This bill directs the President, through the Department of Defense and the National Intelligence Director, to create strategies for identifying stolen sensitive data and classified information held by foreign entities. It specifically targets financial, medical, biometric data, intellectual property, and trade secrets belonging to U.S. persons. The legislation authorizes these officials to determine if destroying, manipulating, or recovering such stolen data serves U.S. economic and national security interests, and if so, permits them to attempt those actions while potentially informing the data owners. Officials must submit a report to Congress within one year outlining their strategies, actions taken, and recommendations for future legislative or administrative steps.
The Youth AI Privacy Act requires companies that operate artificial intelligence chatbots to take specific steps to protect minors under 18 from potential harm. The law mandates that companies must clearly inform young users that they are interacting with an AI, not a human, and prohibits features designed to encourage compulsive use, such as push notifications or rewards for frequent engagement. Additionally, the bill restricts how companies can use personal data from minors, banning the use of this information for advertising, profiling, or training AI models, with limited exceptions for safety testing. The Federal Trade Commission is tasked with enforcing these rules and issuing guidance to help companies comply, while also authorizing funding for research on the effects of AI chatbots on youth mental health.
The Parents Decide Act requires operating system providers to collect users' dates of birth when setting up accounts and using the system, with parental verification needed for anyone under 18. The bill mandates that app developers be able to access this information to verify user ages and gives parents control over what their minor children can access on their devices. The Federal Trade Commission is tasked with creating specific regulations within 180 days on how to verify parental consent, protect collected data, and implement these requirements, with enforcement through existing FTC unfair practices laws. The provisions take effect one year after enactment, and the FTC must report to Congress on implementation within 18 months.
This bill requires credit reporting resellers to use reasonable procedures to ensure the accuracy of consumer information they transmit to other agencies or end users. It limits reseller liability when they accurately pass on data obtained from another consumer reporting agency without making changes. The law defines resellers according to existing Fair Credit Reporting Act definitions and focuses on maintaining data integrity during the transfer process. These changes directly affect companies that sell consumer credit reports to other businesses or individuals.
This bill prohibits businesses from using automated systems to set different prices for food and groceries based on surveillance data about individual consumers, such as their browsing history or personal information. It allows exceptions for discounts based on reasonable costs, membership programs, or broad group categories like students and seniors, provided the rules are clearly disclosed and applied uniformly. The Federal Trade Commission would enforce these rules, while states and individuals can also sue for violations, seeking damages of at least $3,000 per violation.
The Online Privacy Act of 2026 establishes a new Digital Privacy Agency to enforce comprehensive privacy protections for individuals in the United States. The bill requires companies that collect personal information to provide consumers with rights to access, correct, delete, and port their data, while also prohibiting discriminatory processing and requiring explicit consent for behavioral personalization. Covered entities must implement data minimization practices, maintain detailed access records for employees, and notify individuals of data breaches within 14 days. The legislation creates a new federal agency with enforcement powers, including the ability to issue cease-and-desist orders, impose civil penalties, and conduct investigations, while also transferring certain Federal Trade Commission privacy enforcement authorities to this new agency.
This joint resolution seeks to formally disapprove a rule from the Bureau of Consumer Financial Protection that would have removed regulations on how large banks and credit unions handle consumer information requests. If passed, the resolution would prevent the Bureau from withdrawing the existing requirements that govern how these financial institutions respond to consumer data inquiries. The measure directly affects the Bureau's regulatory authority and the operational compliance obligations of large financial institutions. By invoking a statutory review process, the resolution aims to keep the current consumer protection standards in place without allowing the proposed regulatory changes to take effect.
This bill establishes a framework to protect American-owned closed-source AI models from unauthorized extraction by foreign entities, particularly those from China and Russia. It requires the Secretary of State to conduct assessments identifying which foreign entities are conducting model extraction attacks or facilitating them through fraudulent account networks, then publish a public list of these actors for up to five years. The legislation authorizes the President to impose economic sanctions on identified entities and their affiliates, while also creating mechanisms for industry coordination and sharing information about threats. Importantly, the bill distinguishes between legitimate AI research conducted under contractual terms and unauthorized extraction attempts that bypass access controls or violate usage agreements.
This joint resolution seeks to disapprove a rule from the Bureau of Consumer Financial Protection that would have removed a previous requirement about protecting sensitive consumer data. If passed, the resolution would keep in place the earlier rule that mandated stricter data security measures for financial institutions. The measure directly affects banks and other financial companies that handle sensitive consumer information. It uses a congressional veto process to block the agency's attempt to withdraw the data protection rule.
This bill establishes a comprehensive federal framework for consumer data privacy and security, creating a uniform set of rules that would preempt most state privacy laws. It requires businesses that collect personal data to obtain consent from individuals before gathering or processing their information, with stricter requirements for sensitive data like health records and financial details. Covered entities must provide clear privacy policies, allow individuals to access, correct, or delete their data, and implement security programs to protect information from unauthorized access. The Federal Trade Commission would enforce these rules and has authority to impose civil penalties on violators, while also receiving additional funding to carry out enforcement duties.
