary socio-technical research to design, prototype, and translate to practice privacy-preserving technologies and to increase understanding of their human, social, behavioral, and economic dimensions, including research on: (1) public understanding, expectations, and perspectives on privacy; (2) consumer privacy rights, including rights to access, correction, deletion, data portability, individual autonomy, impermanence, and to be informed; (3) privacy governance and transparency, including notice and consent processes and the efficacy of privacy policies; (4) empowering consumers for data ownership and control; (5) privacy by design; (6) privacy-preserving automated decision-making systems and human review of such systems; (7) ensuring privacy in consumer surveillance systems; (8) user interfaces, including design elements that deliberately obscure, mislead, coerce, or deceive consumers; (9) privacy implications of emerging technologies; and (10) incentives to implement privacy protections.