II 

117TH CONGRESS 

2D SESSION S. 3627 

To establish a centralized system to allow individuals to request the simultaneous deletion of their personal information across all data brokers, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

FEBRUARY 10, 2022 

Mr. CASSIDY (for himself and Mr. OSSOFF) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To establish a centralized system to allow individuals to 

request the simultaneous deletion of their personal information across all data brokers, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Data Elimination and 

5 Limiting Extensive Tracking and Exchange Act’’ or the 

6 ‘‘DELETE Act’’. 

7 SEC. 2. DATA DELETION REQUIREMENTS. 

8 (a) DATA BROKER ANNUAL REGISTRATION.— 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 3627 IS

1 (1) IN GENERAL.—Not later than 1 year after 

2 the date of enactment of this section, the Commis3 sion shall promulgate regulations to require any data 

4 broker to— 

5 (A) not later than 18 months after the 

6 date of enactment of this section, and annually 

7 thereafter, register with the Commission; and 

8 (B) provide the following information with 

9 such registration: 

10 (i) The name and primary physical, 

11 email, and uniform resource locator (URL) 

12 addresses of the data broker. 

13 (ii) If the data broker permits an indi14 vidual to opt out of the data broker’s col15 lection or use of personal information, cer16 tain sales of such information, or its data17 bases— 

18 (I) the method for requesting an 

19 opt-out; 

20 (II) any limitations on the type 

21 of data collection, uses, or sales for 

22 which an individual may opt out; and 

23 (III) whether the data broker 

24 permits an individual to authorize a 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 3627 IS

1 third party to perform the opt-out on 

2 the individual’s behalf. 

3 (iii) A response to a standardized 

4 form (as issued by the Commission) speci5 fying the types of information the data 

6 broker collects or obtains and the sources 

7 from which the data broker obtains data. 

8 (iv) A statement as to whether the 

9 data broker implements a credentialing 

10 process and, if so, a description of that 

11 process. 

12 (v) Any additional information or ex13 planation the data broker chooses to pro14 vide concerning its data collection prac15 tices. 

16 (vi) Any other information determined 

17 appropriate by the Commission. 

18 (2) PUBLIC AVAILABILITY.— 

19 (A) IN GENERAL.—The Commission shall 

20 make the information described in paragraph 

21 (1) publicly available in a downloadable and 

22 machine-readable format, except in the event 

23 that the Commission— 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 3627 IS

1 (i) determines that the risk of making 

2 such information available is not in the in3 terest of public safety or welfare; and 

4 (ii) provides a justification for such 

5 determination. 

6 (B) DISCLAIMER.—The Commission shall 

7 include on the website of the Commission a dis8 claimer that— 

9 (i) the Commission cannot confirm 

10 the accuracy of the responses provided by 

11 the data brokers in the registration de12 scribed in paragraph (1); and 

13 (ii) individuals may contact such data 

14 brokers at their own risk. 

15 (b) CENTRALIZED DATA DELETION SYSTEM.— 

16 (1) ESTABLISHMENT.— 

17 (A) IN GENERAL.—Not later than 1 year 

18 after the date of enactment of this section, the 

19 Commission shall promulgate regulations to es20 tablish a centralized system that— 

21 (i) implements and maintains reason22 able security procedures and practices (in23 cluding administrative, physical, and tech24 nical safeguards) appropriate to the nature 

25 of the information and the purposes for 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 3627 IS

1 which the personal information will be 

2 used, to protect individuals’ personal infor3 mation from unauthorized use, disclosure, 

4 access, destruction, or modification; and 

5 (ii) allows an individual, through a 

6 single submission, to request that every 

7 data broker who is registered under sub8 section (a) and who maintains any per9 sistent identifiers (as described in subpara10 graph (B)(iii)) delete any personal infor11 mation related to such individual held by 

12 such data broker or affiliated legal entity 

13 of the data broker. 

14 (B) REQUIREMENTS.—The centralized sys15 tem established in subparagraph (A) shall meet 

16 the following requirements: 

17 (i) Subject to the regulations promul18 gated in accordance with paragraph 

19 (2)(B)(ii), the centralized system shall 

20 allow an individual to request the deletion 

21 of all personal information related to such 

22 individual through a single deletion re23 quest. 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 3627 IS

1 (ii) The centralized system shall pro2 vide a standardized form to allow an indi3 vidual to make such request. 

4 (iii) Such standardized form shall in5 clude the individual’s email, phone number, 

6 physical address, and any other persistent 

7 identifier determined by the Commission to 

8 aid in the deletion request. 

9 (iv) The centralized system shall auto10 matically hash all submitted information 

11 and allow the Commission to maintain 

12 independent hashed registries of each type 

13 of information obtained through such form. 

14 (v) The centralized system shall only 

15 permit data brokers who are registered 

16 with the Commission to submit hashed 

17 queries to the independent hashed reg18 istries described in clause (iv). 

19 (vi) The centralized system shall allow 

20 an individual to make such request using 

21 an internet website operated by the Com22 mission. 

23 (vii) The centralized system shall not 

24 charge the individual to make such re25 quest. 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 3627 IS

1 (viii) The centralized system shall 

2 automatically delete any individual data 

3 field stored in the system once such data 

4 field has been stored in the centralized sys5 tem for 2 years. The Commission shall in6 form the individual of this automatic dele7 tion period when the individual makes a 

8 deletion request. Beginning 4 years after 

9 the date of enactment of this Act, the 

10 Commission may promulgate rules to ad11 just such retention period or enable auto12 matic renewal of requests if it determines 

13 that such adjustment or automatic renewal 

14 would better protect individual privacy or 

15 the public interest. 

16 (C) TRANSITION.— 

17 (i) IN GENERAL.—Not later than 8 

18 months after the effective date of the regu19 lations promulgated under subparagraph 

20 (A), each data broker shall— 

21 (I) not less than once every 31 

22 days, access the hashed registries 

23 maintained by the Commission as de24 scribed in subparagraph (B)(iv); and 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 3627 IS

1 (II) process any deletion request 

2 associated with a match between such 

3 hashed registries and the records of 

4 the data broker. 

5 (ii) FTC GUIDANCE.—Not later than 

6 6 months after the effective date of the 

7 regulations promulgated under subpara8 graph (A), the Commission shall publish 

9 guidance on the process and standards to 

10 which a data broker must adhere in car11 rying out clause (i). 

12 (2) DELETION.— 

13 (A) INFORMATION DELETION.— 

14 (i) IN GENERAL.—Subject to clause 

15 (ii), not later than 31 days after accessing 

16 the hashed registries described in para17 graph (1)(B)(iv), a data broker and any 

18 associated legal entity shall delete all per19 sonal information in its possession related 

20 to the individual making the request. Im21 mediately following the deletion, the data 

22 broker shall send an affirmative represen23 tation to the Commission with the number 

24 of records deleted pursuant to each match 

25 with a value in the hashed registries. 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 3627 IS

1 (ii) EXCLUSIONS.—In carrying out 

2 clause (i), a data broker may retain, where 

3 required, the following information: 

4 (I) Any personal information that 

5 is processed or maintained solely as 

6 part of human subjects research con7 ducted in compliance with any legal 

8 requirements for the protection of 

9 human subjects. 

10 (II) Any personal information 

11 necessary to comply with a warrant, 

12 subpoena, court order, rule, or other 

13 applicable law. 

14 (III) Any personal information 

15 related to the suppression list de16 scribed in subparagraph (B)(ii). 

17 (IV) Any information necessary 

18 for an activity described in subsection 

19 (e)(3)(B), provided that the retained 

20 information is used solely for any 

21 such activity. 

22 (iii) USE OF INFORMATION.—Any per23 sonal information excluded under clause 

24 (ii) may only be used for the purpose de25 scribed in the applicable subclause of 


kjohnson on DSK79L0C42PROD with BILLS
10 

•S 3627 IS

1 clause (ii), and may not be used for any 

2 other purpose, including marketing pur3 poses. 

4 (B) DO NOT TRACK LIST; SUPPRESSION

5 LIST.— 

6 (i) DO NOT TRACK LIST.—Not later 

7 than 18 months after the date of enact8 ment of this section, the Commission shall 

9 promulgate regulations to prohibit any 

10 data broker registered under subsection (a) 

11 from collecting or retaining personal infor12 mation on any individual who has sub13 mitted a deletion request through the cen14 tralized system established in paragraph 

15 (1)(A), unless such data collection is re16 quested by the individual. 

17 (ii) SUPPRESSION LIST.—Not later 

18 than 18 months after the date of enact19 ment of this section, the Commission shall 

20 promulgate regulations to ensure that— 

21 (I) any individual who submits a 

22 deletion request through the central23 ized system established in paragraph 

24 (1) shall be included on the Do Not 

25 Track list described in clause (i); and 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 3627 IS

1 (II) each data broker registered 

2 under subsection (a)— 

3 (aa) may not collect or re4 tain more personal information 

5 than is necessary to identify an 

6 individual who is included on the 

7 Do Not Track list; and 

8 (bb) in the case that unnec9 essary personal information is 

10 collected or retained, shall imme11 diately delete any personal infor12 mation not required to comply 

13 with the regulations promulgated 

14 under this subparagraph. 

15 (C) ANNUAL REPORT.—Each data broker 

16 registered under subsection (a) shall submit to 

17 the Commission, on an annual basis, a report 

18 on— 

19 (i) the completion rate with respect to 

20 the completion of deletion requests under 

21 subparagraph (A); and 

22 (ii) the effectiveness of the suppres23 sion list under subparagraph (B)(ii), in24 cluding— 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 3627 IS

1 (I) the number of times the data 

2 broker collected personal information 

3 related to an individual included on 

4 the suppression list; 

5 (II) the number of times the data 

6 broker collected data resulting in a 

7 match with the hashed registries 

8 maintained by the Commission as de9 scribed in paragraph (1)(B)(iv); and 

10 (III) whether the regulations pro11 mulgated under subparagraph (B) 

12 and the structure or format of the 

13 hashed registries promote efficient 

14 comparison of the suppression list 

15 with information collected or retained 

16 by the data broker. 

17 (D) AUDIT.— 

18 (i) IN GENERAL.—Not later than 3 

19 years after the date of enactment of this 

20 section, and every 3 years thereafter, each 

21 data broker registered under subsection (a) 

22 shall undergo an independent third party 

23 audit to determine compliance with this 

24 subsection. 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 3627 IS

1 (ii) AUDIT REPORT.—Not later than 6 

2 months after the completion of any audit 

3 under clause (i), each such data broker 

4 shall submit to the Commission any report 

5 produced as a result of the audit, along 

6 with any related materials. 

7 (iii) MAINTAIN RECORDS.—Each such 

8 data broker shall maintain the materials 

9 described in clause (ii) for a period of not 

10 less than 6 years. 

11 (3) ANNUAL FEE.— 

12 (A) IN GENERAL.—Subject to subpara13 graph (B), each data broker registered under 

14 subsection (a) and who maintains any per15 sistent identifiers (as described in paragraph 

16 (1)(B)(iii)) shall pay to the Commission, on an 

17 annual basis, a subscription fee determined by 

18 the Commission to access the database. 

19 (B) LIMIT.—The amount of the subscrip20 tion fee under subparagraph (A) may not ex21 ceed 1 percent of the expected annual cost of 

22 operating the centralized system and hashed 

23 registries described in paragraph (1), as deter24 mined by the Commission. 


kjohnson on DSK79L0C42PROD with BILLS
14 

•S 3627 IS

1 (C) AVAILABILITY.—Any amounts col2 lected by the Commission pursuant to this 

3 paragraph shall be available without further ap4 propriation to the Commission for the purpose 

5 of enforcing and administering this Act, includ6 ing the implementation and maintenance of 

7 such centralized system and hashed registries 

8 and the promotion of public awareness of the 

9 centralized system. 

10 (c) ENFORCEMENT BY THE COMMISSION.— 

11 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC12 TICES.—A violation of subsection (a) or (b) or a reg13 ulation promulgated under this Act shall be treated 

14 as a violation of a rule defining an unfair or decep15 tive act or practice under section 18(a)(1)(B) of the 

16 Federal Trade Commission Act (15 U.S.C. 

17 57a(a)(1)(B)). 

18 (2) POWERS OF THE COMMISSION.— 

19 (A) IN GENERAL.—The Commission shall 

20 enforce this section in the same manner, by the 

21 same means, and with the same jurisdiction, 

22 powers, and duties as though all applicable 

23 terms and provisions of the Federal Trade 

24 Commission Act (15 U.S.C. 41 et seq.) were in25 corporated into and made a part of this Act. 


kjohnson on DSK79L0C42PROD with BILLS
15 

•S 3627 IS

1 (B) PRIVILEGES AND IMMUNITIES.—Any 

2 person who violates subsection (a) or (b) or a 

3 regulation promulgated under this Act shall be 

4 subject to the penalties and entitled to the 

5 privileges and immunities provided in the Fed6 eral Trade Commission Act (15 U.S.C. 41 et 

7 seq.). 

8 (C) AUTHORITY PRESERVED.—Nothing in 

9 this section shall be construed to limit the au10 thority of the Commission under any other pro11 vision of law. 

12 (D) RULEMAKING.—The Commission shall 

13 promulgate in accordance with section 553 of 

14 title 5, United States Code, such rules as may 

15 be necessary to carry out this section. 

16 (d) STUDY AND REPORT.— 

17 (1) STUDY.—The Commission shall conduct a 

18 study on the implementation and enforcement of this 

19 section. Such study shall include— 

20 (A) an analysis of the effectiveness of the 

21 centralized system established in subsection 

22 (b)(1)(A); 

23 (B) the number deletion requests sub24 mitted annually using such centralized system; 


kjohnson on DSK79L0C42PROD with BILLS
16 

•S 3627 IS

1 (C) an analysis of the progress of coordi2 nating the operation and enforcement of such 

3 requests with similar systems established and 

4 maintained by the various States; and 

5 (D) any other area determined appropriate 

6 by the Commission. 

7 (2) REPORT.—Not later than 3 years after the 

8 date of enactment of this section, and annually 

9 thereafter for each of the next 4 years, the Commis10 sion shall submit to the Committee on Commerce, 

11 Science, and Transportation of the Senate and the 

12 Committee on Energy and Commerce of the House 

13 of Representatives a report containing— 

14 (A) the results of the study conducted 

15 under paragraph (1); 

16 (B) a summary of any enforcement actions 

17 taken pursuant to this Act; and 

18 (C) recommendations for such legislation 

19 and administrative action as the Commission 

20 determines appropriate. 

21 (e) DEFINITIONS.—In this section: 

22 (1) COMMISSION.—The term ‘‘Commission’’ 

23 means the Federal Trade Commission. 


kjohnson on DSK79L0C42PROD with BILLS
17 

•S 3627 IS

1 (2) CREDENTIALING PROCESS.—The term 

2 ‘‘credentialing process’’ means the practice of taking 

3 reasonable steps to confirm— 

4 (A) the identity of the entity with whom 

5 the data broker has a direct relationship; 

6 (B) that any data disclosed to the entity 

7 by such data broker will be used for the de8 scribed purpose of such disclosure; and 

9 (C) that such data will not be used for un10 lawful purposes. 

11 (3) DATA BROKER.— 

12 (A) IN GENERAL.—The term ‘‘data 

13 broker’’ means an entity that knowingly collects 

14 or obtains the personal information of an indi15 vidual with whom the entity does not have a di16 rect relationship and then— 

17 (i) uses the personal information to 

18 perform a service for a third party; or 

19 (ii) sells, licenses, trades, provides for 

20 consideration, or is otherwise compensated 

21 for disclosing personal information to a 

22 third party. 

23 (B) EXCLUSION.—The term ‘‘data broker’’ 

24 does not include an entity who solely uses, sells, 

25 licenses, trades, provides for consideration, or is 


kjohnson on DSK79L0C42PROD with BILLS
18 

•S 3627 IS

1 otherwise compensated for disclosing personal 

2 information for one or more of the following ac3 tivities: 

4 (i) Providing 411 directory assistance 

5 or directory information services, including 

6 name, address, and telephone number, on 

7 behalf of or as a function of a tele8 communications carrier. 

9 (ii) Providing an individual’s publicly 

10 available information if the information is 

11 being used by the recipient as it relates to 

12 that individual’s business or profession. 

13 (iii) Providing or using personal infor14 mation in a manner that is regulated 

15 under another Federal or State law, in16 cluding the Fair Credit Reporting Act, the 

17 Gramm-Leach-Bliley Act, or the Health 

18 Insurance Portability and Accountability 

19 Act. 

20 (iv) Providing personal information to 

21 a third party at the express direction of 

22 the individual for a clearly disclosed single23 use purpose. 

24 (v) Providing or using personal infor25 mation for assessing, verifying, or authenVerDate Sep 11 2014 04:43 Feb 12, 2022 Jkt 029200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S3627.IS S3627

kjohnson on DSK79L0C42PROD with BILLS
19 

•S 3627 IS

1 ticating an individual’s identity, or for in2 vestigating or preventing actual or poten3 tial fraud. 

4 (vi) Gathering, preparing, collecting, 

5 photographing, recording, writing, editing, 

6 reporting, or publishing news or informa7 tion that concerns local, national, or inter8 national events or other matters of public 

9 interest for dissemination to the public. 

10 (C) EXCLUSION FROM SALE.— 

11 (i) IN GENERAL.—For purposes of 

12 this paragraph, the term ‘‘sells’’ does not 

13 include a one-time or occasional sale of as14 sets of an entity as part of a transfer of 

15 control of those assets that is not part of 

16 the ordinary conduct of the entity. 

17 (ii) NOTICE REQUIRED.—To meet the 

18 exclusion criteria described in clause (i), an 

19 entity must provide notice to the Commis20 sion, in the manner determined appro21 priate by the Commission, of any such one22 time or occasional sale of assets. 

23 (4) DELETE.—The term ‘‘delete’’ means to re24 move or destroy information such that the informa25 tion is not maintained in human- or machine-readVerDate Sep 11 2014 04:43 Feb 12, 2022 Jkt 029200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\S3627.IS S3627

kjohnson on DSK79L0C42PROD with BILLS
20 

•S 3627 IS

1 able form and cannot be retrieved or utilized in such 

2 form in the normal course of business. 

3 (5) DIRECT RELATIONSHIP.— 

4 (A) IN GENERAL.—The term ‘‘direct rela5 tionship’’ means a relationship between an indi6 vidual and an entity where the individual— 

7 (i) is a current customer; 

8 (ii) has obtained a good or service 

9 from the entity within the prior 18 

10 months; or 

11 (iii) has made an inquiry about the 

12 products or services of the entity within 

13 the prior 90 days. 

14 (B) EXCLUSION.—The term ‘‘direct rela15 tionship’’ does not include a relationship be16 tween an individual and a data broker where 

17 the individual’s only connection to the data 

18 broker is based on the individual’s request— 

19 (i) for the data broker to delete the 

20 personal information of the individual; or 

21 (ii) to opt out of the data broker’s col22 lection or use of personal information, cer23 tain sales of such information, or its data24 bases. 


kjohnson on DSK79L0C42PROD with BILLS
21 

•S 3627 IS

1 (6) HASH.—The term ‘‘hash’’ means to input 

2 data to a cryptographic, one-way, collision resistant 

3 function that maps a bit string of arbitrary length 

4 to a fixed-length bit string to produce a cryp5 tographically secure value. 

6 (7) HASHED.—The term ‘‘hashed’’ means the 

7 type of value produced by hashing data. 

8 (8) HUMAN SUBJECTS RESEARCH.—The term 

9 ‘‘human subjects research’’ means research that— 

10 (A) an investigator (whether professional 

11 or student) conducts on a living individual; and 

12 (B) either— 

13 (i) obtains information or biospeci14 mens through intervention or interaction 

15 with the individual, and uses, studies, or 

16 analyzes the information or biospecimens; 

17 or 

18 (ii) obtains, uses, studies, analyzes, or 

19 generates personal information or identifi20 able biospecimens. 

21 (9) PERSONAL INFORMATION.— 

22 (A) IN GENERAL.—The term ‘‘personal in23 formation’’ means any information held by a 

24 data broker, regardless of how the information 

25 is collected, inferred, created, or obtained, that 


kjohnson on DSK79L0C42PROD with BILLS
22 

•S 3627 IS

1 is linked or reasonably linkable by the data 

2 broker to a particular individual or consumer 

3 device, including the following information: 

4 (i) Financial information, including 

5 any bank account number, credit card 

6 number, debit card number, or insurance 

7 policy number. 

8 (ii) A name, alias, home or other 

9 physical address, online identifier, Internet 

10 Protocol address, email address, account 

11 name, State identification card number, 

12 driver’s license number, passport number, 

13 or an identifying number on a government14 issued identification. 

15 (iii) Geolocation information. 

16 (iv) Biometric information. 

17 (v) The contents of, attachments to, 

18 or parties to information, including with 

19 respect to email, text messages, picture 

20 messages, voicemails, audio conversations, 

21 or video conversations. 

22 (vi) Web browsing history, including 

23 any search query. 

24 (vii) Genetic sequencing information. 


kjohnson on DSK79L0C42PROD with BILLS
23 

•S 3627 IS

1 (viii) A device identifier, online identi2 fier, persistent identifier, or digital 

3 fingerprinting information. 

4 (ix) Any inference drawn from any of 

5 the information described in this para6 graph that is used to create a profile about 

7 an individual that reflects such individual’s 

8 preferences, characteristics, psychological 

9 trends, predispositions, behavior, attitudes, 

10 intelligence, abilities, or aptitudes. 

11 (x) Any other information determined 

12 appropriate by the Commission. 

13 (B) LINKED OR REASONABLY LINKABLE.— 

14 For purposes of subparagraph (A), information 

15 is ‘‘linked or reasonably linkable’’ to a par16 ticular individual or consumer device if the in17 formation can be used on its own or in com18 bination with other information held by or read19 ily accessible to a data broker to identify a par20 ticular individual or consumer device. 

21 (10) PROCESS.—The term ‘‘process’’ means to 

22 perform or direct the performance of an operation 

23 on personal information, including the collection, 

24 transmission, use, disclosure, analysis, prediction, or 


kjohnson on DSK79L0C42PROD with BILLS
24 

•S 3627 IS

1 modification of such personal information, whether 

2 or not by automated means. 

3 (11) UNIFORM RESOURCE LOCATOR; URL.—The 

4 term ‘‘uniform resource locator’’ or ‘‘URL’’ means a 

5 short string containing an address that refers to an 

6 object on the web. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS