DELETE Act
- Bill Number
- S. 1287
- Origin Chamber
- Senate
- Congress
- 119th Congress, Session 1
- Policy Area
- Commerce
- Status
- Introduced
- Latest Action
- 2025-04-03: Read twice and referred to the Committee on Commerce, Science, and Transportation.
- Last Updated
- 2026-04-21T11:03:28Z
AI-Generated Summary
Purpose of the Legislation
The DELETE Act (S. 1287) aims to protect consumer privacy by creating a federal system that lets individuals easily request the deletion of their personal information from data brokers—companies that collect and sell personal data on people they don't directly know or serve. It sets up a one-stop process to remove data across all such brokers and stop future collection, while requiring brokers to register and follow rules.
Key Provisions
- Data Broker Registration:
- Data brokers must register annually with the Federal Trade Commission (FTC) within 18 months of the law's enactment.
- Registration includes details like the broker's contact info, opt-out methods (if any), types of data collected and sources, and any identity verification processes for sharing data.
- The FTC makes this info public in an easy-to-download format, with a disclaimer that it can't verify accuracy.
- Brokers don't have to reveal trade secrets or confidential business info.
- Centralized Deletion System:
- The FTC must create and run a secure online system within one year, where people submit a single request (via a standard form with details like email, phone, address) to delete their data from all registered brokers.
- The system uses "hashing" (a secure way to scramble identifiers like emails without revealing them) and "salting" (adding random data to hashes for extra security) to create private registries that brokers can query without seeing full details.
- Individuals can request deletion of all personal info tied to identifiers (like device IDs) and opt to stop future collection; it's free and done through the FTC's website.
- Brokers must check the registries every 31 days, delete matching data within 31 days, and report deletions to the FTC. They can't charge for this.
- Deletion Rules and Exceptions:
- Brokers and their affiliates must delete all personal info (e.g., names, addresses, browsing history, financial details, inferences about behavior) linked to the individual and stop collecting more, unless needed for:
- Legal human subjects research (studies on people following ethical rules).
- Court orders, subpoenas, or laws requiring retention.
- Specific fraud prevention or identity verification, but only for that purpose—not marketing.
- Retained info can't be used for other reasons.
- Compliance and Oversight:
- Brokers pay an annual fee (capped at 1% of system costs) to access the hashed registries; fees fund the system and FTC enforcement.
- Annual reports from brokers on deletion completion rates.
- Every three years, independent audits of compliance, with reports to the FTC kept for six years.
- The FTC enforces violations as unfair practices under existing consumer protection laws, with fines and other penalties.
- Study, Reporting, and Preemption:
- The FTC conducts a study on the system's effectiveness, deletion requests, and coordination with state privacy laws, reporting to Congress annually for five years with recommendations.
- The law overrides conflicting state privacy rules but allows states to keep stronger protections.
- Definitions (Key Terms Explained):
- Data Broker: A business that collects personal info from non-customers and sells, shares, or uses it for third parties (excludes news media, credit agencies, fraud prevention services, or directory assistance).
- Personal Information: Any data linked to an individual, like addresses, emails, location, biometrics, browsing history, or profiles based on inferences.
- Delete: Permanently remove data so it can't be read or used in normal business.
- Direct Relationship: Ongoing customer ties (e.g., recent purchases or inquiries); deletion requests don't create one.
Significant Changes to Existing Law
- This introduces the first federal mandate for data brokers to register publicly and comply with a unified deletion system, building on but expanding FTC authority under the Federal Trade Commission Act (which treats violations as deceptive practices).
- No prior nationwide law requires a centralized opt-out for data brokers; it adds technical standards like hashed registries for privacy-preserving queries.
- It excludes certain activities (e.g., journalism, fraud checks) to avoid overreach, and limits preemption to preserve state laws like California's stricter privacy rules.
Potential Impacts
- On Citizens: Empowers individuals with a simple, free way to control their data, reducing unwanted tracking and sales, which could limit identity theft risks and targeted ads. However, it relies on people knowing about and using the system.
- On Government Agencies: The FTC gains new duties to build/maintain the system, handle registrations, enforce rules, and report to Congress, potentially increasing its workload and budget (offset by fees). It may coordinate with states for better enforcement.
- On Data Brokers: Requires operational changes like regular data purges and audits, raising compliance costs but capping fees; smaller brokers might struggle more than large ones.
- On International Relations: Minimal direct impact, though it could influence global data privacy standards (e.g., aligning with EU rules) and affect U.S. firms operating abroad by standardizing deletion practices.
Main Stakeholders Affected
- Individuals/Consumers: Primary beneficiaries, gaining easier privacy tools.
- Data Brokers: Businesses like Acxiom or Experian must register, delete data, and pay fees; exclusions protect some (e.g., news outlets).
- Federal Trade Commission (FTC): Leads implementation, enforcement, and public education.
- States and Regulators: Can maintain or enhance their laws, potentially partnering with the federal system.
- Third Parties: Companies buying data (e.g., advertisers) may face reduced access; researchers and law enforcement get narrow exceptions.
Notable Legal, Constitutional, or Political Implications
- Legal: Strengthens FTC enforcement powers without new agencies, treating non-compliance as unfair trade practices for civil penalties. The hashing system balances privacy with broker needs, but disputes over "reasonable linkability" of data could lead to lawsuits.
- Constitutional: May raise free speech concerns if deletions limit public data use (e.g., for journalism), but exclusions mitigate this; no direct First Amendment conflicts as it targets commercial data sales, not expression.
- Political: Bipartisan support (introduced by Sens. Cassidy, Ossoff, Lujan) reflects growing privacy consensus, but could spark debates on federal overreach vs. state rights. Annual reports ensure oversight, potentially leading to future expansions if effective.
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Cosponsors (3)
Sen. Ossoff, Jon [D-GA], Sen. Lujan, Ben Ray [D-NM], Sen. Schiff, Adam B. [D-CA]
Recent Actions
- 2025-04-03: Read twice and referred to the Committee on Commerce, Science, and Transportation.
- 2025-04-03: Introduced in Senate
Bill Versions
- Data Elimination and Limiting Extensive Tracking and Exchange Act — issued 2025-04-03 — PDF (23 pages)