This bill creates rules for companies that run online services and that collect data tied to people or their devices. It defines key terms such as "end user," "individual identifying data," "online service provider," and "sensitive data." Online service providers must follow three duties: a duty of care (protect data and notify users of breaches involving sensitive data), a duty of loyalty (not use user-linked data in ways that benefit the company but harm users or cause serious, foreseeable harm or that a reasonable user would find highly offensive), and a duty of confidentiality (not disclose, sell, or share such data except under strict rules and only if the recipient agrees to the same duties and is audited). If a provider gives data to another person, those duties also apply to that person. The Federal Trade Commission (referred to as the Commission) will enforce the law, write rules, and may expand breach-notification rules. State attorneys general can sue on behalf of residents and seek civil penalties for knowing or repeated violations. The bill also says rights under this act cannot be waived by contract, does not change other privacy laws, and takes effect on enactment with the main duties applying 180 days after enactment.
No publicly available information on the estimated costs to the federal government, businesses, or states is included in the bill text. The bill authorizes the Commission to write regulations and allows states to seek civil penalties, but it does not provide budget or cost estimates.
No publicly available information in the bill text about supporters' stated reasons or arguments for the bill.
No publicly available information in the bill text about opponents' stated reasons or arguments against the bill.