Sponsor
Michael Cloud
Representative · R-TX
Representative · R-TX
The bill substantially strengthens individual privacy, ownership, and control over personal data (including special protections for minors) at the cost of higher compliance and litigation burdens for businesses and potential reductions in ad‑supported or personalized services and some operational/security uses.
All users (broadly: middle-class families, students, tech workers and other consumers) gain clear ownership and stronger control over the personal data they create — including rights to access, correct, delete/de‑identify, and port that data.
Limits on third‑party collection, retention, tracking, and monetization reduce unwanted profiling and targeted tracking by large operators and data brokers.
Users get greater transparency and accountability about who has received their data (including third parties and service providers).
Covered businesses’ compliance costs and limits on monetizing data are likely to lead to higher consumer prices or reduced free/ad‑supported services and personalization.
Implementing access, deletion, portability, notice/icon requirements and coordinating state/federal enforcement will create substantial compliance and regulatory complexity for covered entities (including small businesses) and for government agencies.
A private right of action with statutory damages and broad property‑style rights over data increases litigation exposure, creating legal risk and potential court costs for covered entities.
Based on analysis of 3 sections of legislative text.
Establishes users as owners of their personal data and creates rights to access, correct, delete, and port data while limiting collection, retention, sharing, tracking, and monetization by covered entities and data brokers.
Official title: To affirm user ownership of their data, prohibit entities from requiring the transfer or monetization of private data in exchange for services, prohibit the collection of third-party contact information without written consent, and for other purposes.
Introduced May 4, 2026 by Michael Cloud · Last progress May 4, 2026
Makes users the legal owners of the personal data they create and gives individuals broad control over that data. It bars covered companies from requesting contact lists without written consent from both the user and contacts, requires data access, correction, deletion/de-identification, and portability rights, and limits collection, retention, sharing, tracking, and monetization of personal information with specific timing, consent, and youth protections. Imposes operational duties on covered entities and commercial data operators: fast, free responses to verified user requests (no later than 90 days), automatic deletion time limits for sensitive categories (e.g., browsing history, biometrics), machine-readable portability without licensing limits, and conspicuous opt-outs and transparency about third-party recipients. The bill emphasizes privacy-by-default and parity of service regardless of privacy choices.