The Data Elimination and Limiting Extensive Tracking and Exchange Act, or DELETE Act, aims to empower individuals by creating a centralized system for managing their personal data held by data brokers. It mandates that the Federal Trade Commission (FTC) establish regulations requiring data brokers to register annually and provide specific information, such as their addresses, opt-out methods, and types of data collected. This registration information will be made publicly available by the FTC in a machine-readable format, though the Commission will disclaim responsibility for its accuracy. A core provision of the bill is the establishment of a centralized data deletion system , to be implemented by the FTC within one year. This system will allow individuals to submit a single request to simultaneously delete their personal information from all registered data brokers and, unless specified otherwise, discontinue future collection. The system will use a standardized form requiring persistent identifiers like email and phone number, and will secure this information through hashing across independent registries. Registered data brokers will be required to access these hashed registries at least monthly to process deletion requests within 31 days, also discontinuing future collection. Certain exclusions apply, allowing data brokers to retain information for purposes like human subjects research , legal compliance, or fraud prevention. Data brokers must submit annual reports on deletion completion rates and undergo independent third-party audits every three years to ensure compliance. To fund the system, registered data brokers maintaining persistent identifiers will pay an annual subscription fee, capped at one percent of the system's operating cost, with funds dedicated to its administration and public awareness. Violations of the Act will be treated as unfair or deceptive acts or practices under the Federal Trade Commission Act, granting the FTC enforcement authority. The bill also includes a preemption clause, stating that it preempts state privacy laws only if they are inconsistent, while allowing for state laws that offer greater protection. The Act broadly defines a "data broker" as an entity that collects personal information from individuals with whom it has no direct relationship and then uses or sells that information to third parties. However, it excludes entities performing activities such as 411 directory services, providing public business information, fraud prevention, news gathering, or acting as a consumer reporting agency. "Personal information" is also broadly defined, encompassing financial data, identifiers, geolocation, biometrics, web browsing history, genetic information, and inferences used to profile individuals.
The Data Elimination and Limiting Extensive Tracking and Exchange Act, or DELETE Act, aims to empower individuals by creating a centralized system for managing their personal data held by data brokers. It mandates that the Federal Trade Commission (FTC) establish regulations requiring data brokers to register annually and provide specific information, such as their addresses, opt-out methods, and types of data collected. This registration information will be made publicly available by the FTC in a machine-readable format, though the Commission will disclaim responsibility for its accuracy. A core provision of the bill is the establishment of a centralized data deletion system , to be implemented by the FTC within one year. This system will allow individuals to submit a single request to simultaneously delete their personal information from all registered data brokers and, unless specified otherwise, discontinue future collection. The system will use a standardized form requiring persistent identifiers like email and phone number, and will secure this information through hashing across independent registries. Registered data brokers will be required to access these hashed registries at least monthly to process deletion requests within 31 days, also discontinuing future collection. Certain exclusions apply, allowing data brokers to retain information for purposes like human subjects research , legal compliance, or fraud prevention. Data brokers must submit annual reports on deletion completion rates and undergo independent third-party audits every three years to ensure compliance. To fund the system, registered data brokers maintaining persistent identifiers will pay an annual subscription fee, capped at one percent of the system's operating cost, with funds dedicated to its administration and public awareness. Violations of the Act will be treated as unfair or deceptive acts or practices under the Federal Trade Commission Act, granting the FTC enforcement authority. The bill also includes a preemption clause, stating that it preempts state privacy laws only if they are inconsistent, while allowing for state laws that offer greater protection. The Act broadly defines a "data broker" as an entity that collects personal information from individuals with whom it has no direct relationship and then uses or sells that information to third parties. However, it excludes entities performing activities such as 411 directory services, providing public business information, fraud prevention, news gathering, or acting as a consumer reporting agency. "Personal information" is also broadly defined, encompassing financial data, identifiers, geolocation, biometrics, web browsing history, genetic information, and inferences used to profile individuals.