HR 7445, the Evergreen Community Safety Act of 2026, requires large electronic communication service providers (with 1 million+ users) to disclose customer communications or records to law enforcement within 72 hours of a court order. Courts may extend this deadline in 7-day increments for complex or voluminous data requests. The bill also shortens the deadline for providers to challenge disclosure orders to 48 hours and allows individuals harmed by non-compliance to sue for damages and injunctive relief. This directly affects major tech companies and internet service providers meeting the user threshold, streamlining but tightening data disclosure processes for law enforcement.
The DRIVER Act requires car manufacturers and fleet owners to give vehicle owners free, real-time access to their vehicle's data (like location, driving habits, and sensor information) through standard ports or wireless connections. Owners can control how this data is used or shared with third parties (except for foreign adversaries), delete stored data, and cannot be charged for access or decryption. Manufacturers and fleet owners must provide clear opt-out options before selling owner data and are banned from selling data to specific countries like China, Russia, or Iran. The Federal Trade Commission enforces these rules under existing laws, and states cannot create conflicting laws.
HR 1770, the Consumer Safety Technology Act, requires federal agencies to study and pilot new technologies to improve consumer safety. Title I mandates the Consumer Product Safety Commission to run a one-year AI pilot program to track product injuries, identify hazards, monitor recalls, and check imports, then report findings to Congress. Title II directs the Commerce Secretary to study how blockchain technology can prevent fraud in consumer transactions, including public input and a 6-month report to Congress. Title III requires the Federal Trade Commission to report on its enforcement actions against deceptive practices involving digital tokens and recommend improvements to protect consumers. The bill affects the Consumer Product Safety Commission, Commerce Department, and FTC, focusing on research and reporting rather than immediate regulatory changes.
This bill blocks federal contractors from using DeepSeek or similar AI tools developed by High Flyer (or its affiliates) for government work, with limited security waivers allowed for national defense or research. It requires a detailed report within one year on national security risks from AI platforms based in or linked to "countries of concern" (as defined in existing law). The report must analyze data privacy threats, including how U.S. user data stored in these platforms could be accessed by foreign governments, used for propaganda, or exploited for economic espionage. The law aims to protect U.S. data security and prevent foreign adversaries from leveraging AI systems for strategic advantage.
HR 2403, the TELL Act, requires companies operating websites or mobile apps that store U.S. user data in China to clearly disclose two specific facts to users: (1) that their data is stored in China, and (2) whether the Chinese Communist Party or Chinese state-owned entities have access to it. It prohibits companies from knowingly providing false information about these points. Violations would be enforced as unfair or deceptive practices under the Federal Trade Commission Act, with the FTC handling enforcement and penalties. The law directly affects U.S. technology companies that collect user data and store it in China.
The NO FAKES Act of 2025 establishes legal rights for individuals to control how their voice and visual likeness is used in AI-generated digital replicas. It defines "digital replicas" as highly realistic computer-generated representations that are readily identifiable as an individual's voice or appearance, granting individuals (and their heirs) the right to authorize or prohibit such uses. The law creates liability for unauthorized use of digital replicas or distribution of products designed to create them without authorization, while providing safe harbors for online services that follow specific procedures for handling claims. It preempts state laws regarding voice and visual likeness rights in digital replicas (with limited exceptions) and establishes a 10-year post-mortem right that can be renewed for additional 5-year periods if there's active public use.
The My Body, My Data Act of 2025 requires companies and services handling personal reproductive or sexual health information - such as health apps, clinics, or digital platforms - to only collect, retain, or share this data when strictly necessary for a service a person has requested. It gives individuals the right to access, correct, or delete their data easily (within 15 days, without fees), and mandates clear privacy policies explaining how data is used. The bill also prohibits companies from retaliating against people who exercise these rights, such as by charging higher prices or denying services. Enforcement will be handled by the Federal Trade Commission, with individuals able to sue for violations and seek penalties of up to $1,000 per violation per day.
This bill prohibits data brokers from selling, reselling, licensing, trading, or otherwise sharing military servicemembers' personal information (such as names, addresses, or service details) with foreign adversaries or entities controlled by them. It requires data brokers to include contractual safeguards in agreements to prevent recipients from further sharing this information with covered nations. The Federal Trade Commission and state attorneys general can enforce these rules through civil actions to stop violations and seek remedies for affected servicemembers. The bill also mandates a congressional report within one year to assess enforcement and potential expansions of the protections.
This bill amends the Children's Online Privacy Protection Act (COPPA) to extend protections to teens aged 12-17 in addition to children under 13. It requires operators of websites, online services, applications, and mobile apps to obtain verifiable consent from parents for children's personal information and from teens themselves for teens' personal information. The bill prohibits operators from using children's or teens' personal information for individual-specific advertising without consent, mandates clear privacy notices, and requires data deletion upon request. It also establishes new reporting requirements for the Federal Trade Commission regarding high-impact social media companies that affect children or teens.
The One Fair Price Act of 2025 prohibits businesses from charging different prices for the same product or service based on surveillance data (such as tracking online behavior or personal information). It specifically bans price discrimination using this data, while allowing price differences for legitimate reasons like cost-based pricing, broad group discounts (e.g., for teachers or veterans), or loyalty programs with clear disclosure. The Federal Trade Commission enforces the law, and states or individuals can sue for violations, seeking damages or injunctions. The bill also requires a joint study on its impact on small businesses within one year of enactment.
