The Consumer Data Privacy and Security Act of 2026 is a comprehensive federal law that gives Americans more control over their personal information and requires companies to be transparent about how they collect and use data. The law applies to most businesses, telecommunications companies, and nonprofits that collect personal information from consumers.

Under this law, companies generally need your permission before collecting or using your personal data. For sensitive information like Social Security numbers, health records, financial account details, biometric data (like fingerprints), precise location information, or details about your race, religion, or sexual orientation, companies must get your explicit, clear consent—simply not objecting isn't enough. For other types of personal data, companies can assume you've agreed if you don't decline after being given notice. You have the right to withdraw your consent at any time, and companies must make this easy to do.

The law includes some exceptions where companies don't need your permission, such as when they need your data to complete a transaction you requested, comply with the law, prevent fraud or security threats, or conduct research for public benefit. Companies must keep your personal information secure, delete it when you ask, and be honest about what they're doing with it. The Federal Trade Commission will enforce these rules and can impose penalties on companies that violate them.