HB8652, titled the “You Own the Data Act” (YODA), would establish a broad federal privacy framework for large online operators and data brokers. The bill declares that users own the data they create and seeks to limit how covered entities collect, retain, share, monetize, and delete personal information. It would prohibit companies from requiring users to hand over or monetize private data as a condition of service, restrict the collection of third-party contact information without written consent, and bar tracking cookies unless the user authorizes them. It also requires clearer privacy notices, access to data, correction and deletion rights, data portability, and notice of data breaches.
The bill would also impose special rules for minors, requiring affirmative parental or guardian consent before collecting, retaining, or transferring a child’s covered data where technically feasible. Covered entities would have to provide opt-out controls, allow users to delete data directly over time, and treat users who refuse tracking cookies the same as those who accept them. In addition, the bill sets limits on data retention, including a 60-day deletion rule for browsing history and biometric data, and requires annual reporting when a user allows data to be sold. Enforcement would be handled by the Federal Trade Commission, state attorneys general, and a private right of action for individuals against large covered entities.
If enacted, the bill would create new federal obligations for large online platforms and data brokers and would likely affect privacy, advertising, analytics, and data brokerage practices nationwide. It would also expand user rights over personal information and create new compliance duties related to consent, transparency, deletion, portability, and breach response. The bill expressly states that it does not limit other federal or state laws, so it would operate alongside existing privacy and consumer protection regimes rather than replacing them entirely.
The overall sentiment reflected in the bill text is strongly pro-privacy and pro-user control, with the findings emphasizing civil liberties, property rights, and anonymity. Because there are no committee transcripts or votes provided, there is no recorded legislative debate or formal vote history to indicate broader support or opposition. The main points of contention likely concern the scope of the restrictions on data collection and monetization, the compliance burden on large online services and data brokers, the private right of action, and the practical feasibility of requirements such as parental consent, data deletion, and user-controlled opt-outs.
The bill would add a new federal privacy and data-rights regime affecting covered entities defined as large online operators and data brokers. It would require changes to data collection, sharing, retention, deletion, portability, consent, and disclosure practices, and would authorize enforcement by the FTC, state attorneys general, and private plaintiffs. It would not preempt other federal or state laws, but would layer additional obligations onto existing consumer protection and privacy statutes and could significantly affect online platforms, ad-tech firms, and data brokers.
The bill’s framing and findings are strongly supportive of privacy rights, user ownership of data, and limits on commercial data exploitation. No committee discussion or vote record is provided, so there is no evidence of formal opposition or support in the legislative history included here. Based on the text alone, the measure appears designed to appeal to privacy advocates and critics of data monetization, while likely drawing concern from technology and advertising interests over operational and legal burdens.
Likely points of contention include the bill’s broad restrictions on monetization and data sharing, the requirement for written consent to access contacts, the limits on tracking cookies, and the obligation to provide deletion and portability rights. Covered entities and data brokers may object to the compliance costs, the 60-day deletion rule for browsing and biometric data, and the private right of action with statutory damages. Supporters would likely emphasize stronger privacy protections, while opponents would likely focus on feasibility, enforcement exposure, and the impact on service design and targeted advertising.