New Federal Bill Could Change How Your Data Is Used—Even in Rural Colorado

~CNYW staff, The Lobby newsletter

They’re Selling Your Data—This New Bill Wants to Stop It.

It’s known as the YODA Act and would affect just about all of us in Southeast Colorado, should the House pass it, send it to the Senate for passage and sign it into law.

Representative Michel Cloud from Texas is the bill’s sponsor that was just introduced.

It would require you to provide written consent before any companies could share or sell your data which includes your contacts.  It would also make it mandatory to delete your browsing and any biometric data without a 60-day period. 

This would also give you more power for private lawsuits.

According to The Lobby: Your Weekly Legislative Update:

The Breakdown

• Bans companies from accessing your phone contacts unless both you AND your contacts consent in writing

• Requires covered entities to provide data access, correction, deletion, and portability rights within 90 days of request

• Forces automatic deletion of browsing history and biometric data within 60 days of collection

• Prohibits data collection from minors under 18 without parental consent where technically feasible

• Creates private right of action allowing individuals to sue companies with $50M+ revenue for $100-$750 per violation

• Mandates opt-out buttons on every website and app, plus caps privacy notices at 1,000 words

The Impact

This bill represents one of Congress's most aggressive consumer data protection proposals, directly targeting the business models of major tech platforms and data brokers. The 60-day auto-delete for biometrics and browsing data would fundamentally disrupt ad-targeting ecosystems, while the private right of action—long opposed by industry—could unleash waves of litigation against Silicon Valley. With no federal preemption of state laws mentioned, this could layer on top of California's CCPA framework rather than replacing it.

Supporters

Privacy advocates, consumer groups, and state AGs would likely champion the bill's strong enforcement mechanisms, explicit consent requirements, and rare private lawsuit provisions that put real power in consumers' hands.

Skeptics

Tech industry, data brokers, and business groups will argue the 60-day deletion mandate is operationally impossible and that private lawsuits will spawn frivolous litigation crushing smaller platforms caught in the crossfire.

What's Next

The bill sits with the House Energy and Commerce Committee, where it awaits potential markup, hearings, or could languish without further action this session.

Sponsor: Congressman Michael Cloud, TX

(source: The Lobby: Your Weekly Legislative Update)

###