This bill requires the Department of Defense (DOD) to strengthen protections for personal data tied to operational security of military personnel and civilian employees. It prohibits storing such sensitive data on non-DOD servers or cloud services unless under specific contracts or with data subject permission, and mandates strict waiver conditions for exceptions. The DOD must review privacy guidance by June 2026, implement new security standards for system owners, and notify Congress within 30 days of policy changes, data storage violations, or security incidents involving this data. These requirements aim to prevent data breaches that could endanger personnel or national security. The bill applies directly to DOD data handling practices and personnel managing sensitive information.
HR 1734 establishes a task force of financial regulators (including Treasury, Fed, and Consumer Financial Protection Bureau officials) to study deep fake threats to banking security. The task force must issue a report within one year detailing current protections used by banks and credit unions, standard definitions for AI terms like "deep fakes," risks of identity theft via AI fraud, and best practices for prevention. The report will also include regulatory recommendations to protect consumers from data theft and fraud. This procedural bill requires a study but does not enact new laws or directly affect consumers or institutions until recommendations are considered.
This bill protects personal information for Members of Congress, their immediate family members living in their households, and congressional staff identified as security threats. It requires government agencies and data brokers to remove specific sensitive details - including home addresses, phone numbers, school locations, and precise location data - from public records upon request. Agencies must act within 72 hours to remove such information, while data brokers are prohibited from selling or sharing covered data without consent. Exceptions include news reporting on public concerns and information voluntarily shared by the individual.
This bill codifies the Federal Trade Commission's existing "negative option" rule into law, making it permanently binding as of July 7, 2025. It requires companies to get explicit customer consent before automatically renewing subscriptions or services, rather than assuming consent through inaction. The rule directly affects consumers who use recurring payment services (like streaming, software, or memberships) and the businesses that offer them. This change prevents companies from charging customers for continued service without clear, affirmative action from the user to renew.
HR 859 requires manufacturers to clearly state before purchase whether internet-connected consumer devices (like smart speakers or home monitors) contain a camera or microphone. It directly affects device manufacturers, excluding phones, laptops, and dedicated cameras (which consumers reasonably expect to have such features). The Federal Trade Commission enforces this as an unfair/deceptive practice under existing law, with guidance issued within 180 days of enactment. The law applies only to devices made after the FTC issues its guidance, not older models.
HR 2612, the DELETE Act, creates a system allowing individuals to request deletion of their personal data from data brokers through a single online portal. Data brokers must register annually with the FTC and implement a centralized deletion system, requiring them to delete personal information within 31 days of a request (with limited exceptions for legal requirements or research). The FTC enforces compliance through annual audits, mandatory reporting on deletion completion rates, and penalties for violations. This directly affects companies that collect personal information without a direct customer relationship and sell or share it with third parties.
This bill requires major websites and online services (excluding small businesses) to provide a simplified, accessible summary of their terms of service within 360 days. The summary must clearly explain what sensitive data they collect (e.g., health, location, financial info), user rights (like arbitration waivers), data breach history, and estimated reading time, and must be placed prominently on their sites. It also mandates a graphic diagram showing how user data is shared with third parties and an interactive format for full terms. Violations can be enforced by the FTC or state attorneys general acting on behalf of residents.
This bill bans online platforms from conducting market research on children under 13 and requires parental permission for such research on teens aged 13-17. It applies to social media and apps that let users create profiles, share content, and use features like auto-play or notifications to keep users engaged. Platforms must stop collecting data about minors' behavior without consent, with enforcement led by the Federal Trade Commission. States can also sue platforms that violate these rules.
This bill requires the Comptroller General to conduct a security audit of Social Security Administration systems accessed by the U.S. DOGE Service or affiliated entities, focusing on vulnerabilities and potential violations of privacy laws like the Privacy Act of 1974. The audit must identify security flaws in software used by these entities and assess compliance with federal data privacy rules. The Comptroller General must submit a report to Congress and the Social Security Commissioner within one year, detailing findings and recommendations. The Social Security Commissioner then has 90 days to fix identified issues and report back to Congress on progress. The bill directly affects Social Security Administration systems handling sensitive data, primarily impacting seniors whose information is processed through these systems.
This bill prohibits all federal agencies from using facial recognition technology to verify someone's identity, directly affecting government operations like border security or benefit applications. It defines facial recognition technology as systems that automatically identify individuals from digital images or video. The key provision bans this specific use across federal departments, though it doesn't restrict other government applications like law enforcement investigations. The law focuses solely on identity verification processes, leaving other uses of the technology unaffected.
