HR7901-119

What This Bill Does

The Government Surveillance Reform Act of 2026 rewrites major parts of the Foreign Intelligence Surveillance Act, Executive Order surveillance practice, and the Stored Communications Act. Its central rule is that the Federal Government generally cannot search for or acquire sensitive information about a United States person or a person in the United States without the same judicial authorization that would be required in a domestic law-enforcement investigation. It also limits government purchases from data brokers, strengthens FISA court process, creates employee discipline, expands civil access to court, modernizes warrants for digital records, protects vehicle data, and requires detailed public reporting.

The bill defines a covered person as a United States person or a person known or believed to be in the United States at the relevant query, acquisition, communication, or data-creation time. Under FISA section 702, officers may not access communications content or other warrant-protected information returned by a query associated with a covered person unless a current FISA order, emergency authorization, or criminal warrant applies. Narrow exceptions cover an imminent threat of death or serious bodily harm, case-by-case consent, and defensive cybersecurity. Emergency and cybersecurity access must be reported to the FISA Court and Congress within 14 days.

If an emergency application is denied or information is accessed unlawfully, the information and its fruits generally cannot be used, disclosed, or admitted. The Attorney General may authorize limited disclosure to prevent death or serious bodily harm and must report that decision. Every query must be reasonably likely to retrieve foreign-intelligence information and have a significant foreign-intelligence purpose. Agencies must create electronic records of every term, date, user, justification, access, and exception, including attribution for automated queries, and report implementation to Congress.

The same query and access protections apply to intelligence collected outside FISA under executive authority. Section 702 use restrictions extend from criminal cases to civil and administrative proceedings. Reverse targeting of a nominal foreign target for the significant purpose of obtaining a known covered person's information is prohibited absent emergency assistance or consent. Domestic communications whose sender and all intended recipients are in the United States cannot be intentionally acquired for foreign-intelligence purposes without FISA authority or an emergency followed by reporting.

Section 702 and non-FISA intelligence about covered people that is not specifically known to contain foreign intelligence must generally be destroyed within five years. Litigation preservation and lawful investigation exceptions require segregation and purpose limits. The Government must use FISA or a criminal warrant before intentionally targeting a covered person anywhere in the world for communications content, location, browsing, search history, other information protected by a reasonable expectation of privacy, or pen-register information. Evidence from an emergency acquisition that is not later approved is excluded, subject to a life-or-safety exception.

Section 702 technical-assistance directives to communications providers must be necessary, narrowly tailored, and not unduly burdensome to providers or nontarget customers. A provider need not comply unless the FISA Court expressly approves the method and serves an order describing the required assistance. The bill narrows the expanded 2024 definition of electronic communication service provider and voids directives to entities removed from the definition. It also changes annual certification from a significant to the primary foreign-intelligence purpose, repeals special query rules for people traveling to the United States, requires sensitive-query counts, and extends section 702 through April 20, 2030.

Federal law-enforcement agencies generally may not buy or otherwise exchange value for personal data about covered people from a nongovernmental organization. Personal data includes linkable identifiers and reidentifiable anonymized data. Exceptions cover mixed compilations that cannot reasonably exclude covered data, statutory whistleblower awards, cost reimbursement under compulsory process, employment use, consented background checks, and lawfully obtained public data supported by perjury-backed attestations. The public-data exception does not cover biometric or location information.

Federal agencies cannot evade the purchase ban by receiving data from another government entity. They must obtain an attestation, destroy unlawfully acquired data, and may not use it or its fruits as evidence. The Attorney General must create and review minimization procedures. Agencies must remove covered data before operational use, audit continuously, and generally may query a covered person's records only under a qualifying court order, a life-or-safety exception, or consent. State and local agencies buying comparable data through interstate commerce or specified Federal assistance must publicly report annual spending, data categories, and estimated affected people.

FISA applications must fairly reflect all relevant information and follow Attorney General accuracy procedures. Applications must disclose exculpatory or credibility-undermining information, document every factual assertion, check intelligence-community relationships with a target, certify supporting records, and undergo annual agency audits. A judge cannot issue an order without finding that the stated procedures meet the statute. DOJ must record every written and oral interaction with the FISA Court in the application file.

The FISA Court generally must appoint privacy or civil-liberties amici for novel law, constitutional concerns, sensitive investigations, new technology, programmatic reauthorization, and similar issues, and technical amici for materially new or unresolved technology. Sensitive matters include public officials, candidates, political or religious groups, prominent members, and domestic news media. Amici receive applications, supporting material, precedent, unredacted decisions, and classified court records when eligible. They may raise additional legality issues, seek supporting documentation, consult other amici with court permission, petition for FISA Court of Review certification, and seek Supreme Court certification. Courts must report appointments and written decisions not to appoint.

Significant or novel FISA opinions, sensitive-investigation decisions, and opinions nominated by an amicus must undergo declassification review and be released to the greatest practicable extent within 180 days. The FISA courts gain jurisdiction over access to their own records and ancillary claims, with written reasons and appellate review. The old section 215 grandfather clause ends 180 days after enactment.

The bill defines injury in fact for surveillance suits by people who regularly communicate foreign intelligence with people abroad and take reasonable avoidance measures, or who have a concrete injury from a good-faith basis to believe their rights are or imminently will be violated. It applies FISA's classified-evidence procedures when the Government invokes the state-secrets privilege. This eases standing but does not itself decide the merits of a claim.

The FBI, CIA, NSA, and National Counterterrorism Center must investigate willful, knowing, reckless, and negligent violations affecting covered people. Consequences escalate from 90- or 180-day access suspensions and personnel-file entries to reassignment, security-clearance termination, and presumptive termination after repeated violations. Agency heads must justify departures from presumptive termination to Congress and decide discipline within 60 days after an investigation.

FISA and the specified criminal-surveillance statutes become the exclusive means for domestic electronic surveillance, interception from domestic systems, wholly domestic communications, and foreign-intelligence acquisition of location information about people in the United States. Foreign communications involving foreign systems remain outside that exclusive-means rule when acquired under otherwise applicable law by means that are not FISA electronic surveillance.

Outside FISA, intelligence elements generally may not acquire datasets containing linkable covered-person data. Exceptions require a FISA or criminal order, restricted employment or compliance use, emergency, case-specific consent, inseparable mixed datasets subject to minimization, or limited overseas acquisition of records that could be compelled by a national security letter when domestic compulsion is infeasible. Covered data must be excluded or deleted before operational use, unlawful data and its fruits are suppressed, and the Director of National Intelligence must report dataset volume, sensitive categories, national-security-letter analogues, and violations to Congress, the Privacy and Civil Liberties Oversight Board, and the public.

Inspector General audits must examine FISA applications and section 702 directives, assess accuracy and safeguards, report deficiencies and remediation to the Attorney General, DNI, PCLOB, Congress, the FISA Court, and amici, and publish unclassified versions. PCLOB gains protected communications parity with intelligence Inspectors General and a compensation ceiling tied to comparable intelligence-community positions. Attorney General certifications granting immunity for warrantless assistance must reach Congress within 30 days, including ongoing certifications within 90 days.

For ordinary criminal investigations, the bill requires warrants for stored communications of any age, location information, web-browsing records, search-query records, prospective browsing data, prospective location records, and Federal tracking devices. Prospective browsing warrants may last no more than 30 days absent renewed findings. Emergency tracking use requires warrant grounds, an application within 48 hours, termination if denied or no longer needed, notice to the named person, and treatment of unapproved data as unlawfully obtained. Pen-register applications by Federal prosecutors must present specific and articulable facts showing relevance and materiality to an ongoing investigation.

Subscriber subpoenas must identify a particular person by name, address, temporary network address, or account identifier. The Email Privacy Act removes the 180-day distinction for stored messages, permits providers to notify customers unless delayed-notice law applies, preserves access to provider-employee and public advertising messages, and preserves congressional subpoena authority. Interactive computing services and intermediary infrastructure receive the same protections as traditional email and remote-computing providers. Data brokers may be compelled only under the most stringent standard that would govern comparable records held by an online service provider.

Voluntary Federal disclosures must follow public minimization procedures that limit acquisition, use, and dissemination; remove or mask personally identifiable information; and destroy information when the investigation ends. Judges must report warrants, orders, denials, providers, offenses, and agencies to the Administrative Office of the U.S. Courts. The office must publish machine-readable annual statistics for stored communications, records, pen registers, and trap-and-trace devices, and Federal agencies must publish voluntary-disclosure statistics.

The bill preserves preexisting State and local acquisition authority by moving their Stored Communications Act procedures into a separate section 2703A and retaining a separate mobile-tracking rule. Federal agencies may not receive or use State or local data obtained under standards that would be unlawful for the Federal agency. State procedures retain applicable State-law limits, provider motions to quash, preservation requests, consent, specified subpoenas, telemarketing-fraud requests, and emergency disclosure.

Federal investigators generally need a Rule 41 warrant to access onboard or telematics data from a noncommercial vehicle, including diagnostic, entertainment, navigation, sensor, camera, autonomous-driving, communications, and event-recorder data. Consent must be affirmative, specific, voluntary, time-limited, optional, sanction-free, and understandable; generic privacy policies do not count. A lawful operator may consent unless a passenger age 14 or older objects. Emergency access requires probable cause and a warrant application within 48 hours. Unlawfully obtained vehicle data and its fruits are excluded, and safety-event-recorder data cannot establish probable cause.

Transparency provisions add annual counts for FISA certifications, amicus petitions and appointments, en banc proceedings, section 702 targets, provider directives, masked and unmasked U.S.-person identities, warrant and nonwarrant queries, and foreign-intelligence evidence used in criminal cases. DOJ must publish annual FISA application error and omission statistics. Providers may report national-security letters, selectors, orders, directives, contents, and noncontents in narrower bands and may identify whether they received a demand under each authority. PCLOB must report on FISA use involving First Amendment activity, race, ethnicity, national origin, and religion. Emergency compliance assessments become annual.

The Act preserves State and local authority as it existed before enactment, includes severability, and allows the Attorney General, with DNI coordination when appropriate, to delay a provision for up to one year only after showing Congress that technical systems or trained personnel are needed.

Who Benefits and How

United States persons, people located in the United States, journalists, political and religious organizations, public officials, candidates, communications users, data-broker subjects, drivers, passengers, and online-service customers gain warrant standards, minimization, deletion, notice, suppression, reporting, and stronger court process. Communications providers gain protection from vague or unduly burdensome technical-assistance demands and more granular transparency rights. Civil-liberties and technical amici gain access and appellate participation.

Who Bears the Burden and How

The Attorney General, DNI, FBI, CIA, NSA, NCTC, other intelligence elements, Federal law-enforcement agencies, FISA applicants, Inspectors General, PCLOB, courts, and congressional oversight offices must build logs, minimization systems, audits, discipline, reports, and judicial records. Data brokers, communications providers, intermediary services, automotive-data holders, and State or local agencies face attestations, preservation, disclosure, security, reporting, or process requirements. Investigators lose warrantless access and purchased-data shortcuts except within the statute's narrow exceptions.

Key Provisions

• Requires warrants or narrow exceptions for covered-person section 702 queries.
• Applies comparable query protections to intelligence collected outside FISA.
• Bars reverse targeting and warrantless wholly domestic acquisition.
• Requires a significant foreign-intelligence query purpose and primary certification purpose.
• Destroys non-foreign-intelligence covered data after five years.
• Requires FISA Court approval of provider technical assistance.
• Extends section 702 through April 20, 2030.
• Prohibits Federal law-enforcement purchases of covered brokered data.
• Prevents interagency laundering of unlawfully purchased data.
• Requires warrants for covered-person targeting anywhere in the world.
• Mandates complete FISA accuracy files and certifications.
• Presumptively appoints privacy and technical amici.
• Expands declassification and FISA court-record review.
• Eases standing for concrete surveillance claims.
• Creates escalating discipline for intelligence-employee violations.
• Makes FISA and criminal statutes the exclusive means for domestic surveillance.
• Requires warrants for location, browsing, search, email, tracking, and comparable broker data.
• Protects intermediary-held data and customer notice.
• Preserves separate State and local procedures while blocking Federal circumvention.
• Requires warrants or specific consent for Federal access to vehicle data.
• Expands public court, DOJ, DNI, PCLOB, provider, and emergency-compliance reporting.