The Online Privacy Act of 2023 creates a new federal law to protect how companies handle your personal information online. It establishes a new government agency called the Digital Privacy Agency to enforce these privacy rules and gives you several important rights.

Under this law, you gain the right to know what personal information companies collect about you and how they use it. You can request to see all the data a company has on you, find out which other companies they've shared it with, and understand what they're using your information for. You also get the right to delete your personal information and to correct information that's wrong or incomplete. Companies must provide easy ways for you to exercise these rights, including online options.

The law limits how companies can use your data, especially for targeted advertising and behavioral tracking. It prevents companies from selling your information without proper consent and creates rules about how data can be shared with third parties. The law also makes it illegal for anyone to publicly share your personal information with the intent to threaten, harass, or harm you. Small businesses with less than $25 million in annual revenue get some exemptions from these requirements, but larger companies must comply fully. Importantly, you cannot waive your rights under this law through contracts or agreements—these protections are mandatory and cannot be taken away.

Online Privacy Act of 2023

Eshoo, Anna G.

Online Privacy Act of 2023 This bill establishes online privacy rights for personal information, including the contents of personal communications. It also applies requirements for protecting those rights to certain data processors, service providers, and other entities that collect, process, or maintain personal information and transmit it online. The entities covered by the bill must generally permit individuals to oversee and control their personal information, including by allowing them to <ul> <li>access, download, and transmit their information;</li> <li>correct inaccurate or incomplete information;</li> <li>request the deletion of their information; and</li> <li>request human reviews of certain automated processes.</li> </ul> Further, the bill limits how covered entities may use, retain, and disclose personal information and otherwise requires actions to preserve information privacy. For example, covered entities must (1) notify and obtain consent from individuals before using, retaining, or disclosing their information in most instances; and (2) maintain privacy and information security policies. Additionally, covered entities may not process information for purposes related to employment, housing, and other opportunities in a discriminatory manner. The bill establishes the Digital Privacy Agency to administer the provisions of the bill and transfers certain authorities, employees, and responsibilities related to information privacy from the Federal Communications Commission to the agency. Violations of the bill's requirements may be enforced by the Digital Privacy Agency, states, and individuals. The bill sets out specific guidelines for investigating and adjudicating violations, with violations subject to civil penalties. The bill also requires research and public education on information privacy.