Senator Gillibrand Reintroduced Data Protection Act

The proposed legislation targets personal data misuse by establishing an independent federal oversight agency.

Updated on Sept. 30, 2026 in Cybersecurity

Bold flat-color editorial illustration of rhythmic modular server rack volumes, representing the structural nature of federal data protection policy. — Senator Kirsten Gillibrand has reintroduced the Data Protection Act, legislation proposing a dedicated federal agency to enforce data privacy standards and regulate information collection. AI Illustration. Upload story photo >

Live Poll

Should the U.S. establish an independent federal agency to regulate personal data privacy?

Senator Kirsten Gillibrand has reintroduced the Data Protection Act, a bill aimed at creating an independent federal agency to regulate data practices. The legislation seeks to limit how personal information is collected, used, and shared across the United States.

Why it matters

The United States currently lacks a dedicated federal agency to enforce privacy standards, leaving significant gaps in oversight. This bill attempts to curb threats to civil rights and privacy resulting from unregulated data practices.

In 2025, 3,300 data breaches occurred in the U.S., impacting 278 million individuals. Despite this scale, 89 percent of Americans report concern over how their personal data is accessed and used by aggregators.

The players

Kirsten Gillibrand

United States Senator who has repeatedly sponsored legislation focused on federal data privacy oversight.

The details

The proposed agency would manage a public registry of data aggregators while enforcing strict limits on data collection and sharing. It would also possess the authority to pursue civil penalties, injunctive relief, and other equitable remedies for privacy violations. Furthermore, the agency would be responsible for establishing new privacy standards, specifically targeting high-risk data practices and algorithm fairness.

2025: More than 3,300 data breaches occurred across the United States.
September 30, 2026: Senator Kirsten Gillibrand reintroduced the Data Protection Act.

The Tech Race

The proposed Data Protection Act marks a departure from the current U.S. sector-specific regulatory framework by mirroring the centralized authority structure found in the European Union General Data Protection Regulation (GDPR). This move highlights a growing competition between national legislative approaches to curb the influence of data aggregators.

If enacted, this legislation would change how private companies handle user information by requiring stricter adherence to federal privacy standards. While currently just a proposal, it would eventually impact any American whose personal data is managed by large-scale commercial aggregators.

The takeaway

This reintroduction underscores a persistent push to formalize federal privacy oversight in response to widespread data exposure. Watch the upcoming legislative calendar for committee hearings that may define the agency's enforcement scope.