Consumer Data Privacy and Security Act of 2026

Increased Transparency: Covered entities are required to provide clear and specific privacy policies that explain what data is collected and why, making it easier for people to understand how their information is used (Section 4).

Greater Individual Control: The bill establishes specific rights for individuals, such as the right to access their data, request corrections to inaccurate information, and request the deletion of their personal data (Section s 5(b), 5(c), and 5(d)).

Enhanced Data Security: All covered entities and service providers must implement comprehensive data security programs with administrative, technical, and physical safeguards to protect against unauthorized access or theft (Section 6).

Protection of Sensitive Information: The bill requires express affirmative consent before an entity can collect or process highly sensitive personal data, such as biometric information or health information (Section 3(b)(1)(B)(i)).

Accountability for Large Entities: Large entities that process vast amounts of data must designate a privacy officer to oversee compliance and conduct privacy impact assessments for changes in processing sensitive data (Section 7).

Limits on Data Accuracy Verification for Small Businesses: Certain requirements regarding the right to access and correct data do not apply to small businesses, which may impact how individuals interact with smaller entities (Section 5(h)).

Potential for Fees on Excessive Requests: While the first two requests for data access in a year are free, covered entities are permitted to charge reasonable fees for requests that are considered manifestly unfounded or excessive (Section 5(e)(2)).

Restriction of Data Rights via Declination: Entities can refuse to act on a request to access, correct, or delete data if they determine it is contrary to their legitimate interests, such as completing a transaction or maintaining security (Section 5(g)(1)(B)).

Preemption of State Laws: The Act is intended to supersede many state privacy and security laws, which could impact the specific privacy protections previously established by individual states (Section 10(a) and 10(b)).