Gillibrand reintroduces U.S. data privacy bill

Sen. Kirsten Gillibrand has reintroduced the Data Protection Act, a proposal to create an independent federal data protection agency in the United States. The bill would seek to limit the collection, use and transfer of personal data, while also overseeing high-risk practices and algorithms, maintaining a public registry of data brokers and enforcing privacy rules.

What does the text propose?

The draft calls for a federal agency with authority to develop data protection standards and guidance, while setting limits on how personal data is collected, used and transferred. It also seeks to give the new body oversight over data brokers and systems considered high risk.

The proposal was circulated as the Data Protection Act and, according to the coverage reviewed, no Senate bill number has been assigned. That detail does not prevent it from being presented as a national proposal, but its provisions would only take effect if Congress passes it.

What is its parliamentary status?

The verifiable legislative status is still preliminary, and no voting schedule has been confirmed. The text is circulating as a discussion draft, while the formal reference that appears in the Senate's Congressional Record links the initiative to S. 5594, identified as a bill to establish the Data Protection Agency.

Tech Policy Press also included S. 5594 in its September 2026 technology policy roundup and described it as a Kirsten Gillibrand initiative to establish the Data Protection Agency, protect privacy and serve other purposes. That mention adds no further details on process, sponsors or timing.

What political context surrounds the proposal?

Federal legislative coverage of a national data privacy law had still shown no public progress after a subcommittee hearing held in early June. At the same time, states continued to legislate on privacy, according to Route Fifty, keeping open the debate between a federal solution and fragmented state frameworks.

The bill's reintroduction brings back the idea of a dedicated federal regulator for personal data in the United States. For now, the confirmed fact is that the initiative exists, is circulating as a draft and still has no solid parliamentary path.