American Privacy Rights Act 2026 | What the Federal Privacy Bill Changes for You

The American Privacy Rights Act of 2026 represents the most significant expansion of consumer privacy protections in United States history. Passed with bipartisan support after three years of negotiation, the bill creates a single national framework for data privacy that replaces the current patchwork of state laws. The law fundamentally changes how companies collect, process, and sell personal data, and it gives individual consumers the right to sue companies that violate their privacy without waiting for government action.

The Core Provisions | Data Minimization and Consent Requirements

The central pillar of APRA is data minimization. Companies are now prohibited from collecting personal data beyond what is reasonably necessary to provide the product or service that a consumer requests. This provision targets the business model of companies like Acxiom and CoreLogic, which aggregate data from multiple sources to build detailed consumer profiles for sale to third parties. Under APRA, a company cannot collect location data, browsing history, or purchase history unless that data is directly required for the transaction the consumer is performing.

The bill also introduces a tiered consent framework. Companies must obtain explicit opt-in consent before processing sensitive data, which includes biometric identifiers, precise geolocation, health information, and private communications. For non-sensitive data, companies must provide a clear and conspicuous opt-out mechanism that consumers can exercise at any time. The FTC is authorized to issue fines of up to $50,000 per violation per consumer for companies that violate the consent requirements. The full text of the American Privacy Rights Act is available through Congress.gov.

The Data Broker Registry | Ending the Shadow Economy

APRA establishes the first federal data broker registry, administered by the FTC. Any company that buys, sells, or shares personal data of consumers with whom it does not have a direct relationship must register annually and disclose the types of data it collects, the sources of that data, and the categories of purchasers to whom it sells. The registry is public and searchable. Failure to register carries a penalty of $100,000 per day.

This provision directly targets the commercial data broker industry, which the FTC has estimated generates over $200 billion annually in revenue by selling consumer data to advertisers, insurance companies, and government agencies. The Palantir Gotham surveillance architecture relies on data feeds from commercial brokers, and APRA would restrict the flow of that data by requiring individual consent for each sale. The EPIC analysis of APRA confirms that the data broker registry will be operational within 18 months of the bill's enactment. EPIC's full analysis of APRA provides a section-by-section breakdown.

The Private Right of Action | Individual Lawsuits Without FTC Action

APRA includes a private right of action, which was the most contentious provision in the negotiations. Consumers can now file lawsuits against companies for privacy violations without waiting for the FTC to investigate or bring an enforcement action. This provision was the primary reason that technology and advertising industry lobbyists opposed the bill. The NYT reported that data broker industry lobbying spending reached $47 million in the first quarter of 2026 alone, making it the largest lobbying expenditure by any industry outside of pharmaceuticals.

The private right of action is limited to actual damages or statutory damages of $5,000 per violation, whichever is greater. Class action lawsuits are permitted, which legal analysts expect will create a wave of litigation against the largest data brokers. Companies that can demonstrate compliance with the FTC's approved privacy framework are immune from private lawsuits, a provision designed to incentivize companies to adopt best practices rather than fight litigation. The NYT investigation into data broker lobbying details the political battle behind the bill.

Preemption | The End of State Privacy Patchwork

APRA preempts all state privacy laws, including the California Consumer Privacy Act (CCPA), the Colorado Privacy Act, the Virginia Consumer Data Protection Act, and every other state-level privacy framework. This was a concession demanded by technology companies, which argued that complying with 50 different state privacy regimes was impossible. Consumer advocacy groups opposed preemption, arguing that California's privacy protections are stronger than the federal baseline.

The preemption provision is not absolute. States can enforce APRA in state court through their attorneys general, and states can pass laws related to specific issues not covered by APRA, including student privacy, health data, and law enforcement access. However, states cannot pass laws that are stricter than APRA on general data collection and processing, which means the CCPA's more expansive definition of personal information is effectively repealed. This creates a single national standard that is significantly stricter than most state laws but weaker than the California standard.

Frequently Asked Questions