The You Own the Data Act (YODA) establishes new federal rules requiring major online platforms and data brokers to give users greater control over their personal information. Covered entities, defined as large websites with over 100 million users or data brokers generating significant revenue from user data, must obtain written consent before sharing contact lists and allow users to access, correct, delete, or export their data within 90 days. The bill also mandates that these companies stop tracking cookies without permission, limit data retention to 60 days for browsing and biometric data, and provide clear privacy notices in under 1,000 words. Enforcement is handled by the Federal Trade Commission and state attorneys general, while individuals can sue companies for violations and receive damages of up to $750 per incident.
The CHATBOT Act establishes new federal rules requiring companies that provide open-ended artificial intelligence chatbots to implement strict privacy protections and parental controls for users under the age of 18. Under this legislation, platforms must create "family accounts" for children under 13 and obtain verifiable parental consent before allowing teens to create their own accounts, while also mandating the deletion of personal data if these requirements are not met. The bill further requires that default settings on these accounts prioritize child safety by limiting screen time, disabling financial transactions, and preventing the chatbot from generating unsolicited outputs. Companies are prohibited from using the personal data of children and teens for targeted advertising, and the Federal Trade Commission is authorized to enforce these provisions as unfair or deceptive practices. Additionally, the Act mandates a study by the National Science Foundation on the social impacts of AI chatbots on young people and requires a report from the Government Accountability Office to evaluate the law's effectiveness.
This bill establishes a new Office of Urban Agriculture and Innovative Production within the Department of Agriculture to support farming methods like hydroponics and controlled-environment agriculture. It creates a competitive grant program that provides funding to nonprofits, local governments, Tribal organizations, and schools to help urban farmers navigate regulations, access land, and improve food availability in underserved areas. Additionally, the legislation updates federal data collection requirements to include modern farming technologies and allocates specific funding amounts to support these initiatives from 2026 through 2030.
The PROTECT Act requires the Department of Homeland Security to share safety and data protection guidelines with government agencies and private organizations within a year of passing. These guidelines focus on how to securely handle personal information for law enforcement officers and employees, as well as steps they can take to stay safe. The law defines personal information broadly to include any data that can identify an individual, regardless of their citizenship status. This initiative aims to improve security practices across federal, state, local, and private sectors without changing existing legal requirements for data handling.
This bill requires federal crime control grants to include a certification that applicants have not improperly shared personal details about individuals involved in firearm transactions or background checks. It directly affects public agencies, private organizations, and local governments receiving funding from the Department of Justice, mandating they confirm they have protected sensitive data from accidental or intentional leaks. The law specifically defines "personally identifiable information" to include names, social security numbers, and biometric records to clarify what must be safeguarded. By adding these certification requirements to existing grant programs, the legislation aims to enforce stricter data privacy standards for those handling firearm-related records.
The Public Safety UAS Readiness Act establishes a grant program to help fire departments, law enforcement agencies, and emergency medical services train their personnel on operating drones for public safety missions. Funded by up to $10 million annually from 2026 to 2029, these grants can be used to develop training curriculums, purchase compliant drones, and cover administrative costs related to the programs. Recipients must submit detailed plans outlining their safety protocols, risk management strategies, and data privacy measures, with a priority given to agencies in high-risk areas or underserved regions that currently lack drone training capacity. To ensure quality, the act requires that training materials be maintained by recognized nonprofit organizations and mandates annual reporting on the number of trained personnel and drone deployments to Congress.
The Postal Data Privacy Act of 2026 restricts the use of mail covers by requiring governmental entities to obtain a court order before accessing postal records for criminal investigations. To qualify for such an order, authorities must provide specific facts demonstrating that the requested data is relevant and material to an ongoing case, while state laws prohibiting mail covers would override federal requirements. Additionally, the bill mandates that postal officials preserve relevant records for up to 180 days while a court order is being sought or renewed. These provisions directly affect federal and state law enforcement agencies as well as the United States Postal Inspection Service by establishing new procedural safeguards for accessing mail data.
The Subpoena Abuse Prevention Act restricts how federal government agencies can use administrative subpoenas to obtain phone and app records from service providers. It requires agencies to identify a specific individual by name or account details before requesting data and explicitly bans using these subpoenas to investigate or retaliate against constitutionally protected activities like free speech or religious exercise. The law also mandates that agencies certify the subpoena's legitimate purpose and allows service providers to notify customers about the request unless a court orders otherwise. Finally, the bill requires federal agencies to publicly report annually on the number of subpoenas issued and the total accounts affected.
This bill requires the Department of Defense to review and eventually ban contracts with retailers that use payment processing systems from specific countries deemed a national security risk, such as China, Russia, Iran, and North Korea. Effective January 1, 2027, the Defense Department will be prohibited from entering into agreements for payment equipment or services if those tools rely on technology developed, owned, or controlled by entities in these nations. The law defines covered systems broadly to include hardware, software, and firmware linked to these countries, aiming to prevent potential foreign access to sensitive military financial data. Retailers wishing to continue working with the Department of Defense must replace their payment processing infrastructure with systems that do not involve these restricted technologies.
This joint resolution seeks to formally disapprove a rule from the Bureau of Consumer Financial Protection that would have removed an earlier regulation about data security. The bill directly affects financial institutions by aiming to keep in place the 2022 requirement for stronger protection of sensitive consumer information. If passed, the rule attempting to withdraw the data security standards would have no legal effect, meaning the original data protection rules would remain active.
