HR2612-119

What This Bill Does

The DELETE Act directs the Federal Trade Commission to regulate data brokers. Within one year, the FTC must require data brokers to register annually, disclose names and addresses, opt-out methods, data collection types, sources, credentialing processes, and other information, and publish most registration information in downloadable, machine-readable form with safety exceptions and disclaimers. The FTC must also establish a centralized secure system that lets an individual, through one submission, request deletion of all personal information held by registered data brokers and affiliated legal entities and discontinue present or future collection unless the individual says otherwise. The system must use administrative, physical, and technical safeguards; standardized forms; email, phone, physical address, and persistent identifiers; salted and hashed registries; free public access; and registered-broker hashed queries. Data brokers must check registries at least every 31 days, delete matching personal information within 31 days, stop future collection, send deletion counts to the FTC, file annual completion-rate reports, undergo independent third-party audits every three years, pay database subscription fees capped at 1 percent of expected annual operating costs, and face FTC Act penalties for violations. The FTC must study and report on implementation, enforcement, deletion request volumes, state coordination, enforcement actions, and recommendations, while state privacy laws are preempted only when inconsistent and weaker than the federal protection.

Who Benefits and How

Consumers benefit because one free submission can trigger deletion requests across registered data brokers and stop future collection tied to hashed identifiers. Privacy advocates benefit from public broker registration, standardized deletion rights, independent audits, FTC enforcement, and recurring reports. People at risk from data exposure benefit if brokers delete personal information such as location, identifiers, financial data, biometrics, communications, browsing history, genetic data, and inferences. State privacy enforcers benefit because stronger state privacy laws are preserved when they provide greater protection than the federal rule.

Who Bears the Burden and How

Data brokers must register annually, disclose practices, query hashed registries every 31 days, delete matching records, stop collection, report completion rates, pay fees, and undergo audits. The Federal Trade Commission must write rules, build and secure the centralized system, maintain registries, publish broker information, enforce violations, and report to Congress. Data broker compliance teams must manage deletion exceptions for legal obligations, human subjects research, fraud prevention, and other allowed retained uses. Businesses relying on brokered personal information may lose access to records deleted through the centralized system.

Key Provisions

• Requires annual FTC registration and public disclosures for data brokers.
• Creates a free centralized deletion system using salted and hashed identifiers for one-stop consumer deletion requests.
• Requires brokers to check registries every 31 days, delete matching records, stop future collection, report completion, and undergo audits.
• Provides FTC enforcement, subscription-fee funding, implementation studies, congressional reports, and limited preemption of weaker inconsistent state laws.