US HB8014: Online Privacy Act of 2026

In one paragraph

The federal H.R. 8014 (Online Privacy Act of 2026) would create individual privacy rights and security duties for covered entities that intentionally collect, process or maintain personal information and send or receive it over the internet, and a new Digital Privacy Agency to enforce them. Its AI-related parts include a right to human review of solely automated decisions that materially increase reasonably foreseeable significant privacy harms and a ban on behavioral personalization without affirmative express consent. Introduced March 19, 2026 and referred to House committees; no further action.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill is pending. It would put access, deletion, consent, security and breach-notice duties on businesses handling personal data online, with human review of automated decisions.

Key provisions

1. 1Title I rights: access, correction, deletion and portability of personal information, and notice within 30 days when contact information is collected from someone with no existing relationship
2. 2Sec. 105: for solely automated decisions that materially increase reasonably foreseeable significant privacy harms, the entity must inform the individual, offer a way to request human review and conduct it within a reasonable amount of time
3. 3Sec. 106: no behavioral personalization without affirmative express consent, renewed at least every calendar year
4. 4Title II duties include data minimization, no disclosure without consent, a ban on re-identification and on dark patterns, and information security policies; breaches must be reported to the agency without undue delay and if feasible within 72 hours, and to individuals within 14 days where they face foreseeable privacy harms
5. 5Sec. 5 adds 18 U.S.C. 881: knowingly disclosing personal information via interstate commerce with intent to threaten, intimidate or harass, or to incite or facilitate a crime of violence, is punishable by a fine and up to 5 years in prison
6. 6Title III creates the Digital Privacy Agency (Director with a 6-year term) and authorizes $550,000,000 for each of fiscal years 2026 through 2030; small businesses are exempt from several rights

Latest legislative action

Mar 19, 2026. Referred to the House Committee on Energy and Commerce, and in addition to the Committees on the Judiciary and Science, Space, and Technology.

Sponsors