What the New Data Privacy Bill Actually Does, Section by Section
The Digital Privacy Standards Act cleared committee on September 12. Here is what its four main sections actually require, without the spin from either side.
By Jonah Reyes, Politics & Policy
· 2 min read
Key Takeaways
- •The Digital Privacy Standards Act passed committee 14 to 9 on September 12; it is not yet law.
- •Section 1 creates a 45-day data deletion window, with fines up to $7.5 million per company per year.
- •Section 2 requires plain-language disclosure of data categories collected and shared, similar to existing California law.
- •The most contested provision, Section 3, would let individuals sue companies directly rather than relying solely on regulators.
The Digital Privacy Standards Act cleared the Senate Commerce Committee on September 12 by a 14 to 9 vote, advancing a bill that would require companies to let users delete their personal data on request and to disclose, in plain language, what categories of data they collect.
The bill runs 142 pages. Most of what matters to an ordinary reader is contained in four sections: data deletion rights, disclosure requirements, a private right of action, and an enforcement timeline.
Context box: how a bill gets from committee to law
The Short Answer
Passing a Senate committee vote means the bill can now be scheduled for a floor vote, but it is not law yet. It still needs a majority vote in the full Senate, a matching or reconciled version passed by the House, and the President's signature, or a two-thirds override of a veto.
Section 1 of the bill gives consumers the right to request deletion of personal data held by a company, with a 45-day compliance window. Companies that fail to comply face fines starting at $2,500 per violation, per consumer, capped at $7.5 million per company per year.
$7.5 million
maximum annual fine per company for deletion request violations
Fines scale from $2,500 per individual violation, meaning a company would need roughly 3,000 documented violations to hit the cap in a single year.
Section 2 requires companies to publish a data inventory, in plain language, listing categories of data collected, location, browsing history, purchase history, and which third parties receive it. This is modeled closely on California's existing state law, which has been in effect since 2020.
“The disclosure section does not ban data sharing. It requires a company to say, in one place, what it shares and with whom. That is a smaller step than either side is describing it as.”
Where the two sides actually disagree
The real fight is over Section 3, the private right of action, which would let individual consumers sue a company directly for a violation rather than relying only on a regulator to bring a case. Industry groups argue this will trigger a wave of class-action lawsuits; consumer advocates argue it is the only enforcement mechanism with real teeth, since state attorneys general have brought only 31 privacy enforcement actions nationwide since 2020.
The bill's next stop is a full Senate floor vote, not yet scheduled as of publication. A companion bill in the House has been introduced but has not yet received a committee hearing.
Frequently Asked Questions
- Does this bill ban companies from collecting personal data?
- No. It does not ban data collection. It requires companies to disclose what data they collect and to honor deletion requests within 45 days.
- When would the law take effect if passed?
- The bill as written includes an 18-month implementation window after signing, meaning companies would not need to comply until roughly two years after committee passage, assuming no delays.
- data privacy
- Congress
- legislation
- consumer protection
Sources
- 01Digital Privacy Standards Act, Committee Print, U.S. Senate Committee on Commerce, Science, and Transportationcommerce.senate.gov
- 02State Privacy Enforcement Actions Database, National Association of Attorneys Generalexample.com
Corrections
No corrections have been made to this article.
About the reporter
Politics & Policy Reporter, Trestlewire
I cut my teeth covering a state legislature, which taught me that most of what actually changes people's lives happens in committee markups and agency rulemaking, not in the moments that make the evening news.
Read full bio and all stories →