Online Privacy Act of 2026

Individual Data Control: The bill grants people specific rights to access, correct, delete, and move their personal information, which empowers individuals over their own digital footprint (Sec. s 101, 102, 103, and 104).

Protection Against Automated Bias: Individuals have the right to request a human review of decisions made solely through automated processing if those decisions could cause significant privacy harms (Sec. 105).

Increased Autonomy in Personalization: The act requires entities to get express affirmative consent before using personal information to create or improve behavioral personalization algorithms (Sec. 106).

Prevention of Discrimination: The bill prohibits entities from using personal information to discriminate against people in critical areas like employment, housing, education, and health care (Sec. 207).

Enhanced Protection Against Harmful Behavior: The bill creates a criminal penalty for doxxing, specifically targeting those who disclose personal information with the intent to threaten, intimidate, or harass others (Sec. 5).

Data Security and Breach Notification: It requires entities to implement reasonable security policies and mandates that they notify individuals of data breaches that could cause privacy harms (Sec. 212 and 213).

Right to Petition for Modification: Individuals or entities can file a petition with the Digital Privacy Agency to modify or set aside a civil investigative demand based on constitutional or legal rights (Section 401(f)).

Protection Against Insolvency: The Digital Privacy Agency can issue temporary cease-and-desist orders if a violation is likely to cause a person to become insolvent or prejudice individual interests (Section 402(c)(1)).

State Enforcement: State attorneys general or privacy regulators can bring civil actions on behalf of residents to enjoin violations or compel compliance (Section 404(a)).

Private Right of Action: Aggrieved persons have the right to bring civil actions for injunctive relief or damages in a court of competent jurisdiction (Section 405(a)-(b)).

Nonprofit Representation: Individuals can appoint a nonprofit organization to lodge complaints and represent their interests in privacy and information security matters (Section 405(c)).

Whistleblower Incenties: Individuals who report violations through the Director can receive a portion of the resulting civil penalties (Section 408(b)).

Standardized Research and Education: NIST is tasked with developing privacy risk management frameworks and carrying out public awareness activities to help individuals understand privacy risks and rights (Section 601; Section 602).

Potential Service Disruptions: While the bill provides for providing services without behavioral personalization, it notes that if a core aspect of a product cannot function without such personalization, an entity may deny the use of that product or service (Sec. 106).

Burden of Identity Verification: The ability to exercise rights may be subject to identity verification and authentication procedures, which could pose a hurdle for some individuals (Sec. 109).

Information Loss via Deletion: While the right to deletion is a benefit, the bill also allows entities to deny such requests if the information is necessary to complete a transaction or perform a contract initiated previously (Sec. s 103 and 110).

Cease-and-Desist Orders: The Digital Privacy Agency can issue orders that require a person to cease certain acts and take affirmative action to correct violations (Section 402(b)(1)(D)).

Temporary Orders: The Agency may issue temporary orders that become effective immediately upon service, requiring a person to act to prevent insolvency or other conditions (Section 402(c)(1)).

Civil Money Penalties: Violators may be required to pay penalties based on the number of individuals whose personal information was affected (Section 406(c)(2)).

Legal Costs: In civil actions brought by the Agency or State officials, the prevailing party may recover its costs (Section 406(b)).