YODA
- Bill Number
- H.R. 8652
- Origin Chamber
- House
- Congress
- 119th Congress, Session 2
- Policy Area
- Commerce
- Status
- Introduced
- Latest Action
- 2026-05-04: Referred to the House Committee on Energy and Commerce.
- Last Updated
- 2026-05-18T18:52:37Z
AI-Generated Summary
Summary of H.R. 8652: You Own the Data Act (YODA)
Purpose
This legislation affirms that individuals own their personal data and seeks to protect privacy and property rights by restricting how companies collect, use, share, or profit from such data. It aims to prevent companies from conditioning access to services on data sharing or monetization and to give users greater control over their information.
Key Provisions
- User Data Ownership and Consent: Declares that data belongs to the user who creates it, even if shared or sold with consent. Prohibits covered entities from requiring users to transfer or allow monetization of their data to access services.
- Prohibition on Contact Sharing: Makes it unlawful for covered entities to request or access a user's contacts or contact information without written consent from both the user and the contacts.
- User Rights to Data Access and Control: Requires covered entities to let users access their data (including lists of recipients), correct inaccuracies, request deletion or de-identification, and obtain portable copies in a machine-readable format, at no cost and at least twice per year.
- Data Minimization: Limits collection, sharing, and retention of personal information to what is reasonably necessary for requested services or fraud prevention; monetization is explicitly not considered necessary.
- Consumer Controls: Mandates an opt-out icon for data collection on websites and apps; requires deletion options within two years; bans tracking cookies without consent and ensures equal service quality for those who opt out.
- Minors' Protections: Prohibits collection, retention, or transfer of data from users under 18 without affirmative parental or guardian consent, where feasible.
- Transparency Requirements: Demands clear, concise privacy notices (1,000 words or less) detailing data collection, use, and sharing; requires annual reports to users whose data is sold.
- Data Security: Requires timely breach notifications and remedies such as credit monitoring.
- Retention Limits: Mandates deletion of browsing history or biometric data within 60 days of collection.
- Enforcement Mechanisms: Authorizes Federal Trade Commission (FTC) enforcement as an unfair or deceptive practice, state attorney general actions, and a private right of action for individuals against large entities (those with at least $50 million in global revenue), with damages of $100–$750 per violation.
Significant Changes to Existing Law
The bill introduces new federal standards for data ownership and user rights, including explicit prohibitions on data-for-service exchanges and contact harvesting. It establishes a private right of action and specific timelines for data access and deletion, going beyond existing FTC authority under the Federal Trade Commission Act by creating affirmative obligations for covered entities. It also adds targeted rules for minors, cookies, and breach remedies not uniformly present in prior federal privacy statutes.
Potential Impacts
- On Government Agencies: Expands FTC oversight and enforcement duties; enables state attorneys general to pursue civil actions, potentially increasing litigation and coordination with federal efforts.
- On Citizens: Enhances user control over personal information, potentially improving privacy protections and access to services without data surrender, though compliance may affect service availability or costs.
- On International Relations: Could influence data practices of multinational companies operating in the U.S., possibly aligning with or conflicting with foreign privacy regimes like those in the European Union.
Main Stakeholders Affected
- Users and consumers residing in the United States.
- Covered entities, including commercial data operators, data brokers, and large online platforms with over 100,000,000 users.
- Parents and guardians of minors under 18.
- Federal Trade Commission and state attorneys general for enforcement.
- Third-party recipients of user data.
Notable Legal, Constitutional, or Political Implications
The bill ties data protection to constitutional concepts of property rights and privacy against unwarranted searches. It creates a private right of action, which may lead to increased litigation. Enforcement provisions integrate with existing FTC and state consumer protection laws without preempting them. The emphasis on written consent and minimization could raise compliance challenges for smaller entities, though thresholds focus on large operators.
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Recent Actions
- 2026-05-04: Referred to the House Committee on Energy and Commerce.
- 2026-05-04: Introduced in House
- 2026-05-04: Introduced in House
Bill Versions
- You Own the Data Act — issued 2026-05-04 — PDF (15 pages)