Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘American Data Privacy and Protection Act’’. 
(b) TABLE OF CONTENTS.—The table of contents of this 
Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Definitions. 
TITLE I—DUTY OF LOYALTY 
Sec. 101. Data minimization. 
Sec. 102. Loyalty duties. 
Sec. 103. Privacy by design. 
Sec. 104. Loyalty to individuals with respect to pricing. 
TITLE II—CONSUMER DATA RIGHTS 
Sec. 201. Consumer awareness. 
Sec. 202. Transparency. 
Sec. 203. Individual data ownership and control. 
Sec. 204. Right to consent and object. 
Sec. 205. Data protections for children and minors. 
Sec. 206. Third-party collecting entities. 
Sec. 207. Civil rights and algorithms. 
Sec. 208. Data security and protection of covered data. 
Sec. 209. Small business protections. 
Sec. 210. Unified opt-out mechanisms. 
TITLE III—CORPORATE ACCOUNTABILITY 
Sec. 301. Executive responsibility. 
Sec. 302. Service providers and third parties. 
Sec. 303. Technical compliance programs. 
Sec. 304. Commission approved compliance guidelines. 
Sec. 305. Digital content forgeries. 
TITLE IV—ENFORCEMENT, APPLICABILITY, AND MISCELLANEOUS 
Sec. 401. Enforcement by the Federal Trade Commission. 
Sec. 402. Enforcement by States. 
Sec. 403. Enforcement by persons. 
Sec. 404. Relationship to Federal and State laws. 
Sec. 405. Severability. 
Sec. 406. COPPA. 
Sec. 407. Authorization of appropriations. 
Sec. 408. Effective date. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6213
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
SEC. 2. DEFINITIONS. 
In this Act: 
(1) AFFIRMATIVE EXPRESS CONSENT.— 
(A) IN
GENERAL.—The term ‘‘affirmative 
express consent’’ means an affirmative act by an 
individual that clearly communicates the indi-
vidual’s freely given, specific, and unambiguous 
authorization for an act or practice after having 
been informed, in response to a specific request 
from a covered entity that meets the require-
ments of subparagraph (B). 
(B) REQUEST
REQUIREMENTS.—The re-
quirements of this subparagraph with respect to 
a request from a covered entity to an individual 
are the following: 
(i) The request is provided to the indi-
vidual in a clear and conspicuous stand-
alone disclosure made through the primary 
medium used to offer the covered entity’s 
product or service, or only if the product or 
service is not offered in a medium that per-
mits the making of the request under this 
paragraph, another medium regularly used 
in conjunction with the covered entity’s 
product or service. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(ii) The request includes a description 
of the processing purpose for which the indi-
vidual’s consent is sought and— 
(I) clearly states the specific cat-
egories of covered data that the covered 
entity shall collect, process, and trans-
fer necessary to effectuate the proc-
essing purpose; and 
(II) includes a prominent heading 
and is written in easy-to-understand 
language that would enable a reason-
able individual to identify and under-
stand the processing purpose for which 
consent is sought and the covered data 
to be collected, processed, or transferred 
by the covered entity for such proc-
essing purpose. 
(iii) The request clearly explains the 
individual’s applicable rights related to con-
sent. 
(iv) The request is made in a manner 
reasonably accessible to and usable by indi-
viduals with disabilities. 
(v) The request is made available to the 
individual in each covered language in 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
which the covered entity provides a product 
or service for which authorization is sought. 
(vi) The option to refuse consent shall 
be at least as prominent as the option to ac-
cept, and the option to refuse consent shall 
take the same number of steps or fewer as 
the option to accept. 
(vii) Processing or transferring any 
covered data collected pursuant to affirma-
tive express consent for a different proc-
essing purpose than that for which affirma-
tive express consent was obtained shall re-
quire affirmative express consent for the 
subsequent processing purpose. 
(C) EXPRESS CONSENT REQUIRED.—A cov-
ered entity may not infer that an individual has 
provided affirmative express consent to an act or 
practice from the inaction of the individual or 
the individual’s continued use of a service or 
product provided by the covered entity. 
(D) PRETEXTUAL CONSENT PROHIBITED.— 
A covered entity may not obtain or attempt to 
obtain the affirmative express consent of an indi-
vidual through— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(i) the use of any false, fictitious, 
fraudulent, or materially misleading state-
ment or representation; or 
(ii) the design, modification, or ma-
nipulation of any user interface with the 
purpose or substantial effect of obscuring, 
subverting, or impairing a reasonable indi-
vidual’s autonomy, decision making, or 
choice to provide such consent or any cov-
ered data. 
(2) AUTHENTICATION.—The term ‘‘authentica-
tion’’ means the process of verifying an individual or 
entity for security purposes. 
(3) BIOMETRIC INFORMATION.— 
(A) IN GENERAL.—The term ‘‘biometric in-
formation’’ means any covered data generated 
from the technological processing of an individ-
ual’s unique biological, physical, or physiological 
characteristics that is linked or reasonably 
linkable to an individual, including— 
(i) fingerprints; 
(ii) voice prints; 
(iii) iris or retina scans; 
(iv) facial or hand mapping, geometry, 
or templates; or 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(v) gait or personally identifying phys-
ical movements. 
(B) EXCLUSION.—The term ‘‘biometric in-
formation’’ does not include— 
(i) a digital or physical photograph; 
(ii) an audio or video recording; or 
(iii) data generated from a digital or 
physical photograph, or an audio or video 
recording, that cannot be used to identify 
an individual. 
(4) COLLECT; COLLECTION.—The terms ‘‘collect’’ 
and ‘‘collection’’ mean buying, renting, gathering, ob-
taining, receiving, accessing, or otherwise acquiring 
covered data by any means. 
(5) 
COMMISSION.—The 
term 
‘‘Commission’’ 
means the Federal Trade Commission. 
(6) CONTROL.—The term ‘‘control’’ means, with 
respect to an entity— 
(A) ownership of, or the power to vote, more 
than 50 percent of the outstanding shares of any 
class of voting security of the entity; 
(B) control over the election of a majority 
of the directors of the entity (or of individuals 
exercising similar functions); or 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(C) the power to exercise a controlling influ-
ence over the management of the entity. 
(7) COVERED ALGORITHM.—The term ‘‘covered 
algorithm’’ means a computational process that uses 
machine learning, natural language processing, arti-
ficial intelligence techniques, or other computational 
processing techniques of similar or greater complexity 
and that makes a decision or facilitates human deci-
sion-making with respect to covered data, including 
to determine the provision of products or services or 
to rank, order, promote, recommend, amplify, or 
similarly determine the delivery or display of infor-
mation to an individual. 
(8) COVERED DATA.— 
(A) IN GENERAL.—The term ‘‘covered data’’ 
means information that identifies or is linked or 
reasonably linkable, alone or in combination 
with other information, to an individual or a de-
vice that identifies or is linked or reasonably 
linkable to an individual, and may include de-
rived data and unique persistent identifiers. 
(B) EXCLUSIONS.—The term ‘‘covered data’’ 
does not include— 
(i) de-identified data; 
(ii) employee data; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(iii) publicly available information; or 
(iv) inferences made exclusively from 
multiple independent sources of publicly 
available information that do not reveal 
sensitive covered data with respect to an in-
dividual. 
(C) EMPLOYEE DATA DEFINED.—For pur-
poses of subparagraph (B), the term ‘‘employee 
data’’ means— 
(i) information relating to a job appli-
cant collected by a covered entity acting as 
a prospective employer of such job applicant 
in the course of the application, or hiring 
process, if such information is collected, 
processed, or transferred by the prospective 
employer solely for purposes related to the 
employee’s status as a current or former job 
applicant of such employer; 
(ii) information processed by an em-
ployer relating to an employee who is act-
ing in a professional capacity for the em-
ployer, provided that such information is 
collected, processed, or transferred solely for 
purposes related to such employee’s profes-
sional activities on behalf of the employer; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(iii) the business contact information 
of an employee, including the employee’s 
name, position or title, business telephone 
number, business address, or business email 
address that is provided to an employer by 
an employee who is acting in a professional 
capacity, if such information is collected, 
processed, or transferred solely for purposes 
related to such employee’s professional ac-
tivities on behalf of the employer; 
(iv) emergency contact information col-
lected by an employer that relates to an em-
ployee of that employer, if such information 
is collected, processed, or transferred solely 
for the purpose of having an emergency con-
tact on file for the employee and for proc-
essing or transferring such information in 
case of an emergency; or 
(v) information relating to an em-
ployee (or a spouse, dependent, other covered 
family member, or beneficiary of such em-
ployee) that is necessary for the employer to 
collect, process, or transfer solely for the 
purpose of administering benefits to which 
such employee (or spouse, dependent, other 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
covered family member, or beneficiary of 
such employee) is entitled on the basis of the 
employee’s position with that employer. 
(9) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered enti-
ty’’— 
(i) means any entity or any person, 
other than an individual acting in a non- 
commercial context, that alone or jointly 
with others determines the purposes and 
means of collecting, processing, or transfer-
ring covered data and— 
(I) is subject to the Federal Trade 
Commission Act (15 U.S.C. 41 et seq.); 
(II) is a common carrier subject 
to the Communications Act of 1934 (47 
U.S.C. 151 et seq.) and all Acts 
amendatory thereof and supplementary 
thereto; or 
(III) is an organization not orga-
nized to carry on business for its own 
profit or that of its members; and 
(ii) includes any entity or person that 
controls, is controlled by, or is under com-
mon control with the covered entity. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(B) EXCLUSIONS.—The term ‘‘covered enti-
ty’’ does not include— 
(i) a Federal, State, Tribal, territorial, 
or local government entity such as a body, 
authority, board, bureau, commission, dis-
trict, agency, or political subdivision of the 
Federal Government or a State, Tribal, ter-
ritorial, or local government; 
(ii) a person or an entity that is col-
lecting, processing, or transferring covered 
data on behalf of a Federal, State, Tribal, 
territorial, or local government entity, in so 
far as such person or entity is acting as a 
service provider to the government entity; or 
(iii) an entity that serves as a congres-
sionally designated nonprofit, national re-
source center, and clearinghouse to provide 
assistance to victims, families, child-serving 
professionals, and the general public on 
missing and exploited children issues. 
(C) NON-APPLICATION
TO
SERVICE
PRO-
VIDERS.—An entity shall not be considered to be 
a covered entity for purposes of this Act in so far 
as the entity is acting as a service provider (as 
defined in paragraph (29)). 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(10) COVERED LANGUAGE.—The term ‘‘covered 
language’’ means the ten languages with the most 
users in the United States, according to the most re-
cent United States Census. 
(11) COVERED
MINOR.—The term ‘‘covered 
minor’’ means an individual under the age of 17. 
(12) DE-IDENTIFIED DATA.—The term ‘‘de-iden-
tified data’’ means information that does not identify 
and is not linked or reasonably linkable to a distinct 
individual or a device, regardless of whether the infor-
mation is aggregated, and if the covered entity or 
service provider— 
(A) takes reasonable technical measures to 
ensure that the information cannot, at any 
point, be used to re-identify any individual or 
device that identifies or is linked or reasonably 
linkable to an individual; 
(B) publicly commits in a clear and con-
spicuous manner— 
(i) to process and transfer the informa-
tion solely in a de-identified form without 
any reasonable means for re-identification; 
and 
(ii) to not attempt to re-identify the 
information with any individual or device 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS