Consumer Data Privacy and Security Act of 2026

The Consumer Data Privacy and Security Act of 2026 would establish a federal framework to protect consumer privacy by regulating how covered entities—including businesses, common carriers, and nonprofits—collect, process, and use personal data. It requires explicit or implicit consent for data collection unless a permissible purpose applies, grants individuals rights to know and control their data, mandates security measures, and imposes accountability obligations such as appointing privacy officers and conducting impact assessments. The bill also defines sensitive personal data, sets rules for service providers and third-party data sharing, and empowers the Federal Trade Commission to enforce compliance, with provisions tailored for small businesses.