You Own the Data Act

Summary#

This bill, called the You Own the Data Act, says that individuals own the personal data they create. It limits how covered entities and commercial data operators can collect, share, sell, and keep that data. The bill requires clear privacy notices, gives users rights to access, correct, delete, and port their covered data, and sets rules for consent when collecting contacts and minors' data. It defines covered data to include location, phone and email, social security and government IDs, browsing history, call records, biometric data, and certain communications.

What it means for you#

  • Companies must give you access to your covered data or a readable summary within 90 days of a verified request. They must allow you to correct, delete, or de-identify that data and to get it in a portable, machine-readable format when possible.
  • You can exercise these rights at least twice per year and the company must do this free of charge.
  • Companies cannot force you to share your contacts unless both you and those contacts give written consent. If you are under 18, a parent or guardian must affirmatively consent before a covered entity collects or shares your data where technically feasible.
  • Companies that collect browsing history or biometric data must delete it within 60 days of collection.
  • Websites and apps must show a clear opt-out icon for data collection, and privacy notices must be clear, accurate, and 1,000 words or less.
  • The Federal Trade Commission enforces the rules, states can also sue, and individuals can bring private lawsuits against large covered entities.

Expenses#

No publicly available information on federal budget or implementation costs. The bill does specify enforcement and remedies that could have financial effects: the FTC may enforce the law; state attorneys general may sue; and private plaintiffs may recover $100 to $750 per violation plus attorney fees and other relief. No official cost estimates are included in the text.

Proponents' View#

According to the bill text, supporters aim to protect individual property and privacy rights in personal data. The bill frames its rules as returning control to users, limiting unnecessary data collection and monetization, improving transparency, and giving people tools to access, correct, delete, and move their data.

Opponents' View#

No publicly available information.