The You Own the Data Act affirms that users own their personal data and prohibits companies from requiring people to surrender or allow monetization of their data in order to access services. The bill applies to large technology companies and data brokers that collect personally identifiable information online, such as location data, browsing history, biometric information, and contact lists. Companies must allow users to access, correct, delete, and port their data within 90 days of request at no cost, and must delete browsing and biometric data within 60 days of collection. The legislation requires companies to limit data collection to what is necessary for providing requested services or preventing fraud, provide clear privacy notices under 1,000 words, and obtain written consent before collecting contact information from users' address books. Enforcement is handled by the Federal Trade Commission and state attorneys general, with individuals able to sue covered entities for violations and potentially recover $100 to $750 per violation plus attorney's fees.