S 5594
Data Protection Act of 2026
TL;DR
Senator Kirsten Gillibrand's Data Protection Act of 2026 would create a new federal agency dedicated to policing how companies collect, use, and share personal data, including data fed into AI systems. It targets 'high-risk data practices' like algorithmic decision-making, biometric processing, and large-scale data aggregation, giving the new agency authority to investigate, fine, and regulate companies that handle consumer data.
How This Might Impact Your Business
Companies processing data for AI training, profiling, or automated decisions would face oversight from a new federal Data Protection Agency with investigation and enforcement powers.
'High-risk data practices' including biometric analysis, behavioral advertising, and algorithmic hiring or lending decisions would trigger heightened compliance obligations.
Large data brokers and platforms handling data on more than a threshold number of individuals would face registration and audit requirements.
Financial services, healthcare, HR tech, adtech, social media, and insurance firms would likely fall under the agency's direct scrutiny given their reliance on consumer data and automated decisioning.
Civil penalties and injunctive relief would apply to violations, with the new agency able to coordinate with the FTC and state attorneys general.
Small businesses may get carve-outs, but vendors serving large enterprises would still need to meet contractual compliance flow-downs.
Expect multi-year implementation if passed, but companies should anticipate rulemaking activity within 12 to 18 months of enactment.
What Should You Do
Inventory every AI system and data pipeline that uses personal, biometric, or behavioral data, and document the business purpose and decision logic.
Ask your legal and privacy teams to map current practices against existing frameworks (GDPR, CPRA, CFPB rules) since this bill borrows heavily from them.
Assign someone to track S 5594 through the Senate Commerce Committee and flag any markup or hearing announcements.
Review vendor contracts for AI and data processing services to confirm you can require compliance updates if federal rules change.
Brief your executive team on the likelihood of a federal data regulator emerging, and start scenario planning for centralized federal oversight versus the current state-by-state patchwork.
Who It Affects
Sponsors
Status Timeline
committee
Read twice and referred to the Committee on Commerce, Science, and Transportation.
September 29, 2026