When you are online, you are the product. Data on every website you visit, video you watch, post you share, or message you send is collected and monetized. While relying on the mass collection of Americans’ personal and private information, this business model has made social media companies among the most valuable on earth. Yet for years, Americans have had few safeguards to protect their “virtual you,” jeopardizing their privacy and exposing them to the predations of fraudsters, criminals, and even foreign actors.

As far back as 2014, a single data broker reported to the Federal Trade Commission that it held information on 1.4 billion consumer transactions and over 700 billion data elements. Another broker’s database covered approximately $1 trillion in consumer transactions. Fast forward ten years and the problem had only magnified. In 2024, the FTC reported that none of the nine social media and streaming companies it studied—including Facebook, YouTube, Snapchat, and TikTok—provided a complete list of the third parties with which they shared user information. Many even collected personal information on non-users, meaning that Americans who took care to avoid these platforms could still have their data stored by them.

Online platforms use artificial intelligence to analyze the data they collect to infer biographical information on users, including their marital status, household income, location, and hobbies. Yet many lack written retention or deletion policies, leaving Americans with little ability to control their personal data once it has been collected. 

This mass invasion of Americans’ data privacy poses serious risks to their safety, especially from foreign criminals and state actors. The 2024 FTC report noted that social media platforms shared users’ personal information with third parties located in other countries, including Communist China and Hong Kong. A year earlier, researchers at Duke University discovered that personal information about thousands of U.S. service members—including their addresses and health conditions—could be purchased from data brokers for as little as 12 cents per record. Cybercriminals routinely target the companies that collect such data, with 2025seeing more than 3,300 data breaches or exposures that generated 278 million victim notices.

Americans—not Big Tech—should be in charge of their data, which is why I have led the fight in Congress for more than a decade to establish a national privacy standard. While serving in the U.S. House of Representatives in 2015, I led the Data Security and Breach Notification Act, bipartisan legislation that would have required entities holding Americans’ personal information to maintain security protections and to notify consumers following a data breach.

In one of my first acts as a U.S. Senator in 2019, I wrote to the FTC urging the agency to investigate Google and Facebook for potential privacy and data-security violations after several consumer data breaches. On Data Privacy Day in 2021, I reintroduced theBROWSER Act to require platforms to disclose their privacy policies in plain terms and to give consumers a real choice to opt in before sensitive data is collected or shared. And in 2020 and again in 2021, I joined Senator Wicker (R-Miss.) in introducing theSAFE DATA Act, comprehensive federal privacy legislation designed to give Americans greater control over their personal information, increase transparency, and strengthen data-security requirements.

Across my time in Congress, I have also led the effort to hold Big Tech accountable for treating children as a profit source and monetizing their information with little or no oversight. As Ranking Member of the Senate Commerce Subcommittee on Consumer Protection, Product Safety, and Data Security, I helped lead a 2021 hearing examining children’s online privacy and manipulative marketing practices. The following year, Senator Blumenthal (D-Conn.) and I introduced the bipartisan Kids Online Safety Act to ensure that online platforms are safe for children by design. This legislation passed out of the Senate Commerce Committee last month, and we look forward to getting it to President Trump’s desk as soon as possible.

Through it all, I have remained committed to establishing a national data privacy framework. Ten years after I introduced the Data Security and Breach Notification Act in the House, I chaired a hearing for the Senate Judiciary Subcommittee on Privacy, Technology, and the Law examining how a national data privacy framework can protect Americans’ personal information across state lines, empower consumers, and promote responsible innovation.

Americans have every right to protect their privacy—whether in the physical world or the virtual space. Big Tech has repeatedly failed to protect it. It’s on Congress to finally take action.