Twenty federal privacy-related bills are moving through the 119th Congress as of the International Association of Privacy Professionals' September 2025 tracker update, and only two of them, both narrow single-issue laws rather than a broad privacy standard, have been signed. That gap between "bills introduced" and "bills enacted" is the entire story of federal privacy legislation in the United States: dozens of attempts every session, and still no comprehensive national privacy law on the books.
This post counts every bill currently tracked, shows what actually became law, and traces why the two most serious recent attempts at a comprehensive standard, the American Data Privacy and Protection Act and the American Privacy Rights Act, both died before reaching a full floor vote.
How many federal privacy bills are in Congress right now?
The IAPP's Westin Research Center tracks 20 privacy-related bills introduced in the 119th Congress as of its September 2025 update, organized into five categories: consumer, workplace, health, financial, and children's/educational privacy. Children's and educational privacy is the largest single category with 6 bills, followed by financial privacy with 5, consumer privacy with 4, health privacy with 3, and workplace privacy with 2.
Figure 1: Category breakdown of the 20 federal privacy bills the IAPP tracked in the 119th Congress. Source: IAPP US Federal Privacy Legislation Tracker, updated September 2025.
None of the 20 tracked bills is a comprehensive consumer data privacy standard along the lines of the EU's GDPR or California's CCPA. Every one addresses a narrower slice of privacy: deepfakes, genetic data, reproductive health records, mortgage credit checks, or children's social media accounts. That is a change from the prior two Congresses, each of which saw a genuine attempt at a broad federal standard introduced, and both of which failed.
Which federal privacy bills have actually become law?
Two of the 20 tracked bills cleared both chambers and were signed. The TAKE IT DOWN Act, introduced by Sen. Ted Cruz, R-Texas, and Rep. Maria Elvira Salazar, R-Fla., criminalizes the nonconsensual distribution of intimate images, including AI-generated deepfakes, and requires platforms to remove reported content. It was signed into law on 19 May 2025. The Homebuyers Privacy Protection Act, sponsored by Rep. John W. Rose, R-Tenn., and Sen. Jack Reed, D-RI, restricts mortgage lenders' so-called "trigger lead" data sales by amending the Fair Credit Reporting Act, and it was signed on 5 September 2025.
| Bill | Signed | What it covers |
|---|---|---|
| TAKE IT DOWN Act | 19 May 2025 | Nonconsensual intimate images and deepfakes |
| Homebuyers Privacy Protection Act | 5 September 2025 | Mortgage "trigger lead" credit data sales |
Source: IAPP US Federal Privacy Legislation Tracker, updated September 2025.
Both laws are narrow and reactive, responding to a specific harm rather than setting baseline rules for how any company handles personal data. Of the 20 bills the IAPP tracked, 18 were still pending as of the September 2025 snapshot.
Figure 2: Share of the 20 tracked bills that reached the president's desk versus those still pending. Source: IAPP US Federal Privacy Legislation Tracker, updated September 2025.
Why has comprehensive federal privacy legislation failed for 20 years?
Efforts to pass a comprehensive federal privacy law "after over 20 years of fruitless debate" is how the Harvard Journal of Law and Technology described the American Data Privacy and Protection Act in an October 2022 analysis, and the description still holds. Congress has introduced dozens of broad privacy bills since the early 2000s, and every one has stalled, been narrowed into a sector-specific law, or expired unpassed when its Congress adjourned.
The ADPPA came the closest. Introduced by Rep. Frank Pallone Jr., D-NJ, on 21 June 2022 as H.R. 8152, with Republican co-sponsors including then-ranking member Cathy McMorris Rodgers, R-WA, the bill advanced out of the House Energy and Commerce Committee on a 53-2 vote on 20 July 2022, a rare near-unanimous bipartisan margin for privacy legislation. It never received a floor vote in the full House, and under congressional rules a bill that has not passed both chambers dies automatically at adjournment. The ADPPA died with the end of the 117th Congress on 3 January 2023.
Figure 3: Milestones in the two most recent comprehensive federal privacy bill attempts, alongside the two narrow bills that did pass. Source: GovInfo bill records, TechPolicy.Press bill tracker, IAPP tracker.
How close did the ADPPA get to becoming law?
A federal privacy bill has to clear several stages before it can be signed, and most tracked bills, including all 18 still-pending bills in the current Congress, stop at the first or second stage. A bill needs a committee hearing, then a scheduled markup, then a committee vote, then a floor vote in each chamber, before it reaches the president's desk.
Figure 4: The stages a federal privacy bill must clear, mapped against where the ADPPA and APRA each stopped. Source: House Energy and Commerce Committee records, as summarized by the Harvard Journal of Law and Technology and TechPolicy.Press.
The ADPPA is the only recent comprehensive privacy bill to reach stage three, a full committee vote. It stopped at stage four: no House leadership ever scheduled the floor vote needed to send it to the Senate. You can generate a privacy policy built around current US disclosure norms rather than waiting on a federal standard that has not materialized after two decades of attempts.
What happened to the American Privacy Rights Act?
The APRA never even reached the ADPPA's stage three. Sen. Maria Cantwell, D-WA, and Rep. Cathy McMorris Rodgers, R-WA, unveiled draft legislation on 8 April 2024. A revised version cleared the House Energy and Commerce Subcommittee on Innovation, Data, and Commerce by voice vote on 23 May 2024, and the bill was formally introduced as H.R. 8818 on 25 June 2024 with cosponsors Frank Pallone Jr., D-NJ, Gus Bilirakis, R-FL, and Jan Schakowsky, D-IL, according to the bill's GovInfo record. A full committee markup was scheduled for 27 June 2024 but was canceled after several advocacy groups and committee members withdrew support over provisions on state-law preemption and a private right of action. The APRA expired with the 118th Congress in January 2025.
Figure 5: The two comprehensive attempts stalled in the upper-right quadrant; the two enacted bills both sit in the narrow-and-signed quadrant. Source: GovInfo bill records, House Energy and Commerce Committee records, TechPolicy.Press.
No comprehensive successor to the APRA has been introduced in the 119th Congress. This mirrors the pattern seen at the state level, where individual states have moved ahead of Congress; see our full tracker of the 20 US state privacy laws now in effect for the state-by-state comparison.
Is Congress getting closer to passing a bill, or further away?
Judged by signatures, 2025 was the most productive year for federal privacy legislation in over a decade, with two bills signed within four months of each other. Judged by scope, it was the least ambitious: neither enacted bill sets rules for how a typical business collects, stores, or sells personal data the way the ADPPA or the APRA would have.
Figure 6: Both bills that became law in the 119th Congress were signed within a five-month span in 2025. Source: IAPP US Federal Privacy Legislation Tracker, updated September 2025.
That combination, narrow bills passing while comprehensive ones stall, has held for every Congress since the ADPPA. It means the practical rulebook for handling personal data in the US is still whatever the effective state privacy laws require, not a federal floor.
How does the current Congress compare on category focus?
| Category | Bills tracked | Share of 20 |
|---|---|---|
| Children's/educational privacy | 6 | 30% |
| Financial privacy | 5 | 25% |
| Consumer privacy | 4 | 20% |
| Health privacy | 3 | 15% |
| Workplace privacy | 2 | 10% |
Source: IAPP US Federal Privacy Legislation Tracker, updated September 2025.
Children's privacy draws the most bills by a wide margin, driven by bipartisan concern over social media and minors, evident in bills like the Kids Off Social Media Act and the Kids Online Safety Act. Financial privacy is a close second, largely bills responding to specific data-broker and credit-reporting practices rather than a general financial privacy standard. For a look at how the underlying state law patchwork has grown while Congress has debated, see our 2020-2026 state privacy law effective-date timeline.
The Bottom Line
Twenty bills, two laws, zero comprehensive standards: that is the current state of federal privacy legislation in the 119th Congress. The two bills that did pass, the TAKE IT DOWN Act and the Homebuyers Privacy Protection Act, both responded to a specific, narrow harm rather than establishing baseline data-handling rules. The two bills that would have set those baseline rules, the ADPPA in 2022 and the APRA in 2024, both stalled before a floor vote, the ADPPA after clearing committee 53-2 and the APRA before even reaching a full committee markup. Until that changes, the actual compliance requirement for any US business handling personal data remains the state-level patchwork, not a federal statute, and a privacy policy needs to reflect whichever state laws actually apply to it.
Frequently Asked Questions
How many federal privacy bills are currently in Congress? 20 federal privacy-related bills were being tracked in the 119th Congress (2025-2026) as of the IAPP's September 2025 tracker update, spanning consumer, workplace, health, financial, and children's/educational privacy.
Has Congress ever passed a comprehensive federal privacy law? No. The closest attempt, the American Data Privacy and Protection Act, passed the House Energy and Commerce Committee 53-2 in July 2022 but never received a floor vote and died when the 117th Congress adjourned on 3 January 2023.
What happened to the American Privacy Rights Act? The American Privacy Rights Act, introduced as H.R. 8818 on 25 June 2024, had its planned 27 June 2024 committee markup canceled and expired at the end of the 118th Congress in January 2025 without a committee vote.
Which federal privacy bills have actually been signed into law? Two of the 20 bills tracked in the 119th Congress became law: the TAKE IT DOWN Act on 19 May 2025 and the Homebuyers Privacy Protection Act on 5 September 2025, both narrow single-issue bills rather than a comprehensive privacy standard.
Where the Numbers Come From
- IAPP. Fazlioglu, M. (2025). "US Federal Privacy Legislation Tracker: Introduced in the 119th Congress (2025-2026)." 20 bills tracked across 5 categories, updated September 2025.
- GovInfo, US Government Publishing Office. H.R. 8152, "American Data Privacy and Protection Act," introduced 21 June 2022, sponsor Rep. Frank Pallone Jr.
- Harvard Journal of Law and Technology Digest. Zhao, Q. (2022). "American Data Privacy and Protection Act: Latest, Closest Yet Still Fragile Attempt Toward Comprehensive Federal Privacy Legislation." 53-2 committee vote, 20 July 2022.
- GovInfo, US Government Publishing Office. H.R. 8818, "American Privacy Rights Act of 2024," introduced 25 June 2024, sponsor Rep. Cathy McMorris Rodgers.
- Tech Policy Press. "Tracker: The American Privacy Rights Act of 2024." Draft unveiled 8 April 2024, subcommittee voice vote 23 May 2024, markup canceled 27 June 2024.
Note: All figures verified as of September 2025 for the IAPP tracker and August 2026 for bill-status details. The 119th Congress runs through January 2027, and this post's bill counts and status will be refreshed at least twice a year to track new introductions, committee action, and any comprehensive successor bill.
