II
119THCONGRESS
1
STSESSION S. 1287
To establish a centralized system to allow individuals to request the simulta-
neous deletion of their personal information across all data brokers,
and for other purposes.
IN THE SENATE OF THE UNITED STATES
APRIL3, 2025
Mr. C
ASSIDY(for himself, Mr. OSSOFF, and Mr. LUJA´N) introduced the fol-
lowing bill; which was read twice and referred to the Committee on Com-
merce, Science, and Transportation
A BILL
To establish a centralized system to allow individuals to
request the simultaneous deletion of their personal infor-
mation across all data brokers, and for other purposes.
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2
SECTION 1. SHORT TITLE. 3
This Act may be cited as the ‘‘Data Elimination and 4
Limiting Extensive Tracking and Exchange Act’’ or the 5
‘‘DELETE Act’’. 6
SEC. 2. DATA DELETION REQUIREMENTS. 7
(a) D
ATABROKERANNUALREGISTRATION.— 8
(1) I
N GENERAL.— 9
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 2
•S 1287 IS
(A) REGULATIONS.—Not later than 1 year 1
after the date of enactment of this section, the 2
Commission shall promulgate regulations to re-3
quire any data broker to— 4
(i) not later than 18 months after the 5
date of enactment of this section, and an-6
nually thereafter, register with the Com-7
mission; and 8
(ii) subject to subparagraph (B), pro-9
vide the following information with such 10
registration: 11
(I) The name and primary phys-12
ical, email, and uniform resource loca-13
tor (URL) addresses of the data 14
broker. 15
(II) If the data broker permits 16
an individual to opt out of the data 17
broker’s collection or use of personal 18
information, certain sales of such in-19
formation, or its databases— 20
(aa) the method for request-21
ing an opt-out; 22
(bb) any limitations on the 23
type of data collection, uses, or 24
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 3
•S 1287 IS
sales for which an individual may 1
opt-out; and 2
(cc) whether the data broker 3
permits an individual to author-4
ize a third party to perform the 5
opt-out on the individual’s behalf. 6
(III) A response to a standard-7
ized form (as issued by the Commis-8
sion) specifying the types of informa-9
tion the data broker collects or ob-10
tains and the sources from which the 11
data broker obtains data. 12
(IV) A statement as to whether 13
the data broker implements a 14
credentialing process and, if so, a de-15
scription of that process. 16
(V) Any additional information 17
or explanation the data broker chooses 18
to provide concerning its data collec-19
tion practices. 20
(VI) Any other information de-21
termined appropriate by the Commis-22
sion. 23
(B) C
ONSTRUCTION.—Nothing in this 24
paragraph shall be construed as requiring a 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 4
•S 1287 IS
data broker to disclose any information that is 1
a trade secret or confidential information de-2
scribed in section 552(b)(4) of title 5, United 3
States Code. 4
(2) P
UBLIC AVAILABILITY.— 5
(A) I
N GENERAL.—The Commission shall 6
make the information described in paragraph 7
(1)(A) publicly available in a downloadable and 8
machine-readable format, except in the event 9
that the Commission— 10
(i) determines that the risk of making 11
such information available is not in the in-12
terest of public safety or welfare; and 13
(ii) provides a justification for such 14
determination. 15
(B) D
ISCLAIMER.—The Commission shall 16
include on the website of the Commission a dis-17
claimer that— 18
(i) the Commission cannot confirm 19
the accuracy of the responses provided by 20
the data brokers in the registration de-21
scribed in paragraph (1)(A); and 22
(ii) individuals may contact such data 23
brokers at their own risk. 24
(b) C
ENTRALIZEDDATADELETIONSYSTEM.— 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 5
•S 1287 IS
(1) ESTABLISHMENT.— 1
(A) I
N GENERAL.—Not later than 1 year 2
after the date of enactment of this section, the 3
Commission shall promulgate regulations to es-4
tablish a centralized system that— 5
(i) implements and maintains reason-6
able security procedures and practices (in-7
cluding administrative, physical, and tech-8
nical safeguards) appropriate to the nature 9
of the information and the purposes for 10
which the personal information will be 11
used, to protect individuals’ personal infor-12
mation from unauthorized use, disclosure, 13
access, destruction, or modification; 14
(ii) allows an individual, through a 15
single submission, to request that every 16
data broker who is registered under sub-17
section (a) and who maintains any per-18
sistent identifiers (as described in subpara-19
graph (B)(iii))— 20
(I) delete any personal informa-21
tion related to such individual held by 22
such data broker or affiliated legal en-23
tity of the data broker; and 24
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 6
•S 1287 IS
(II) unless otherwise specified by 1
the individual, discontinue any present 2
or future collection of personal infor-3
mation related to such individual; and 4
(iii) allows a registered data broker, 5
prior to the collection of any personal in-6
formation that is tied to a persistent iden-7
tifier for which a registry exists, to submit 8
a query to the centralized system to con-9
firm that the persistent identifier is not 10
subject to a deletion request described in 11
clause (ii). 12
(B) R
EQUIREMENTS.—The centralized sys-13
tem established in subparagraph (A) shall meet 14
the following requirements: 15
(i) The centralized system shall allow 16
an individual to request the deletion of all 17
personal information related to such indi-18
vidual and the discontinuation of any col-19
lection of such personal information related 20
to such individual through a single deletion 21
request. 22
(ii) The centralized system shall pro-23
vide a standardized form to allow an indi-24
vidual to make such request. 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 7
•S 1287 IS
(iii) Such standardized form shall in-1
clude the individual’s email, phone number, 2
physical address, and any other persistent 3
identifier determined by the Commission to 4
aid in the deletion request. 5
(iv) The centralized system shall auto-6
matically salt and hash all submitted infor-7
mation and allow the Commission to main-8
tain independent hashed registries of each 9
type of information obtained through such 10
form. 11
(v) The centralized system shall only 12
permit data brokers who are registered 13
with the Commission to submit hashed 14
queries to the independent hashed reg-15
istries described in clause (iv). 16
(vi) With respect to the independent 17
hashed registries described in clause (iv), 18
the salt shall be different for each such 19
registry and shall be made available to all 20
registered data brokers for the purposes of 21
submitting hashed queries, as described in 22
clause (v). 23
(vii) The centralized system shall 24
allow an individual to make such request 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 8
•S 1287 IS
using an internet website operated by the 1
Commission. 2
(viii) The centralized system shall not 3
charge the individual to make such re-4
quest. 5
(C) T
RANSITION.— 6
(i) I
N GENERAL.—Not later than 8 7
months after the effective date of the regu-8
lations promulgated under subparagraph 9
(A), each data broker shall— 10
(I) not less than once every 31 11
days, access the hashed registries 12
maintained by the Commission as de-13
scribed in subparagraph (B)(iv); and 14
(II) process any deletion request 15
associated with a match between such 16
hashed registries and the records of 17
the data broker. 18
(ii) FTC
GUIDANCE.—Not later than 19
6 months after the effective date of the 20
regulations promulgated under subpara-21
graph (A), the Commission shall publish 22
guidance on the process and standards to 23
which a data broker must adhere in car-24
rying out clause (i). 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 9
•S 1287 IS
(2) DELETION.— 1
(A) I
NFORMATION DELETION .— 2
(i) I
N GENERAL.—Subject to clause 3
(ii), not later than 31 days after accessing 4
the hashed registries described in para-5
graph (1)(B)(iv), a data broker and any 6
associated legal entity shall delete all per-7
sonal information in its possession related 8
to the individual making the request and 9
discontinue the collection of personal infor-10
mation related to such individual. Imme-11
diately following the deletion, the data 12
broker shall send an affirmative represen-13
tation to the Commission with the number 14
of records deleted pursuant to each match 15
with a value in the hashed registries. 16
(ii) E
XCLUSIONS.—In carrying out 17
clause (i), a data broker may retain, where 18
required, the following information: 19
(I) Any personal information that 20
is processed or maintained solely as 21
part of human subjects research con-22
ducted in compliance with any legal 23
requirements for the protection of 24
human subjects. 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 10
•S 1287 IS
(II) Any personal information 1
necessary to comply with a warrant, 2
subpoena, court order, rule, or other 3
applicable law. 4
(III) Any information necessary 5
for an activity described in subsection 6
(f)(3)(B), provided that the retained 7
information is used solely for any 8
such activity. 9
(iii) U
SE OF INFORMATION.—Any per-10
sonal information excluded under clause 11
(ii) may only be used for the purpose de-12
scribed in the applicable subclause of 13
clause (ii), and may not be used for any 14
other purpose, including marketing pur-15
poses. 16
(B) A
NNUAL REPORT.—Each data broker 17
registered under subsection (a) shall submit to 18
the Commission, on an annual basis, a report 19
on the completion rate with respect to the com-20
pletion of deletion requests under subparagraph 21
(A). 22
(C) A
UDIT.— 23
(i) I
N GENERAL.—Not later than 3 24
years after the date of enactment of this 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 11
•S 1287 IS
section, and every 3 years thereafter, each 1
data broker registered under subsection (a) 2
shall undergo an independent third party 3
audit to determine compliance with this 4
subsection. 5
(ii) A
UDIT REPORT.—Not later than 6 6
months after the completion of any audit 7
under clause (i), each such data broker 8
shall submit to the Commission any report 9
produced as a result of the audit, along 10
with any related materials. 11
(iii) M
AINTAIN RECORDS.—Each such 12
data broker shall maintain the materials 13
described in clause (ii) for a period of not 14
less than 6 years. 15
(3) A
NNUAL FEE.— 16
(A) I
N GENERAL.—Subject to subpara-17
graph (B), each data broker registered under 18
subsection (a) and who maintains any per-19
sistent identifiers (as described in paragraph 20
(1)(B)(iii)) shall pay to the Commission, on an 21
annual basis, a subscription fee determined by 22
the Commission to access the database. 23
(B) L
IMIT.—The amount of the subscrip-24
tion fee under subparagraph (A) may not ex-25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 12
•S 1287 IS
ceed 1 percent of the expected annual cost of 1
operating the centralized system and hashed 2
registries described in paragraph (1), as deter-3
mined by the Commission. 4
(C) A
VAILABILITY.—Any amounts col-5
lected by the Commission pursuant to this 6
paragraph shall be available without further ap-7
propriation to the Commission for the exclusive 8
purpose of enforcing and administering this 9
Act, including the implementation and mainte-10
nance of such centralized system and hashed 11
registries and the promotion of public aware-12
ness of the centralized system. 13
(c) E
NFORCEMENT BY THE COMMISSION.— 14
(1) U
NFAIR OR DECEPTIVE ACTS OR PRAC -15
TICES.—A violation of subsection (a) or (b) or a reg-16
ulation promulgated under this Act shall be treated 17
as a violation of a rule defining an unfair or decep-18
tive act or practice under section 18(a)(1)(B) of the 19
Federal Trade Commission Act (15 U.S.C. 20
57a(a)(1)(B)). 21
(2) P
OWERS OF THE COMMISSION .— 22
(A) I
N GENERAL.—The Commission shall 23
enforce this section in the same manner, by the 24
same means, and with the same jurisdiction, 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 13
•S 1287 IS
powers, and duties as though all applicable 1
terms and provisions of the Federal Trade 2
Commission Act (15 U.S.C. 41 et seq.) were in-3
corporated into and made a part of this Act. 4
(B) P
RIVILEGES AND IMMUNITIES .—Any 5
person who violates subsection (a) or (b) or a 6
regulation promulgated under this Act shall be 7
subject to the penalties and entitled to the 8
privileges and immunities provided in the Fed-9
eral Trade Commission Act (15 U.S.C. 41 et 10
seq.). 11
(C) A
UTHORITY PRESERVED .—Nothing in 12
this section shall be construed to limit the au-13
thority of the Commission under any other pro-14
vision of law. 15
(D) R
ULEMAKING.—The Commission shall 16
promulgate in accordance with section 553 of 17
title 5, United States Code, such rules as may 18
be necessary to carry out this section. 19
(d) S
TUDY ANDREPORT.— 20
(1) S
TUDY.—The Commission shall conduct a 21
study on the implementation and enforcement of this 22
section. Such study shall include— 23
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 14
•S 1287 IS
(A) an analysis of the effectiveness of the 1
centralized system established in subsection 2
(b)(1)(A); 3
(B) the number deletion requests sub-4
mitted annually using such centralized system; 5
(C) an analysis of the progress of coordi-6
nating the operation and enforcement of such 7
requests with similar systems established and 8
maintained by the various States; and 9
(D) any other area determined appropriate 10
by the Commission. 11
(2) R
EPORT.—Not later than 3 years after the 12
date of enactment of this section, and annually 13
thereafter for each of the next 4 years, the Commis-14
sion shall submit to the Committee on Commerce, 15
Science, and Transportation of the Senate and the 16
Committee on Energy and Commerce of the House 17
of Representatives a report containing— 18
(A) the results of the study conducted 19
under paragraph (1); 20
(B) a summary of any enforcement actions 21
taken pursuant to this Act; and 22
(C) recommendations for such legislation 23
and administrative action as the Commission 24
determines appropriate. 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 15
•S 1287 IS
(e) PREEMPTION.— 1
(1) I
N GENERAL.—The provisions of this Act 2
shall preempt any State privacy law only to the ex-3
tent that such State law is inconsistent with the pro-4
visions of this Act. 5
(2) G
REATER PROTECTION UNDER STATE 6
LAW.—For purposes of paragraph (1), a State pri-7
vacy law is not inconsistent with the provisions of 8
this Act if the protection such law affords any per-9
son is greater than the protection provided under 10
this Act, as determined by the Commission. 11
(f) D
EFINITIONS.—In this section: 12
(1) C
OMMISSION.—The term ‘‘Commission’’ 13
means the Federal Trade Commission. 14
(2) C
REDENTIALING PROCESS .—The term 15
‘‘credentialing process’’ means the practice of taking 16
reasonable steps to confirm— 17
(A) the identity of the entity with whom 18
the data broker has a direct relationship; 19
(B) that any data disclosed to the entity 20
by such data broker will be used for the de-21
scribed purpose of such disclosure; and 22
(C) that such data will not be used for un-23
lawful purposes. 24
(3) D
ATA BROKER.— 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 16
•S 1287 IS
(A) IN GENERAL .—The term ‘‘data 1
broker’’ means an entity that knowingly collects 2
or obtains the personal information of an indi-3
vidual with whom the entity does not have a di-4
rect relationship and then— 5
(i) uses the personal information to 6
perform a service for a third party; or 7
(ii) sells, licenses, trades, provides for 8
consideration, or is otherwise compensated 9
for disclosing personal information to a 10
third party. 11
(B) E
XCLUSION.—The term ‘‘data broker’’ 12
does not include an entity who solely uses, sells, 13
licenses, trades, provides for consideration, or is 14
otherwise compensated for disclosing personal 15
information for one or more of the following ac-16
tivities: 17
(i) Providing 411 directory assistance 18
or directory information services, including 19
name, address, and telephone number, on 20
behalf of or as a function of a tele-21
communications carrier. 22
(ii) Providing an individual’s publicly 23
available information if the information is 24
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 17
•S 1287 IS
being used by the recipient as it relates to 1
that individual’s business or profession. 2
(iii) Providing personal information to 3
a third party at the express direction of 4
the individual for a clearly disclosed single- 5
use purpose. 6
(iv) Providing or using personal infor-7
mation for assessing, verifying, or authen-8
ticating an individual’s identity, or for in-9
vestigating or preventing actual or poten-10
tial fraud. 11
(v) Gathering, preparing, collecting, 12
photographing, recording, writing, editing, 13
reporting, or publishing news or informa-14
tion that concerns local, national, or inter-15
national events or other matters of public 16
interest (as determined by the Commis-17
sion) for dissemination to the public. 18
(vi) Acting as a consumer reporting 19
agency (as defined in section 603(f) of the 20
Fair Credit Reporting Act (15 U.S.C. 21
1681a(f))). 22
(C) E
XCLUSION FROM SALE.— 23
(i) I
N GENERAL.—For purposes of 24
this paragraph, the term ‘‘sells’’ does not 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 18
•S 1287 IS
include a one-time or occasional sale of as-1
sets of an entity as part of a transfer of 2
control of those assets that is not part of 3
the ordinary conduct of the entity. 4
(ii) N
OTICE REQUIRED.—To meet the 5
exclusion criteria described in clause (i), an 6
entity must provide notice to the Commis-7
sion, in the manner determined appro-8
priate by the Commission, of any such one- 9
time or occasional sale of assets. 10
(4) D
ELETE.—The term ‘‘delete’’ means to re-11
move or destroy information such that the informa-12
tion is not maintained in human- or machine-read-13
able form and cannot be retrieved or utilized in such 14
form in the normal course of business. 15
(5) D
IRECT RELATIONSHIP.— 16
(A) I
N GENERAL.—The term ‘‘direct rela-17
tionship’’ means a relationship between an indi-18
vidual and an entity where the individual— 19
(i) is a current customer; 20
(ii) has obtained a good or service 21
from the entity within the prior 18 22
months; or 23
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 19
•S 1287 IS
(iii) has made an inquiry about the 1
products or services of the entity within 2
the prior 90 days. 3
(B) E
XCLUSION.—The term ‘‘direct rela-4
tionship’’ does not include a relationship— 5
(i) between an individual and a data 6
broker where the individual’s only connec-7
tion to the data broker is based on the in-8
dividual’s request— 9
(I) for the data broker to delete 10
the personal information of the indi-11
vidual; or 12
(II) to opt-out of the data bro-13
ker’s collection or use of personal in-14
formation, certain sales of such infor-15
mation, or its databases; or 16
(ii) required under any State or Fed-17
eral law related to the use of personal in-18
formation. 19
(6) H
ASH.—The term ‘‘hash’’ means to input 20
data to a cryptographic, one-way, collision resistant 21
function that maps a bit string of arbitrary length 22
to a fixed-length bit string to produce a cryp-23
tographically secure value. 24
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 20
•S 1287 IS
(7) HASHED.—The term ‘‘hashed’’ means the 1
type of value produced by hashing data. 2
(8) H
UMAN SUBJECTS RESEARCH .—The term 3
‘‘human subjects research’’ means research that— 4
(A) an investigator (whether professional 5
or student) conducts on a living individual; and 6
(B) either— 7
(i) obtains information or biospeci-8
mens through intervention or interaction 9
with the individual, and uses, studies, or 10
analyzes the information or biospecimens; 11
or 12
(ii) obtains, uses, studies, analyzes, or 13
generates personal information or identifi-14
able biospecimens. 15
(9) P
ERSONAL INFORMATION .— 16
(A) I
N GENERAL.—The term ‘‘personal in-17
formation’’ means any information held by a 18
data broker, regardless of how the information 19
is collected, inferred, created, or obtained, that 20
is linked or reasonably linkable by the data 21
broker to a particular individual or consumer 22
device, including the following information: 23
(i) Financial information, including 24
any bank account number, credit card 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 21
•S 1287 IS
number, debit card number, or insurance 1
policy number. 2
(ii) A name, alias, home or other 3
physical address, online identifier, Internet 4
Protocol address, email address, phone 5
number, account name, State identification 6
card number, driver’s license number, 7
passport number, or an identifying number 8
on a government-issued identification. 9
(iii) Geolocation information. 10
(iv) Biometric information. 11
(v) The contents of, attachments to, 12
or parties to information, including with 13
respect to email, text messages, picture 14
messages, voicemails, audio conversations, 15
or video conversations. 16
(vi) Web browsing history, including 17
any search query. 18
(vii) Genetic sequencing information. 19
(viii) A device identifier, online identi-20
fier, persistent identifier, or digital 21
fingerprinting information. 22
(ix) Any inference drawn from any of 23
the information described in this para-24
graph that is used to create a profile about 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 22
•S 1287 IS
an individual that reflects such individual’s 1
preferences, characteristics, psychological 2
trends, predispositions, behavior, attitudes, 3
intelligence, abilities, or aptitudes. 4
(x) Any other information determined 5
appropriate by the Commission. 6
(B) L
INKED OR REASONABLY LINKABLE .— 7
For purposes of subparagraph (A), information 8
is ‘‘linked or reasonably linkable’’ to a par-9
ticular individual or consumer device if the in-10
formation can be used on its own or in com-11
bination with other information held by or read-12
ily accessible to a data broker to identify a par-13
ticular individual or consumer device. 14
(10) P
ROCESS.—The term ‘‘process’’ means to 15
perform or direct the performance of an operation 16
on personal information, including the collection, 17
transmission, use, disclosure, analysis, prediction, or 18
modification of such personal information, whether 19
or not by automated means. 20
(11) S
ALT.—The term ‘‘salt’’ means to add a 21
random string of data to the input of a hash func-22
tion. 23
(12) U
NIFORM RESOURCE LOCATOR ; URL.—The 24
term ‘‘uniform resource locator’’ or ‘‘URL’’ means a 25
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00022 Fmt 6652 Sfmt 6201 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB 23
•S 1287 IS
short string containing an address that refers to an 1
object on the web. 2
Æ
VerDate Sep 11 2014 10:18 Apr 14, 2025 Jkt 000000 PO 00000 Frm 00023 Fmt 6652 Sfmt 6301 E:\BILLS\S1287.IS S1287
mprince on LAP1J3WLY3PROD with $$_JOB