Sponsor
Jerry Moran
Senator · R-KS
Senator · R-KS
Official title: Protect the privacy of consumers.
Introduced March 25, 2026 by Jerry Moran · Last progress March 25, 2026
The bill creates a comprehensive, uniform federal privacy regime that greatly strengthens individual control, sensitive‑data protections, and enforcement capacity, but does so at the cost of higher compliance and taxpayer expenses, reduced state flexibility, limited private suits, and potential frictions for research, small businesses, and some services.
Nearly all Americans: a single federal privacy framework creates consistent baseline rights (access, deletion, consent, notice) and simplifies what individuals can expect across states.
Individuals with sensitive data (health, biometrics, precise location, financial): stronger legal limits on collection, re-identification, and reuse of sensitive information, plus required deletion/de‑identification when data is no longer needed.
Businesses and consumers: clearer national rules and federal coordination (FTC, Commerce engagement, GAO reviews) reduce cross‑state legal uncertainty and help prevent interruptions to cross‑border data transfers.
Residents of states with stronger laws: federal preemption prevents states from keeping or adopting stronger privacy protections, potentially weakening rights for people in those states.
Small businesses and many firms: wide-ranging new compliance obligations (consent systems, contracts, de‑identification, security programs, privacy officers, reporting) will raise administrative and technical costs, which are likely to be passed to consumers or strain small firms.
Individuals and local advocates: the Act removes a private right of action and centralizes enforcement with the FTC (and constrains state suits while FTC cases are pending), limiting direct legal recourse for harmed consumers and concentrating litigation in federal fora.
Based on analysis of 13 sections of legislative text.
Creates a single federal privacy law with consent rules, individual rights, data-security requirements, service‑provider controls, FTC enforcement, and immediate federal preemption of most state privacy laws.
Creates a comprehensive, uniform federal privacy and data-security framework that preempts most state privacy laws for covered entities, sets consent, notice, individual-rights, data-security, service‑provider, and accountability requirements, and makes the Federal Trade Commission (FTC) the primary enforcer. The bill mandates staffing and resources for enforcement, reporting and interagency/international coordination, civil penalties for knowledge-based violations, and deadlines for implementation (general effect in one year; the preemption provision effective immediately).