The Consumer Data Privacy and Security Act of 2026 establishes a comprehensive federal framework requiring companies to obtain explicit consent before collecting personal data, provide clear privacy notices, implement robust security safeguards, and respect consumers' rights to access, correct, and delete their information. The law applies to businesses, nonprofits, and telecommunications companies that collect or process personal data, with stricter requirements for large entities handling data on 20 million or more individuals or sensitive data on 1 million or more individuals. Companies must designate privacy officers, conduct privacy impact assessments before making material changes to sensitive data processing, and use binding contracts to ensure service providers meet the same privacy and security standards. The legislation creates a uniform national privacy standard that preempts most state privacy laws while preserving existing protections for student records, health information, financial data, and employment information, and takes effect one year after enactment with the exception of sensitive data protections, which apply immediately.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.