HR 8014
Online Privacy Act of 2026
TL;DR
Rep. Zoe Lofgren (D-CA) introduced the Online Privacy Act of 2026, a comprehensive federal privacy bill that would create new rights for consumers over their personal data and establish a new Digital Privacy Agency to enforce them. For AI specifically, it targets automated decision-making systems used in hiring, lending, housing, and other high-stakes areas by requiring transparency, human review options, and limits on how personal data trains AI models.
How This Might Impact Your Business
Companies using AI for hiring, credit, insurance, or housing decisions would need to disclose when automated systems are used and offer consumers a way to request human review.
Any business collecting personal data from US consumers (not just large tech firms) would face new consent, minimization, and purpose-limitation rules that restrict using customer data to train AI models without explicit permission.
A new federal Digital Privacy Agency would gain enforcement authority, with penalties potentially reaching tens of thousands of dollars per violation, plus a private right of action letting consumers sue directly.
Data brokers and adtech firms face the steepest lift: registration requirements, algorithmic transparency obligations, and restrictions on profiling minors.
Healthcare, financial services, and HR tech vendors would need to document how their AI systems make decisions and provide plain-language explanations to affected individuals.
Small businesses under certain revenue and data-volume thresholds may qualify for reduced obligations, though the exact carve-outs will be shaped in committee.
Timeline is early: the bill sits in three House committees (Energy and Commerce, Judiciary, Science) and has no floor vote scheduled, so any compliance deadlines would likely be 18 to 24 months post-enactment.
What Should You Do
Inventory every AI or automated decision system your company uses that touches consumers (hiring tools, credit scoring, ad targeting, recommendation engines) and document what data feeds them.
Ask your legal and data teams whether current consent flows would survive a stricter purpose-limitation standard, especially for AI training data.
Assign someone to track this bill through the Energy and Commerce Committee; similar Lofgren bills in past sessions stalled but shaped state laws like CPRA.
Review vendor contracts with AI providers to confirm you can obtain the explainability and audit documentation this bill would require.
Benchmark your practices against existing state laws (California, Colorado, Virginia) since federal passage would likely mirror those frameworks and early alignment reduces future rework.
Who It Affects
Sponsors
Status Timeline
committee
Referred to the Committee on Energy and Commerce, and in addition to the Committees on the Judiciary, and Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
March 19, 2026