SEC. 2. DEFINITIONS. 
In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Securities and Exchange Commission. 
(2) ISSUER.—The term ‘‘issuer’’ has the mean-
ing given the term in section 3(a) of the Securities 
and Exchange Act of 1934 (15 U.S.C. 78c(a)). 
(3) OTHER
DEFINITIONS.—The terms ‘‘com-
mercial data operator’’, ‘‘user’’, and ‘‘user data’’ 
have the meaning given those terms, respectively, 
under section 13(s)(1) of the Securities Exchange 
Act of 1934. 
SEC. 3. COMMERCIAL DATA OPERATORS. 
(a) REQUIREMENTS.— 
(1) IN GENERAL.—A commercial data operator 
shall— 
(A) on a routine basis, and not less fre-
quently than once every 90 days— 
(i) provide each user of the commer-
cial data operator with an assessment of 
the economic value that the commercial 
data operator places on the data of that 
user; and 
(ii) in a clear and conspicuous man-
ner, in accordance with paragraph (3), 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
identify to each user of the commercial 
data operator— 
(I) the types of data collected 
from users of the commercial data op-
erator, whether by the commercial 
data operator or another person pur-
suant to an agreement with the com-
mercial data operator; and 
(II) the ways that the data of a 
user of the commercial data operator 
are used if the use is not directly or 
exclusively related to the online serv-
ice that the commercial data operator 
provides to the user; and 
(B) except as provided in paragraph (2), 
provide a user of the commercial data operator 
with the ability to delete all data, in the aggre-
gate and for an individual field, that the com-
mercial data operator possesses, or maintains 
control or access to with respect to the user, 
through— 
(i) a single setting; or 
(ii) another clear and conspicuous 
mechanism by which the user may make 
such a deletion. 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
(2) DELETION EXCEPTIONS.— 
(A) IN GENERAL.—A commercial data op-
erator shall comply with a user directive to de-
lete, in whole or in part, the data of the user 
except— 
(i) in cases where there is a legal obli-
gation of the commercial data operator to 
maintain the data; 
(ii) for the establishment, exercise, or 
defense of legal claims; or 
(iii) if the data is necessary to detect 
security incidents, protect against mali-
cious, deceptive, fraudulent, or illegal activ-
ity, or assist in the prosecution of those re-
sponsible for such activity. 
(B) RETENTION.—A commercial data op-
erator may not retain any more user data than 
is necessary to carry out an activity described 
in clauses (i) through (iii) of subparagraph (A). 
(3) AVAILABILITY.—A commercial data oper-
ator shall ensure that all disclosures required under 
paragraph (1) are available to a user of the commer-
cial data operator— 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
(A) on and after the date on which the 
commercial data operator makes the identifica-
tion; and 
(B) through any normal mechanism by 
which a user may interact with the online serv-
ice provided by the commercial data operator. 
(4) UNFAIR AND DECEPTIVE ACTS OR PRAC-
TICES.— 
(A) UNFAIR OR DECEPTIVE ACTS OR PRAC-
TICES.—A violation of this subsection shall be 
treated as a violation of a rule defining an un-
fair or deceptive act or practice prescribed 
under section 18(a)(1)(B) of the Federal Trade 
Commission Act (15 U.S.C. 57a(a)(1)(B)). 
(B) POWERS OF FEDERAL TRADE COMMIS-
SION.— 
(i) IN GENERAL.—The Federal Trade 
Commission shall enforce this subsection in 
the same manner, by the same means, and 
with the same jurisdiction, powers, and du-
ties as though all applicable terms and pro-
visions of the Federal Trade Commission 
Act (15 U.S.C. 41 et seq.) were incor-
porated into and made a part of this sub-
section. 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
(ii) PRIVILEGES AND IMMUNITIES.— 
Any person who violates this subsection 
shall be subject to the penalties and enti-
tled to the privileges and immunities pro-
vided in the Federal Trade Commission 
Act (15 U.S.C. 41 et seq.). 
(b) REGULATIONS.—Not later than 1 year after the 
date of enactment of this Act, the Federal Trade Commis-
sion shall promulgate regulations carrying out subsection 
(a). 
SEC. 4. SEC DISCLOSURES. 
(a) IN GENERAL.—Section 13 of the Securities Ex-
change Act of 1934 (15 U.S.C. 78m) is amended by add-
ing at the end the following: 
‘‘(s) DISCLOSURE RELATING TO AGGREGATE VALUE 
OF USER DATA HELD BY COMMERCIAL DATA OPERA-
TORS.— 
‘‘(1) DEFINITIONS.—In this subsection: 
‘‘(A) COMMERCIAL DATA OPERATOR.—The 
term ‘commercial data operator’ means an enti-
ty acting in its capacity as a consumer online 
services provider or data broker that— 
‘‘(i) generates a material amount of 
revenue directly from the use, collection, 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
processing, sale, or sharing of the user 
data; and 
‘‘(ii) has more than 100,000,000 
unique monthly visitors or users in the 
United States for a majority of months 
during the previous 1-year period. 
‘‘(B) USER.—The term ‘user’ means an in-
dividual consumer who uses an online service 
designed for consumer use by a commercial 
data operator. 
‘‘(C) USER DATA.—The term ‘user data’ 
means any information that identifies, relates 
to, describes, is capable of being associated 
with, or could reasonably be linked with an in-
dividual user, whether directly submitted to the 
commercial data operator by the user or derived 
from the observed activity of the user by the 
commercial data operator. 
‘‘(2) DISCLOSURE.—Each issuer that is, or is a 
consolidated subsidiary of, a commercial data oper-
ator and is required to file an annual or quarterly 
report under subsection (a) shall disclose in that re-
port the aggregate value, if material, of— 
‘‘(A) user data that the commercial data 
operator holds; 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(B) contracts with third parties for the 
collection of user data through the online serv-
ice provided by the commercial data operator; 
and 
‘‘(C) any other item that the Commission 
determines, by rule, is necessary or useful for 
the protection of investors and in the public in-
terest. 
‘‘(3) VALUATION METHODOLOGY.— 
‘‘(A) IN GENERAL.—The Commission, in 
consultation with appropriate standards setting 
organizations, shall develop a method or meth-
ods for calculating the value of user data re-
quired to be disclosed under paragraph (2). 
‘‘(B) CONSIDERATIONS.—In developing the 
method under subparagraph (A), the Commis-
sion shall promote comparability in calculating 
the value of data across commercial data opera-
tors that utilize user data in a similar manner 
while taking into account the potential need to 
develop distinct methods for calculating the 
value of data for different uses, sectors, and 
business models.’’. 
(b) QUALITATIVE DISCLOSURE.—Not later than 1 
year after the date of enactment of this subsection, the 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
Commission shall amend section 229.306 of title 17, Code 
of Federal Regulations, to require a commercial data oper-
ator that is an issuer subject to section 13 or 15(d) of 
the Securities Exchange Act of 1934 (15 U.S.C. 78m, 
78o(d)) to provide quantitative and qualitative disclosures 
about the value of user data held, including— 
(1) technical and legal measures in place to 
protect user data held by the commercial data oper-
ator; 
(2) an assessment of financial and legal risks 
associated with storing the type and quantity of user 
data held by the commercial data operator; 
(3) each source of user data held by the com-
mercial data operator, whether by sale, a direct con-
sumer relationship, an indirect consumer relation-
ship, or other means; 
(4) each discrete revenue generating operation 
of the commercial data operator and any subsidiary 
or affiliate that relies on user data; 
(5) the entry into any contract valued at more 
than $10,000,000 with a third party for the collec-
tion, licensing, or sharing by the third party pursu-
ant to an agreement with the commercial data oper-
ator; 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
(6) the amount of revenue derived from obtain-
ing, collecting, processing, selling, using or sharing 
user data during the reporting period; 
(7) how changes in the measurement of aggre-
gate fair value of user data affect the reported per-
formance and cash flows of the issuer; and 
(8) any acquisition of user data in the pre-
ceding reporting period valued at more than 
$100,000,000. 
(c) REPORT.— 
(1) IN GENERAL.—Not later than 3 years after 
the date of enactment of this Act, the Commission 
shall submit to the Committee on Banking, Housing, 
and Urban Affairs of the Senate and the Committee 
on Financial Services of the House of Representa-
tives a report on— 
(A) the nature, timing, and extent of the 
disclosure practices of commercial data opera-
tors; 
(B) an assessment of the valuation meth-
odologies and practices employed by commercial 
data operators in developing and submitting 
disclosures to the public; 
(C) an evaluation of the methods of deliv-
ery and presentation of the disclosures required 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS
by this Act, and the amendments made by this 
Act; and 
(D) recommendations for the improvement 
of the methods described in subparagraph (C), 
including developing standards to enhance com-
parability and utility for investors. 
(2) RULEMAKING.—Not later than 180 days 
after the date on which the report required under 
paragraph (1) is submitted, the Commission shall 
promulgate a proposed regulation implementing the 
recommendations described in paragraph (1)(D). 
Æ 
VerDate Sep 11 2014 
03:08 Jul 18, 2025
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6301
E:\BILLS\H4402.IH
H4402
ssavage on LAPJG3WLY3PROD with BILLS