I 
118TH CONGRESS 
1ST SESSION H. R. 3045 
To affirm user ownership of their data, prohibit entities from requiring 
the transfer or monetization of private data in exchange for services, 
prohibit the collection of third-party contact information without written 
consent, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 2, 2023 
Mr. CLOUD introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To affirm user ownership of their data, prohibit entities 
from requiring the transfer or monetization of private 
data in exchange for services, prohibit the collection of 
third-party contact information without written consent, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘You Own the Data 
Act’’ or ‘‘YODA’’. 
SEC. 2. FINDINGS. 
Congress finds the following: 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
(1) Governments exist to protect individual 
rights to life, liberty, and property. 
(2) The protection of civil liberties, including 
the rights to private property and privacy from un-
warranted searches and seizures, is one of the hall-
marks of a free society. 
(3) It is appropriate for Congress to enact laws 
to protect individuals from data collection by third 
parties. 
(4) Data is the property of the user, as the user 
creates the data. 
(5) A user maintains ownership of the data of 
such user, even when such data is sold or leased 
with the consent of such user. 
(6) Technology should empower the individual 
and the productivity of the individual. 
(7) Individuals should have reasonable access to 
and use of popularly available consumer technologies 
without abdicating the rights of such individuals to 
privacy and anonymity. 
SEC. 3. PROHIBITION ON SHARING USER CONTACTS WITH-
OUT WRITTEN CONSENT AND CLARIFYING 
USER ACCESS TO DATA. 
(a) PROHIBITION ON ACCESS TO USER CONTACTS.— 
It shall be unlawful for a covered entity to ask a user to 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
share the contacts or information about the contacts of 
the user unless the user and the contacts of the user con-
sent to such use in writing. 
(b) ACCESS TO, AND CORRECTION, DELETION, AND 
PORTABILITY OF, COVERED DATA.— 
(1) IN GENERAL.—Subject to paragraphs (2) 
and (3), a covered entity shall provide a user, imme-
diately or as quickly as possible and in no case later 
than 90 days after receiving a verified request from 
the user, with the ability to reasonably— 
(A) access— 
(i) if applicable, a list of each third 
party and service provider to whom the 
covered entity has transferred or shared 
the covered data of the user; 
(ii) the covered data of the user, or an 
accurate representation of the covered data 
of the user, including data aggregation 
that is a readable summary, that is held or 
has been processed by the covered entity or 
any service provider of the covered entity; 
and 
(iii) if a covered entity transfers cov-
ered data, a description of the covered data 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
that was transferred and the purpose for 
which the third party requested the data; 
(B) request that the covered entity— 
(i) correct material inaccuracies or 
materially incomplete information with re-
spect to the covered data of the user that 
is maintained by the covered entity; 
(ii) delete or de-identify covered data 
of the user that is or has been maintained 
by the covered entity; 
(iii) notify any service provider or 
third party to which the covered entity 
transferred such covered data of the cor-
rected information; and 
(iv) provide contact information to the 
user of any service provider or third party 
that the covered data of the user was 
transferred to so that the user may make 
requests described in this subparagraph; 
and 
(C) to the extent that is technically fea-
sible, provide covered data of the user that is or 
has been generated and submitted to the cov-
ered entity by the user and maintained by the 
covered entity in a portable, structured, and 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
machine-readable format that is not subject to 
licensing restrictions. 
(2) FREQUENCY AND COST OF ACCESS.—A cov-
ered entity shall— 
(A) provide a user with the opportunity to 
exercise the rights described in paragraph (1) 
not less than twice in any 12-month period; and 
(B) fulfill the responsibilities described in 
paragraph (1) free of charge. 
(3) PROHIBITION ON RETALIATION.—A covered 
entity shall provide the same quality of goods or 
services, at the same price or rate, regardless of 
whether a user took an action described under para-
graph (1). 
(4) RETENTION
OF
DATA.—A covered entity 
that collects data on a user’s browsing history or bi-
ometric data and information shall delete the data 
within 60 days after the date on which the data was 
collected. 
(c) DATA MINIMIZATION AND CONTEXTUALITY.— 
(1) COLLECTION AND USE OF INFORMATION.— 
A commercial data operator shall limit the collection 
and sharing of information by the operator with 
third parties to what is reasonably necessary to pro-
vide a service or conduct an activity that a consumer 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
has requested or is reasonably necessary for fraud 
prevention. 
(2) RETENTION OF INFORMATION.—A commer-
cial data operator that collects the personal informa-
tion of a consumer shall limit the use and retention 
of that information to what is reasonably necessary 
to provide a service or conduct an activity that a 
consumer has requested or a related operational pur-
pose. Any data collected or retained by a commercial 
data operator solely for security or fraud prevention 
may not be used for operational purposes. 
(3) MONETIZATION.—Monetization of personal 
information shall not be considered reasonably nec-
essary to provide a service or conduct an activity 
that a consumer has requested or reasonably nec-
essary for security or fraud prevention. 
(d) CONSUMER CHOICE AND CONTROL.— 
(1) COMMERCIAL
DATA
OPERATOR.—A com-
mercial data operator shall provide a prominently 
and conspicuously displayed icon a user may click to 
opt out of data collection on every unique website, 
mobile application, or computer application. 
(2) COVERED ENTITIES.—Within 2 years after 
the date of the enactment of this Act, a covered enti-
ty shall take reasonable steps, taking account of 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
available technology, to provide users the ability to 
directly delete the covered data collected by the cov-
ered entity. 
(e) DEFAULT SETTINGS.—A covered entity may re-
quire, through terms of service or otherwise, that a user 
must consent to the transfer of covered data in order to 
use the service of the covered entity. 
(f) POLICIES REGARDING DATA FROM MINORS.—A 
covered entity may not collect, retain, or transfer the cov-
ered data of a user to a third party without affirmative 
consent from the parent or guardian of the user if the 
user is below the age of 18 years old, where technically 
feasible. 
(g) PROHIBITION ON TRACKING COOKIES WITHOUT 
USER CONSENT.—A commercial data operator— 
(1) unless authorized by the user, may not 
track cookies, including on mobile applications; and 
(2) shall provide the same services to users who 
do not authorize tracking cookies. 
(h) TRANSPARENCY.— 
(1) PRIVACY NOTICE.—A covered entity shall 
provide users with a clear, comprehensible, accurate, 
and continuously available privacy notice that— 
(A) describes in detail the information col-
lected by the operator, how that information 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
would be used, and whether the information 
would be sold or shared with any third party; 
and 
(B) is 1,000 words or less. 
(2) REPORT
ON
USE
OF
INFORMATION
RE-
QUIRED.—If a user allows a commercial data oper-
ator to sell the covered data of the user, the com-
mercial data operator shall provide the user with an 
annual report regarding the types of third parties 
with whom data has been shared. The report shall 
include a description of what information has been 
shared, for what purpose information is shared, and 
a list of each third party that receives data. 
(i) DATA SECURITY AND BREACH NOTIFICATION.— 
A covered entity shall notify each user in a timely manner 
of any data breach with respect to the information of the 
user and provide any remedy to compensate the user for 
the breach of their information, including a credit protec-
tion service, fraud alert, and credit monitoring through 
credit reporting agencies. 
(j) ENFORCEMENT.— 
(1) ENFORCEMENT BY THE FEDERAL TRADE 
COMMISSION.— 
(A) UNFAIR OR DECEPTIVE ACTS OR PRAC-
TICES.—A violation of this section shall be 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
treated as a violation of a regulation under sec-
tion 18(a)(1)(B) of the Federal Trade Commis-
sion Act (15 U.S.C. 57a(a)(1)(B)) regarding 
unfair or deceptive acts or practices. 
(B) POWERS OF COMMISSION.—The Com-
mission shall enforce this section in the same 
manner, by the same means, and with the same 
jurisdiction, powers, and duties as though all 
applicable terms and provisions of the Federal 
Trade Commission Act (15 U.S.C. 41 et seq.) 
were incorporated into and made a part of this 
Act. Any person who violates this section shall 
be subject to the penalties and entitled to the 
privileges and immunities provided in the Fed-
eral Trade Commission Act. 
(2) EFFECT ON OTHER LAWS.—Nothing in this 
section shall be construed in any way to limit the 
authority of the Commission under any other provi-
sion of law or to limit the application of any Federal 
or State law. 
(3) ENFORCEMENT BY STATE ATTORNEYS GEN-
ERAL.— 
(A) IN
GENERAL.—If the chief law en-
forcement officer of a State, or an official or 
agency designated by a State, has reason to be-
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
lieve that any person has violated or is violating 
this section, the attorney general, official, or 
agency of the State, in addition to any author-
ity it may have to bring an action in State 
court under its consumer protection law, may 
bring a civil action in any appropriate United 
States district court or in any other court of 
competent jurisdiction, including a State court, 
to— 
(i) enjoin further such violation by 
such person; 
(ii) enforce compliance with this sec-
tion; 
(iii) obtain civil penalties; and 
(iv) obtain damages, restitution, or 
other compensation on behalf of residents 
of the State. 
(B) NOTICE AND INTERVENTION BY THE 
FEDERAL
TRADE
COMMISSION.—The attorney 
general of a State shall provide prior written 
notice of any action under subparagraph (A) to 
the Commission and provide the Commission 
with a copy of the complaint in the action, ex-
cept in any case in which such prior notice is 
not feasible, in which case the attorney general 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB
shall serve such notice immediately upon insti-
tuting such action. The Commission shall have 
the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(C) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion has instituted a civil action for violation of 
this section, no State attorney general, or offi-
cial or agency of a State, may bring an action 
under this paragraph during the pendency of 
that action against any defendant named in the 
complaint of the Commission for any violation 
of this section alleged in the complaint. 
(4) PRIVATE RIGHT OF ACTION.— 
(A) IN GENERAL.—Any individual alleging 
a violation of this section or a regulation pro-
mulgated under this section may bring a civil 
action in any Federal or State court of com-
petent jurisdiction against a covered entity that 
has global annual gross revenues of at least 
$50,000,000. 
VerDate Sep 11 2014 
23:19 May 17, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3045.IH
H3045
pbinns on DSKJLVW7X2PROD with $$_JOB