H.R. 8652

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 8652 Introduced in House (IH)]

<DOC>

119th CONGRESS
2d Session
H. R. 8652

To affirm user ownership of their data, prohibit entities from 
requiring the transfer or monetization of private data in exchange for 
services, prohibit the collection of third-party contact information 
without written consent, and for other purposes.

_______________________________________________________________________

IN THE HOUSE OF REPRESENTATIVES

May 4, 2026

Mr. Cloud introduced the following bill; which was referred to the 
Committee on Energy and Commerce

_______________________________________________________________________

A BILL

To affirm user ownership of their data, prohibit entities from 
requiring the transfer or monetization of private data in exchange for 
services, prohibit the collection of third-party contact information 
without written consent, and for other purposes.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``You Own the Data Act'' or ``YODA''.

SEC. 2. FINDINGS.

Congress finds the following:
(1) Governments exist to protect individual rights to life, 
liberty, and property.
(2) The protection of civil liberties, including the rights 
to private property and privacy from unwarranted searches and 
seizures, is one of the hallmarks of a free society.
(3) It is appropriate for Congress to enact laws to protect 
individuals from data collection by third parties.
(4) Data is the property of the user, as the user creates 
the data.
(5) A user maintains ownership of the data of such user, 
even when such data is sold or leased with the consent of such 
user.
(6) Technology should empower the individual and the 
productivity of the individual.
(7) Individuals should have reasonable access to and use of 
popularly available consumer technologies without abdicating 
the rights of such individuals to privacy and anonymity.

SEC. 3. PROHIBITION ON SHARING USER CONTACTS WITHOUT WRITTEN CONSENT 
AND CLARIFYING USER ACCESS TO DATA.

(a) Prohibition on Access to User Contacts.--It shall be unlawful 
for a covered entity to ask a user to share the contacts or information 
about the contacts of the user unless the user and the contacts of the 
user consent to such use in writing.
(b) Access to, and Correction, Deletion, and Portability of, 
Covered Data.--
(1) In general.--Subject to paragraphs (2) and (3), a 
covered entity shall provide a user, immediately or as quickly 
as possible and in no case later than 90 days after receiving a 
verified request from the user, with the ability to 
reasonably--
(A) access--
(i) if applicable, a list of each third 
party and service provider to whom the covered 
entity has transferred or shared the covered 
data of the user;
(ii) the covered data of the user, or an 
accurate representation of the covered data of 
the user, including data aggregation that is a 
readable summary, that is held or has been 
processed by the covered entity or any service 
provider of the covered entity; and
(iii) if a covered entity transfers covered 
data, a description of the covered data that 
was transferred and the purpose for which the 
third party requested the data;
(B) request that the covered entity--
(i) correct material inaccuracies or 
materially incomplete information with respect 
to the covered data of the user that is 
maintained by the covered entity;
(ii) delete or de-identify covered data of 
the user that is or has been maintained by the 
covered entity;
(iii) notify any service provider or third 
party to which the covered entity transferred 
such covered data of the corrected information; 
and
(iv) provide contact information to the 
user of any service provider or third party 
that the covered data of the user was 
transferred to so that the user may make 
requests described in this subparagraph; and
(C) to the extent that is technically feasible, 
provide covered data of the user that is or has been 
generated and submitted to the covered entity by the 
user and maintained by the covered entity in a 
portable, structured, and machine-readable format that 
is not subject to licensing restrictions.
(2) Frequency and cost of access.--A covered entity shall--
(A) provide a user with the opportunity to exercise 
the rights described in paragraph (1) not less than 
twice in any 12-month period; and
(B) fulfill the responsibilities described in 
paragraph (1) free of charge.
(3) Prohibition on retaliation.--A covered entity shall 
provide the same quality of goods or services, at the same 
price or rate, regardless of whether a user took an action 
described under paragraph (1).
(4) Retention of data.--A covered entity that collects data 
on a user's browsing history or biometric data and information 
shall delete the data within 60 days after the date on which 
the data was collected.
(c) Data Minimization and Contextuality.--
(1) Collection and use of information.--A commercial data 
operator shall limit the collection and sharing of information 
by the operator with third parties to what is reasonably 
necessary to provide a service or conduct an activity that a 
consumer has requested or is reasonably necessary for fraud 
prevention.
(2) Retention of information.--A commercial data operator 
that collects the personal information of a consumer shall 
limit the use and retention of that information to what is 
reasonably necessary to provide a service or conduct an 
activity that a consumer has requested or a related operational 
purpose. Any data collected or retained by a commercial data 
operator solely for security or fraud prevention may not be 
used for operational purposes.
(3) Monetization.--Monetization of personal information 
shall not be considered reasonably necessary to provide a 
service or conduct an activity that a consumer has requested or 
reasonably necessary for security or fraud prevention.
(d) Consumer Choice and Control.--
(1) Commercial data operator.--A commercial data operator 
shall provide a prominently and conspicuously displayed icon a 
user may click to opt out of data collection on every unique 
website, mobile application, or computer application.
(2) Covered entities.--Within 2 years after the date of the 
enactment of this Act, a covered entity shall take reasonable 
steps, taking account of available technology, to provide users 
the ability to directly delete the covered data collected by 
the covered entity.
(e) Default Settings.--A covered entity may require, through terms 
of service or otherwise, that a user must consent to the transfer of 
covered data in order to use the service of the covered entity.
(f) Policies Regarding Data From Minors.--A covered entity may not 
collect, retain, or transfer the covered data of a user to a third 
party without affirmative consent from the parent or guardian of the 
user if the user is below the age of 18 years old, where technically 
feasible.
(g) Prohibition on Tracking Cookies Without User Consent.--A 
commercial data operator--
(1) unless authorized by the user, may not track cookies, 
including on mobile applications; and
(2) shall provide the same services to users who do not 
authorize tracking cookies.
(h) Transparency.--
(1) Privacy notice.--A covered entity shall provide users 
with a clear, comprehensible, accurate, and continuously 
available privacy notice that--
(A) describes in detail the information collected 
by the operator, how that information would be used, 
and whether the information would be sold or shared 
with any third party; and
(B) is 1,000 words or less.
(2) Report on use of information required.--If a user 
allows a commercial data operator to sell the covered data of 
the user, the commercial data operator shall provide the user 
with an annual report regarding the types of third parties with 
whom data has been shared. The report shall include a 
description of what information has been shared, for what 
purpose information is shared, and a list of each third party 
that receives data.
(i) Data Security and Breach Notification.--A covered entity shall 
notify each user in a timely manner of any data breach with respect to 
the information of the user and provide any remedy to compensate the 
user for the breach of their information, including a credit protection 
service, fraud alert, and credit monitoring through credit reporting 
agencies.
(j) Enforcement.--
(1) Enforcement by the federal trade commission.--
(A) Unfair or deceptive acts or practices.--A 
violation of this section shall be treated as a 
violation of a regulation under section 18(a)(1)(B) of 
the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices.
(B) Powers of commission.--The Commission shall 
enforce this section in the same manner, by the same 
means, and with the same jurisdiction, powers, and 
duties as though all applicable terms and provisions of 
the Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
were incorporated into and made a part of this Act. Any 
person who violates this section shall be subject to 
the penalties and entitled to the privileges and 
immunities provided in the Federal Trade Commission 
Act.
(2) Effect on other laws.--Nothing in this section shall be 
construed in any way to limit the authority of the Commission 
under any other provision of law or to limit the application of 
any Federal or State law.
(3) Enforcement by state attorneys general.--
(A) In general.--If the chief law enforcement 
officer of a State, or an official or agency designated 
by a State, has reason to believe that any person has 
violated or is violating this section, the attorney 
general, official, or agency of the State, in addition 
to any authority it may have to bring an action in 
State court under its consumer protection law, may 
bring a civil action in any appropriate United States 
district court or in any other court of competent 
jurisdiction, including a State court, to--
(i) enjoin further such violation by such 
person;
(ii) enforce compliance with this section;
(iii) obtain civil penalties; and
(iv) obtain damages, restitution, or other 
compensation on behalf of residents of the 
State.
(B) Notice and intervention by the federal trade 
commission.--The attorney general of a State shall 
provide prior written notice of any action under 
subparagraph (A) to the Commission and provide the 
Commission with a copy of the complaint in the action, 
except in any case in which such prior notice is not 
feasible, in which case the attorney general shall 
serve such notice immediately upon instituting such 
action. The Commission shall have the right--
(i) to intervene in the action;
(ii) upon so intervening, to be heard on 
all matters arising therein; and
(iii) to file petitions for appeal.
(C) Limitation on state action while federal action 
is pending.--If the Commission has instituted a civil 
action for violation of this section, no State attorney 
general, or official or agency of a State, may bring an 
action under this paragraph during the pendency of that 
action against any defendant named in the complaint of 
the Commission for any violation of this section 
alleged in the complaint.
(4) Private right of action.--
(A) In general.--Any individual alleging a 
violation of this section or a regulation promulgated 
under this section may bring a civil action in any 
Federal or State court of competent jurisdiction 
against a covered entity that has global annual gross 
revenues of at least $50,000,000.
(B) Relief.--In a civil action brought under 
subparagraph (A) in which the plaintiff prevails, the 
court may award--
(i) $100 to $750 per violation;
(ii) reasonable attorney's fees and 
litigation costs; and
(iii) any other relief, including equitable 
or declaratory relief, that the court 
determines appropriate.
(k) Definitions.--In this section:
(1) Commercial data operator.--The term ``commercial data 
operator'' means an entity acting in its capacity as a consumer 
online services provider or data broker that--
(A) generates a material amount of revenue from the 
use, collection, processing, sale, or sharing of data 
generated by a user; and
(B) has more than 100,000,000 unique monthly 
visitors or users in the United States for a majority 
of months during the previous 1-year period.
(2) Commission.--The term ``Commission'' means the Federal 
Trade Commission.
(3) Consent.--The term ``consent'' means an affirmative act 
by an individual that clearly communicates the informed 
authorization of the individual for an act or practice.
(4) Core function.--The term ``core function'' does not 
mean targeted advertising or marketing.
(5) Covered data.--The term ``covered data'' means 
individually, identifiable information about a user collected 
online, including any of the following:
(A) Location information that would identify the 
physical address of an individual.
(B) Telephone number.
(C) Email address.
(D) Social security number or other unique, 
government-issued identifiers.
(E) Nonpublic personal information (as defined in 
section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6809)).
(F) Content of a personal wire communication, oral 
communication, or electronic communication such as 
email or direct messaging with respect to any entity 
that is not the intended recipient of the 
communication.
(G) Call detail records.
(H) Web browsing history, application usage 
history, and the functional equivalent of either that 
is not aggregated data.
(I) Biometric data and information, such as facial 
and voice recognition data.
(6) Covered entity.--The term ``covered entity'' means a 
commercial data broker or large online operator that collects 
covered data from a user through an online platform.
(7) Data broker.--The term ``data broker'' means a covered 
entity whose principal source of revenue is derived from 
processing or transferring the covered data of individuals with 
whom the entity does not have a direct relationship on behalf 
of a third party for use by the third party.
(8) De-identify.--The term ``de-identify'' means to 
separate information from the user or IP address the 
information is associated with.
(9) Delete.--The term ``delete'' means to remove or destroy 
information so that the information is not maintained in human 
or machine-readable form and cannot be retrieved or used in 
such form in the normal course of business.
(10) Large online operator.--The term ``large online 
operator'' means any person that--
(A) provides an online service; and
(B) has more than 100,000,000 authenticated users 
of an online service in any 30-day period.
(11) Monetization.--The term ``monetization'' means the 
process of collecting, using, and storing data solely for 
economic benefit.
(12) User.--The term ``user'' means an individual residing 
in the United States who uses a website that collects data and 
information from the user.
<all>