September 30, 2026
Today, U.S. Senator Kirsten Gillibrand (D-NY) reintroduced the Data Protection Act. This legislation would create a new independent federal agency to protect Americans’ data, ensure fair data practices, and help the government adapt to rapidly evolving digital technologies. “As AI continues to evolve, it is more important than ever that we take action to crack down on tech companies that misuse Americans’ data,” said Senator Gillibrand. “Currently, Big Tech companies are free to sell individuals’ data to the highest bidder without fear of real consequences, posing a severe threat to privacy and civil rights. My bill would create an independent federal agency to protect data and privacy, equipped with the resources to give Americans the meaningful protection they deserve.” Data privacy is a growing concern in the United States. In 2025 alone, more than 3,300 data breaches exposed over 278 million individuals’ personal information. About 89 percent of Americans are concerned that their data is being accessed and used inappropriately. Additionally, the U.S. is one of few democracies in the world that lacks a data protection agency. Senator Gillibrand’s Data Protection Act would create such an agency, strengthening the federal government’s ability to protect Americans’ data and bringing the U.S. in line with peer nations.
Specifically, the Data Protection Act would:
Limit the collection, use, and sharing of personal data;
Oversee high-risk data practices, ensure that data processing and algorithms are fair, and minimize the collection of data for commercial purposes;
Examine the social, ethical, economic, and civil rights impacts of data collection practices;
Maintain a publicly accessible list of data aggregators that collect, process, or share data;
Enforce privacy statutes and rules as authorized by Congress, with a broad range of tools including civil penalties, injunctive relief, and equitable remedies;
Develop model privacy and data protection standards, guidelines, and policies for use by the private sector and government agencies, and;
Advise Congress on emerging privacy and technology issues.
This legislation is endorsed by the Electronic Privacy Information Center (EPIC), Consumer Federation of America, Fairplay, Consumer Action, and National Association of Consumer Advocates. “The United States has been ensnared in a data privacy crisis for decades, and putting an end to it will take significant action from Congress,” said Kara Williams, Counsel at the Electronic Privacy Information Center. “EPIC is proud to endorse Sen. Gillibrand’s Data Protection Act, which would establish a federal data protection agency that would focus exclusively on protecting privacy—a crucial first step to ending the mass overcollection and exploitation of Americans’ personal data. With an increase in surveillance of every corner of life online and off, the need for a strong and clear privacy law with teeth has never been more urgent,” said Ben Winters, Director of AI and Privacy of the Consumer Federation of America. “The Data Protection Act is straightforward, administrable, and what we need right now.”
“Commercial surveillance has become Silicon Valley’s economic operating system, yet the United States is the only major industrialized country without a dedicated data protection agency to rein in harmful data practices,” said Asad Ramzanali, Director of Artificial Intelligence & Technology Policy at the Vanderbilt Policy Accelerator. “This void leaves Americans exposed and the government underequipped to respond. We’ve long needed a well-staffed watchdog with real authority to enforce privacy rights and hold companies accountable.”
“Consumers need an agency that makes data protection its priority. Senator Gillibrand’s plan to create a Data Protection Agency is the right step to ensure that companies use individuals’ data fairly, responsibly and with accountability,” said Ruth Susswein, Director of Consumer Protection at Consumer Action. Data centers in the U.S. are vulnerable to attack, and as a country we need to do a much better job with data security. That’s why the U.S. needs a data protection agency,” said Bruce Schneier, Fellow and Lecturer at Harvard Kennedy School.
