US House Committee Advances Comprehensive Federal Privacy Bill With Power to Preempt State Laws

The US House Energy and Commerce Committee has overwhelmingly advanced a comprehensive federal privacy bill, marking the most significant legislative momentum for national data protection in nearly a decade. The bipartisan vote signals a growing consensus in Washington that the current unregulated data broker ecosystem requires federal intervention.[1]

The legislation, currently dubbed the American Privacy Rights Act of 2026, aims to establish a unified national standard for how companies collect, store, and monetize consumer data. If passed, the bill would fundamentally rewrite the rules of the internet economy, shifting the baseline of privacy from a consumer opt-in model to a default corporate restriction.[2][3]

At the heart of the legislation is a structural shift known as "data minimization." For the past two decades, the internet has operated on a "notice and consent" model, where companies write lengthy, opaque privacy policies and consumers must click "accept" to access a service, legally signing away their data rights in the process.

Under the new federal framework, companies would be legally restricted to collecting only the data strictly necessary to provide the specific product or service the consumer requested. The burden of proof shifts to the company to justify why a specific data point is required for functionality.[1]

For example, a digital flashlight application would no longer be permitted to collect, store, and sell a user's precise GPS location to third-party data brokers, regardless of what is buried in its terms of service. If the data is not needed to turn on the phone's LED light, its collection becomes a federal violation.[3]

The most contentious mechanism in the bill, however, is federal preemption. The legislation is explicitly designed to override the existing patchwork of state-level privacy laws, replacing them with a single, unified national rulebook that supersedes local legislation.[2][4]

Currently, 15 states have enacted their own comprehensive privacy frameworks. This has created a complex compliance nightmare for technology companies, who must build different data infrastructure for users in California, Colorado, and Virginia, while leaving residents of the remaining 35 states with virtually no digital rights.

Industry groups and major tech conglomerates have heavily lobbied for this preemption clause. They argue that a fragmented regulatory landscape stifles innovation and disproportionately burdens mid-sized tech firms that cannot afford massive legal and compliance teams to navigate 15 different state laws.[2]

Conversely, state regulators and digital rights organizations argue that federal preemption sets a "regulatory ceiling" rather than a floor. They warn that the federal bill, while an improvement for states with no laws, actively strips away stronger protections that citizens in progressive states have already voted for.

California lawmakers, in particular, have voiced strong opposition. They note that the federal bill lacks some of the stringent automated decision-making protections and algorithmic audit requirements currently enforced by the California Privacy Protection Agency under the state's existing laws.[4]

To bridge this partisan and geographic divide, the committee negotiated a delicate compromise regarding the "private right of action"—the legal mechanism that allows individual consumers to sue companies directly for privacy violations, rather than waiting for the Federal Trade Commission to act.[1]

The advanced bill allows consumers to file lawsuits against companies that illegally sell their sensitive data or suffer a negligent data breach. However, it mandates a 30-day "cure period," giving businesses a window to delete the data and fix the violation before facing class-action litigation.

The legislation also introduces strict new boundaries on the digital advertising ecosystem. It outright bans the use of sensitive data—such as health information, biometric scans, precise geolocation, and private communications—for targeted advertising under any circumstances.[3]

For non-sensitive data, the bill requires companies to provide a clear, standardized opt-out mechanism for targeted advertising. It also mandates that large data brokers register with the FTC and provide a "one-click" deletion tool allowing consumers to wipe their profiles from broker databases nationwide.[1][3]

While the committee vote represents a major milestone, the bill now faces a deeply divided Senate. Previous iterations of federal privacy legislation have historically stalled in the upper chamber over the exact balance of state preemption and the scope of consumer lawsuits, leaving the final fate of the 2026 act uncertain.[1][4]