I
119THCONGRESS
1
STSESSION H. R. 2612
To establish a centralized system to allow individuals to request the simulta-
neous deletion of their personal information across all data brokers,
and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
APRIL2, 2025
Mrs. T
RAHANintroduced the following bill; which was referred to the
Committee on Energy and Commerce
A BILL
To establish a centralized system to allow individuals to
request the simultaneous deletion of their personal infor-
mation across all data brokers, and for other purposes.
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2
SECTION 1. SHORT TITLE. 3
This Act may be cited as the ‘‘Data Elimination and 4
Limiting Extensive Tracking and Exchange Act’’ or the 5
‘‘DELETE Act’’. 6
SEC. 2. DATA DELETION REQUIREMENTS. 7
(a) D
ATABROKERANNUALREGISTRATION.— 8
(1) I
N GENERAL.— 9
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 2
•HR 2612 IH
(A) REGULATIONS.—Not later than 1 year 1
after the date of enactment of this section, the 2
Commission shall promulgate regulations to re-3
quire any data broker to— 4
(i) not later than 18 months after the 5
date of enactment of this section, and an-6
nually thereafter, register with the Com-7
mission; and 8
(ii) subject to subparagraph (B), pro-9
vide with such registration certain informa-10
tion, including— 11
(I) the name and primary phys-12
ical, email, and uniform resource loca-13
tor (URL) addresses of the data 14
broker; 15
(II) if the data broker permits an 16
individual to opt out of the data bro-17
ker’s collection or use of personal in-18
formation, certain sales of such infor-19
mation, or its databases— 20
(aa) the method for request-21
ing an opt-out; 22
(bb) any limitations on the 23
type of data collection, uses, or 24
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 3
•HR 2612 IH
sales for which an individual may 1
opt-out; and 2
(cc) whether the data broker 3
permits an individual to author-4
ize a third party to perform the 5
opt-out on the individual’s behalf; 6
(III) a response to a standard-7
ized form (as issued by the Commis-8
sion) specifying the types of informa-9
tion the data broker collects or ob-10
tains and the sources from which the 11
data broker obtains data; 12
(IV) a statement as to whether 13
the data broker implements a 14
credentialing process and, if so, a de-15
scription of that process; 16
(V) any additional information or 17
explanation the data broker chooses to 18
provide concerning its data collection 19
practices; and 20
(VI) any other information deter-21
mined appropriate by the Commission. 22
(B) C
ONSTRUCTION.—Nothing in this 23
paragraph shall be construed as requiring a 24
data broker to disclose any information that is 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 4
•HR 2612 IH
a trade secret or other kind of confidential in-1
formation described in section 552(b)(4) of title 2
5, United States Code. 3
(2) P
UBLIC AVAILABILITY.— 4
(A) I
N GENERAL.—The Commission shall 5
make the information provided pursuant to 6
paragraph (1)(A)(ii) publicly available in a 7
downloadable and machine-readable format, ex-8
cept in the event that the Commission— 9
(i) determines that the risk of making 10
such information available is not in the in-11
terest of public safety or welfare; and 12
(ii) provides a justification for such 13
determination. 14
(B) D
ISCLAIMER.—The Commission shall 15
include on the website of the Commission a dis-16
claimer that— 17
(i) the Commission cannot confirm 18
the accuracy of the information provided 19
pursuant to paragraph (1)(A)(ii); and 20
(ii) individuals may contact a data 21
broker who provided such information at 22
their own risk. 23
(b) C
ENTRALIZEDDATADELETIONSYSTEM.— 24
(1) E
STABLISHMENT.— 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 5
•HR 2612 IH
(A) IN GENERAL.—Not later than 1 year 1
after the date of enactment of this section, the 2
Commission shall promulgate regulations to es-3
tablish a centralized system that— 4
(i) implements and maintains reason-5
able security procedures and practices (in-6
cluding administrative, physical, and tech-7
nical safeguards) appropriate to the nature 8
of the information and the purposes for 9
which the personal information will be 10
used, to protect individuals’ personal infor-11
mation from unauthorized use, disclosure, 12
access, destruction, or modification; 13
(ii) allows an individual, through a 14
single submission, to request that every 15
data broker who is registered under sub-16
section (a) and who maintains any per-17
sistent identifiers (as described in subpara-18
graph (B)(iii))— 19
(I) delete any personal informa-20
tion related to such individual held by 21
such data broker or affiliated legal en-22
tity of the data broker; and 23
(II) unless otherwise specified by 24
the individual, discontinue any present 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 6
•HR 2612 IH
or future collection of personal infor-1
mation related to such individual; and 2
(iii) allows a registered data broker, 3
prior to the collection of any personal in-4
formation that is tied to a persistent iden-5
tifier for which a registry exists, to submit 6
a query to the centralized system to con-7
firm that the persistent identifier is not 8
subject to a deletion request described in 9
clause (ii). 10
(B) R
EQUIREMENTS.—The centralized sys-11
tem established in subparagraph (A) shall meet 12
the following requirements: 13
(i) The centralized system shall allow 14
an individual to request the deletion of all 15
personal information related to such indi-16
vidual and the discontinuation of any col-17
lection of such personal information related 18
to such individual through a single deletion 19
request. 20
(ii) The centralized system shall pro-21
vide a standardized form to allow an indi-22
vidual to make such request. 23
(iii) Such standardized form shall in-24
clude the individual’s email, phone number, 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 7
•HR 2612 IH
physical address, and any other persistent 1
identifier determined by the Commission to 2
aid in the deletion request. 3
(iv) The centralized system shall auto-4
matically salt and hash all submitted infor-5
mation and allow the Commission to main-6
tain independent hashed registries of each 7
type of information obtained through such 8
form. 9
(v) The centralized system shall only 10
permit data brokers who are registered 11
with the Commission to submit hashed 12
queries to the independent hashed reg-13
istries described in clause (iv). 14
(vi) With respect to the independent 15
hashed registries described in clause (iv), 16
the salt shall be different for each such 17
registry and shall be made available to all 18
registered data brokers for the purposes of 19
submitting hashed queries, as described in 20
clause (v). 21
(vii) The centralized system shall 22
allow an individual to make such request 23
using an internet website operated by the 24
Commission. 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 8
•HR 2612 IH
(viii) The centralized system shall not 1
charge the individual to make such re-2
quest. 3
(C) T
RANSITION.— 4
(i) I
N GENERAL.—Not later than 8 5
months after the effective date of the regu-6
lations promulgated under subparagraph 7
(A), each data broker shall— 8
(I) not less than once every 31 9
days, access the hashed registries 10
maintained by the Commission as de-11
scribed in subparagraph (B)(iv); and 12
(II) process any deletion request 13
associated with a match between such 14
hashed registries and the records of 15
the data broker. 16
(ii) FTC
GUIDANCE.—Not later than 17
6 months after the effective date of the 18
regulations promulgated under subpara-19
graph (A), the Commission shall publish 20
guidance on the process and standards to 21
which a data broker must adhere in car-22
rying out clause (i). 23
(2) D
ELETION.— 24
(A) I
NFORMATION DELETION .— 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 9
•HR 2612 IH
(i) IN GENERAL.—Subject to clause 1
(ii), not later than 31 days after accessing 2
the hashed registries described in para-3
graph (1)(B)(iv), a data broker and any 4
associated legal entity shall delete all per-5
sonal information in its possession related 6
to the individual making the request and 7
discontinue the collection of personal infor-8
mation related to such individual. Imme-9
diately following the deletion, the data 10
broker shall send an affirmative represen-11
tation to the Commission with the number 12
of records deleted pursuant to each match 13
with a value in the hashed registries. 14
(ii) E
XCLUSIONS.—In carrying out 15
clause (i), a data broker may retain, where 16
required, the following information: 17
(I) Any personal information that 18
is processed or maintained solely as 19
part of human subjects research con-20
ducted in compliance with any legal 21
requirements for the protection of 22
human subjects. 23
(II) Any personal information 24
necessary to comply with a warrant, 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 10
•HR 2612 IH
subpoena, court order, rule, or other 1
applicable law. 2
(III) Any information necessary 3
for an activity described in subsection 4
(f)(3)(B), provided that the retained 5
information is used solely for any 6
such activity. 7
(iii) U
SE OF INFORMATION.—Any per-8
sonal information excluded under clause 9
(ii) may only be used for the purpose de-10
scribed in the applicable subclause of 11
clause (ii), and may not be used for any 12
other purpose, including marketing pur-13
poses. 14
(B) A
NNUAL REPORT.—Each data broker 15
registered under subsection (a) shall submit to 16
the Commission, on an annual basis, a report 17
on the completion rate with respect to the com-18
pletion of deletion requests under subparagraph 19
(A). 20
(C) A
UDIT.— 21
(i) I
N GENERAL.—Not later than 3 22
years after the date of enactment of this 23
section, and every 3 years thereafter, each 24
data broker registered under subsection (a) 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 11
•HR 2612 IH
shall undergo an independent third party 1
audit to determine compliance with this 2
subsection. 3
(ii) A
UDIT REPORT.—Not later than 6 4
months after the completion of any audit 5
under clause (i), each such data broker 6
shall submit to the Commission any report 7
produced as a result of the audit, along 8
with any related materials. 9
(iii) M
AINTAIN RECORDS.—Each such 10
data broker shall maintain the materials 11
described in clause (ii) for a period of not 12
less than 6 years. 13
(3) A
NNUAL FEE.— 14
(A) I
N GENERAL.—Subject to subpara-15
graph (B), each data broker registered under 16
subsection (a) and who maintains any per-17
sistent identifiers (as described in paragraph 18
(1)(B)(iii)) shall pay to the Commission, on an 19
annual basis, a subscription fee determined by 20
the Commission to access the database. 21
(B) L
IMIT.—The amount of the subscrip-22
tion fee under subparagraph (A) may not ex-23
ceed 1 percent of the expected annual cost of 24
operating the centralized system and hashed 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 12
•HR 2612 IH
registries described in paragraph (1), as deter-1
mined by the Commission. 2
(C) A
VAILABILITY.—Any amounts col-3
lected by the Commission pursuant to this 4
paragraph shall be available without further ap-5
propriation to the Commission for the exclusive 6
purpose of enforcing and administering this sec-7
tion, including the implementation and mainte-8
nance of such centralized system and hashed 9
registries and the promotion of public aware-10
ness of the centralized system. 11
(c) E
NFORCEMENT BY THE COMMISSION.— 12
(1) U
NFAIR OR DECEPTIVE ACTS OR PRAC -13
TICES.—A violation of subsection (a) or (b) or a reg-14
ulation promulgated under this section shall be 15
treated as a violation of a rule defining an unfair or 16
deceptive act or practice under section 18(a)(1)(B) 17
of the Federal Trade Commission Act (15 U.S.C. 18
57a(a)(1)(B)). 19
(2) P
OWERS OF THE COMMISSION .— 20
(A) I
N GENERAL.—The Commission shall 21
enforce this section in the same manner, by the 22
same means, and with the same jurisdiction, 23
powers, and duties as though all applicable 24
terms and provisions of the Federal Trade 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 13
•HR 2612 IH
Commission Act (15 U.S.C. 41 et seq.) were in-1
corporated into and made a part of this section. 2
(B) P
RIVILEGES AND IMMUNITIES .—Any 3
person who violates subsection (a) or (b) or a 4
regulation promulgated under this section shall 5
be subject to the penalties and entitled to the 6
privileges and immunities provided in the Fed-7
eral Trade Commission Act (15 U.S.C. 41 et 8
seq.). 9
(C) A
UTHORITY PRESERVED .—Nothing in 10
this section shall be construed to limit the au-11
thority of the Commission under any other pro-12
vision of law. 13
(D) R
ULEMAKING.—The Commission shall 14
promulgate in accordance with section 553 of 15
title 5, United States Code, such rules as may 16
be necessary to carry out this section. 17
(d) S
TUDY ANDREPORT.— 18
(1) S
TUDY.—The Commission shall conduct a 19
study on the implementation and enforcement of this 20
section. Such study shall include— 21
(A) an analysis of the effectiveness of the 22
centralized system established in subsection 23
(b)(1)(A); 24
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 14
•HR 2612 IH
(B) the number deletion requests sub-1
mitted annually using such centralized system; 2
(C) an analysis of the progress of coordi-3
nating the operation and enforcement of such 4
requests with similar systems established and 5
maintained by the various States; and 6
(D) any other area determined appropriate 7
by the Commission. 8
(2) R
EPORT.—Not later than 3 years after the 9
date of enactment of this section, and annually 10
thereafter for each of the next 4 years, the Commis-11
sion shall submit to the Committee on Commerce, 12
Science, and Transportation of the Senate and the 13
Committee on Energy and Commerce of the House 14
of Representatives a report containing— 15
(A) the results of the study conducted pur-16
suant to paragraph (1); 17
(B) a summary of any enforcement actions 18
taken pursuant to this Act; and 19
(C) recommendations for any legislation 20
and administrative action as the Commission 21
determines appropriate. 22
(e) P
REEMPTION.— 23
(1) I
N GENERAL.—The provisions of this Act 24
shall preempt any State privacy law only to the ex-25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 15
•HR 2612 IH
tent that such State law is inconsistent with the pro-1
visions of this Act. 2
(2) G
REATER PROTECTION UNDER STATE 3
LAW.—For purposes of paragraph (1), a State pri-4
vacy law is not inconsistent with the provisions of 5
this Act if the protection such law affords any per-6
son is greater than the protection provided under 7
this Act, as determined by the Commission. 8
(f) D
EFINITIONS.—In this section: 9
(1) C
OMMISSION.—The term ‘‘Commission’’ 10
means the Federal Trade Commission. 11
(2) C
REDENTIALING PROCESS .—The term 12
‘‘credentialing process’’ means the practice of taking 13
reasonable steps to confirm— 14
(A) the identity of the entity with whom 15
the data broker has a direct relationship; 16
(B) that any data disclosed to the entity 17
by such data broker will be used for the de-18
scribed purpose of such disclosure; and 19
(C) that such data will not be used for un-20
lawful purposes. 21
(3) D
ATA BROKER.— 22
(A) I
N GENERAL .—The term ‘‘data 23
broker’’ means an entity that knowingly collects 24
or obtains the personal information of an indi-25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 16
•HR 2612 IH
vidual with whom the entity does not have a di-1
rect relationship and then— 2
(i) uses the personal information to 3
perform a service for a third party; or 4
(ii) sells, licenses, trades, provides for 5
consideration, or is otherwise compensated 6
for disclosing personal information to a 7
third party. 8
(B) E
XCLUSION.—The term ‘‘data broker’’ 9
does not include an entity who solely uses, sells, 10
licenses, trades, provides for consideration, or is 11
otherwise compensated for disclosing personal 12
information for 1 or more of the following ac-13
tivities: 14
(i) Providing 411 directory assistance 15
or directory information services, including 16
name, address, and telephone number, on 17
behalf of or as a function of a tele-18
communications carrier. 19
(ii) Providing an individual’s publicly 20
available information if the information is 21
being used by the recipient as it relates to 22
that individual’s business or profession. 23
(iii) Providing personal information to 24
a third party at the express direction of 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 17
•HR 2612 IH
the individual for a clearly disclosed single- 1
use purpose. 2
(iv) Providing or using personal infor-3
mation for assessing, verifying, or authen-4
ticating an individual’s identity, or for in-5
vestigating or preventing actual or poten-6
tial fraud. 7
(v) Gathering, preparing, collecting, 8
photographing, recording, writing, editing, 9
reporting, or publishing news or informa-10
tion that concerns local, national, or inter-11
national events or other matters of public 12
interest (as determined by the Commis-13
sion) for dissemination to the public. 14
(vi) Acting as a consumer reporting 15
agency (as defined in section 603(f) of the 16
Fair Credit Reporting Act (15 U.S.C. 17
1681a(f))). 18
(C) E
XCLUSION FROM SALE.— 19
(i) I
N GENERAL.—For purposes of 20
this paragraph, the term ‘‘sells’’ does not 21
include a one-time or occasional sale of as-22
sets of an entity as part of a transfer of 23
control of those assets that is not part of 24
the ordinary conduct of the entity. 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 18
•HR 2612 IH
(ii) NOTICE REQUIRED.—To meet the 1
exclusion criteria described in clause (i), an 2
entity must provide notice to the Commis-3
sion, in the manner determined appro-4
priate by the Commission, of any such one- 5
time or occasional sale of assets. 6
(4) D
ELETE.—The term ‘‘delete’’ means to re-7
move or destroy information such that the informa-8
tion is not maintained in human- or machine-read-9
able form and cannot be retrieved or utilized in such 10
form in the normal course of business. 11
(5) D
IRECT RELATIONSHIP.— 12
(A) I
N GENERAL.—The term ‘‘direct rela-13
tionship’’ means a relationship between an indi-14
vidual and an entity where the individual— 15
(i) is a current customer; 16
(ii) has obtained a good or service 17
from the entity within the prior 18 18
months; or 19
(iii) has made an inquiry about the 20
products or services of the entity within 21
the prior 90 days. 22
(B) E
XCLUSION.—The term ‘‘direct rela-23
tionship’’ does not include a relationship— 24
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 19
•HR 2612 IH
(i) between an individual and a data 1
broker where the individual’s only connec-2
tion to the data broker is based on the in-3
dividual’s request— 4
(I) for the data broker to delete 5
the personal information of the indi-6
vidual; or 7
(II) to opt-out of the data bro-8
ker’s collection or use of personal in-9
formation, certain sales of such infor-10
mation, or its databases; or 11
(ii) required under any State or Fed-12
eral law related to the use of personal in-13
formation. 14
(6) H
ASH.—The term ‘‘hash’’ means to input 15
data to a cryptographic, one-way, collision resistant 16
function that maps a bit string of arbitrary length 17
to a fixed-length bit string to produce a cryp-18
tographically secure value. 19
(7) H
ASHED.—The term ‘‘hashed’’ means the 20
type of value produced by hashing data. 21
(8) H
UMAN SUBJECTS RESEARCH .—The term 22
‘‘human subjects research’’ means research that— 23
(A) an investigator (whether professional 24
or student) conducts on a living individual; and 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 20
•HR 2612 IH
(B) either— 1
(i) obtains information or biospeci-2
mens through intervention or interaction 3
with the individual, and uses, studies, or 4
analyzes the information or biospecimens; 5
or 6
(ii) obtains, uses, studies, analyzes, or 7
generates personal information or identifi-8
able biospecimens. 9
(9) P
ERSONAL INFORMATION .— 10
(A) I
N GENERAL.—The term ‘‘personal in-11
formation’’ means any information held by a 12
data broker, regardless of how the information 13
is collected, inferred, created, or obtained, that 14
is linked or reasonably linkable by the data 15
broker to a particular individual or consumer 16
device, including the following: 17
(i) Financial information, including 18
any bank account number, credit card 19
number, debit card number, or insurance 20
policy number. 21
(ii) A name, alias, home or other 22
physical address, online identifier, Internet 23
Protocol address, email address, phone 24
number, account name, State identification 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 21
•HR 2612 IH
card number, driver’s license number, 1
passport number, or an identifying number 2
on a government-issued identification. 3
(iii) Geolocation information. 4
(iv) Biometric information. 5
(v) The contents of, attachments to, 6
or parties to information, including with 7
respect to email, text messages, picture 8
messages, voicemails, audio conversations, 9
or video conversations. 10
(vi) Web browsing history, including 11
any search query. 12
(vii) Genetic sequencing information. 13
(viii) A device identifier, online identi-14
fier, persistent identifier, or digital 15
fingerprinting information. 16
(ix) Any inference drawn from any of 17
the information described in this para-18
graph that is used to create a profile about 19
an individual that reflects such individual’s 20
preferences, characteristics, psychological 21
trends, predispositions, behavior, attitudes, 22
intelligence, abilities, or aptitudes. 23
(x) Any other information determined 24
appropriate by the Commission. 25
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB 22
•HR 2612 IH
(B) LINKED OR REASONABLY LINKABLE .— 1
For purposes of subparagraph (A), information 2
is ‘‘linked or reasonably linkable’’ to a par-3
ticular individual or consumer device if the in-4
formation can be used on its own or in com-5
bination with other information held by or read-6
ily accessible to a data broker to identify a par-7
ticular individual or consumer device. 8
(10) P
ROCESS.—The term ‘‘process’’ means to 9
perform or direct the performance of an operation 10
on personal information, including the collection, 11
transmission, use, disclosure, analysis, prediction, or 12
modification of such personal information, whether 13
or not by automated means. 14
(11) S
ALT.—The term ‘‘salt’’ means to add a 15
random string of data to the input of a hash func-16
tion. 17
(12) U
NIFORM RESOURCE LOCATOR ; URL.—The 18
term ‘‘uniform resource locator’’ or ‘‘URL’’ means a 19
short string containing an address that refers to an 20
object on the web. 21
Æ
VerDate Sep 11 2014 01:24 Apr 08, 2025 Jkt 059200 PO 00000 Frm 00022 Fmt 6652 Sfmt 6301 E:\BILLS\H2612.IH H2612
kjohnson on DSK7ZCZBW3PROD with $$_JOB