Plain-language decipher of federal privacy statutes and the bills that would change them. Not legal advice. Scores are not a recommendation. The timeline is a separate reader tally.
Makes senseEnacted
Homebuyers Privacy Protection Act
H.R. 2808 · Public Law 119-36 · Signed Sep 5, 2025
Operative Rule. Consumer reporting agencies (credit bureaus) are prohibited from furnishing a consumer report containing a mortgage inquiry ("trigger lead") to third parties for marketing purposes, unless the recipient has a firm offer of credit and either the consumer's explicit prior consent or an existing mortgage or deposit account relationship with the consumer.
Status: Public Law 119-36 (Signed Sep 5, 2025; takes effect 180 days post-enactment)
Public tally
This bill
Analysis, scores, case, and remedy
Privacy effect
Stops credit bureaus from converting a confidential home-loan application credit check into an automated telemarketing pipeline sold to competing lenders.
The case for the function
Protects homebuyers from unsolicited robocalls and aggressive marketing barrage triggered solely by mandatory lender credit pulls, without adding new federal agencies.
The case against the tool
Restricts third-party mortgage brokers and non-originating refinancing firms from obtaining automated lead notifications to offer competing interest rates.
Bundled case comparison
No case bundled.
Contradiction with other items
No contradiction bundled. It is the consent pattern the other broker rules lack.
Scores · 1 narrow, 5 unchecked
Scope1
Warrant gap1
Speech risk1
Data grab2
Agency discretion1
Amendment to Restore Check
Extend the same explicit consent rule to other trigger-lead sales across consumer finance (such as auto loan inquiries and credit cards), not only home mortgages.
Call
This one makes sense. The harm is specific, the restriction is narrow, and citizens shopping for a home are not drafted into an unconsented telemarketing broadcast.
S. 4465 · Public Law 119-87 · Enacted Apr 30, 2026 · Sunset moved to Jun 12, 2026
Operative Rule. Authorizes the Attorney General and DNI to compel U.S. electronic communication service providers to assist in targeting non-U.S. persons reasonably believed to be located outside the U.S. for foreign intelligence collection without individual warrants. Communications of U.S. persons in contact with those targets are swept into the repository, and the FBI is permitted to query the database using U.S.-person identifiers without a criminal probable-cause warrant. Public Law 119-87 temporarily extended the statutory sunset from April 30 to June 12, 2026.
Status: Public Law 119-87 (Short sunset extension enacted Apr 30, 2026; longer renewal stalled)
Public tally
Established law
Proposed amendment
Analysis, scores, case, and remedy
Privacy effect
Preserves warrantless domestic search capability ("backdoor searches") over Americans' private international emails, messages, and calls stored in intelligence repositories.
The case for the function
Enables rapid foreign intelligence surveillance of non-citizens abroad to monitor foreign espionage, international terrorism, and advanced cyber-threat infrastructure.
The case against the tool
Bypasses the Fourth Amendment warrant requirement for domestic citizens whose private communications are intercepted incidentally, coupled with documented compliance violations in FBI domestic queries.
Unhinged / worst case
Domestic political opponents, whistleblowers, journalists, and activists who correspond with foreign sources or international colleagues have their domestic communications routinely searched and aggregated without judicial warrants or notice, using foreign-intelligence databases as an end-run around constitutional criminal protections.
Bundled case comparison
Carpenter does not decide Section 702 queries; the Supreme Court's Fourth Amendment geolocation precedent has not been extended by the court to foreign-intelligence backdoor searches.
Contradiction with other items
The extension keeps warrantless U.S.-person queries while ECPA’s content rule and Carpenter’s location rule require a warrant in ordinary criminal cases.
Scores · 1 narrow, 5 unchecked
Scope5
Warrant gap5
Speech risk3
Data grab5
Agency discretion4
Amendment to Restore Check
Mandate a probable-cause warrant or equivalent court order before any U.S.-person query, enforce tighter minimization protocols, and require unclassified public disclosures of domestic query counts.
Call
Invasive on the domestic-query point. Foreign-target collection can be a real intelligence function, but enacted short extensions preserve warrantless querying of Americans without settling the core Fourth Amendment objection.
Operative Rule. Enacts multi-billion appropriations for border security technologies within a broad reconciliation package: reporting cites approximately $2.77 billion allocated for autonomous surveillance towers (ASTs) with AI detection, and about $5.2 billion tied to ICE modernization, including real-time facial and biometric fingerprint matching systems. Tax and budget provisions in the statute are out of scope.
Status: Public Law 119-21 (Signed Jul 4, 2025; appropriations active)
Public tally
Established law
Proposed amendment
Analysis, scores, case, and remedy
Privacy effect
Deploys persistent automated computer vision, sensor arrays, and biometric identity matching along border corridors, capable of tracking domestic travelers without individual suspicion.
The case for the function
Supporters treat appropriations as essential capacity: automated towers monitor remote terrain where border agents cannot stand, and biometrics verify identities at checkpoints.
The case against the tool
Surveillance towers and biometric matching lack statutory retention caps, create persistent surveillance infrastructure, and risk expansion into interior domestic law enforcement.
Unhinged / worst case
The 100-mile border zone (encompassing roughly two-thirds of the U.S. population) becomes a permanent, real-time facial and vehicular recognition dragnet, logging the movements and associations of ordinary citizens and feeding interior deportation and policing algorithms with zero retention limits.
Bundled case comparison
No case bundled.
Contradiction with other items
Contradiction with the Ban Flock Act: the reconciliation money funds ongoing location and face matching; H.R. 10691 would bar federal plate-data purchase unless a later law allows a 48-hour use.
Scores · 1 narrow, 5 unchecked
Scope4
Warrant gap4
Speech risk2
Data grab5
Agency discretion4
Amendment to Restore Check
Enact a statutory data retention cap, ban federal purchases of commercial broker data, mandate judicial warrants for interior facial searches, and set an explicit sunset on tower and biometric matching appropriations.
Call
Mixed, and the biometric slice is the problematic part. Funding border infrastructure can be legitimate, but blank-check appropriations for AI towers and real-time face matching without retention caps turn checkpoint screening into a domestic surveillance net.
Operative Rule. Requires a probable-cause warrant for real-time interception of wire, oral, and electronic communications (Wiretap Act) and for stored communication content held by third-party service providers. However, under Section 2703(d) of the Stored Communications Act, law enforcement can compel non-content transactional records and metadata using court orders based on "reasonable grounds" rather than a full probable-cause warrant.
Status: Enacted 1986 (Active statutory framework; amended by CLOUD Act & USA FREEDOM)
Public tally
Established law
Proposed amendment
Analysis, scores, case, and remedy
Privacy effect
Governs the legal thresholds for government access to stored emails, subscriber logs, cloud files, and metadata held by commercial tech providers.
The case for the function
Established early foundational statutory privacy protections against unauthorized wiretapping while creating structured legal processes for criminal law enforcement.
The case against the tool
Enacted in 1986, creating outdated distinctions between content and metadata where sensitive geolocation logs and transactional trails can be seized under sub-warrant standards.
Unhinged / worst case
Law enforcement routinely reconstructs every citizen's daily associations, medical visits, dating profiles, and financial transactions by chaining together warrantless metadata subpoenas and 2703(d) orders with gag orders that permanently prevent users from ever knowing their digital lives were seized.
Bundled case comparison
Carpenter v. United States, 585 U.S. 296 (2018). U.S. Supreme Court. Holding: A warrant is required for at least seven days of historical cell-site location information (CSLI) from a wireless carrier. Why it matters: Establishes that digital metadata can reveal intimate details of life requiring Fourth Amendment warrant protection despite third-party holding.
Contradiction with other items
Contradiction: Section 2703(d) still authorizes some non-content records on a lower showing than Carpenter's probable-cause warrant rule.
Scores · 1 narrow, 5 unchecked
Scope4
Warrant gap3
Speech risk2
Data grab4
Agency discretion3
Amendment to Restore Check
Require a probable-cause warrant for all stored content and precise location records regardless of age or storage medium; make user notice the mandatory default.
Call
Mixed. A warrant is required for many content demands, but Section 2703(d) orders and non-content metadata demands remain thinner than a constitutional probable-cause warrant.
FISA business-records and pen-register authorities
50 U.S.C. §§ 1861–1862 and 1841–1846 (Distinct from Section 702)
Operative Rule. Authorizes FBI applications to the Foreign Intelligence Surveillance Court (FISC) for orders compelling production of tangible things (business records) and the installation of pen register / trap and trace (PR/TT) devices to collect dialing, routing, addressing, and signaling metadata in foreign intelligence and counter-terrorism investigations, under a statutory relevance standard lower than criminal probable cause.
Status: Enacted Authorities (Reformed by USA FREEDOM Act; certain bulk provisions lapsed)
Public tally
Established law
Proposed amendment
Analysis, scores, case, and remedy
Privacy effect
Permits secret court orders compelling commercial records, financial transactions, travel logs, and routing metadata without ordinary criminal Fourth Amendment showings.
The case for the function
Equips foreign counter-intelligence and anti-espionage investigators to map overseas adversary networks before formal criminal indictment thresholds can be met.
The case against the tool
Relies on secret judicial oversight with lower evidentiary thresholds than ordinary criminal warrants, leaving domestic business and communication records vulnerable to overbroad collection.
Unhinged / worst case
Under broad "relevance" certifications, secret FISC orders compel telecommunications, cloud, and financial institutions to feed real-time routing and transaction streams into classified intelligence hubs, creating shadow surveillance files on lawful domestic organizations.
Bundled case comparison
No case bundled.
Contradiction with other items
Contradiction: Permits metadata collection on a statutory showing lower than ECPA’s standard criminal rules or Carpenter's Fourth Amendment warrant requirement.
Scores · 1 narrow, 5 unchecked
Scope4
Warrant gap4
Speech risk2
Data grab4
Agency discretion4
Amendment to Restore Check
Align the statutory showing with Fourth Amendment probable cause whenever the target or subject of the record is a U.S. person.
Call
Mixed to invasive where they allow collection without the showing required in an ordinary criminal case. A constitutional check requires probable cause when targeting domestic persons.
S. 1748 / H.R. 6484 · 119th Congress · Senate fast-track blocked Sep 30, 2026
Operative Rule. Imposes a statutory "duty of reasonable care" on covered online platforms to prevent and mitigate a listed set of mental health and behavioral harms to minors, enforced primarily by the FTC. The House companion draft is narrower, limits safeguards to users known to be minors, and explicitly states it does not mandate age verification. Sen. Rand Paul blocked a Senate unanimous-consent vote on Sep 30, 2026.
Pressures platforms to infer or verify the age of every user to avoid FTC liability, driving mass adoption of identity uploads, facial estimation, or phone verification.
The case for the function
Sponsors argue platforms will not curb addictive algorithmic feeds, dark patterns, or stranger contact targeting youth unless affirmative legal liability attaches.
The case against the tool
A subjective harm list turns the FTC into a speech gatekeeper and compels universal age-verification checks that strip internet users of online anonymity.
Unhinged / worst case
Every internet user must upload a government ID or submit to biometric facial scans just to access basic news sites, social media, or online forums, while politically appointed regulators pressure platforms to filter lawful LGBTQ+, reproductive, or dissident political content under the guise of "minor mental health harms."
Bundled case comparison
No case bundled.
Contradiction with other items
Contradiction with the Homebuyers Act: one bill uses consent before a sale of a named record; the Senate KOSA duty pushes platforms to infer age, which collects identity the Homebuyers Act tries not to spread.
Scores · 1 narrow, 5 unchecked
Scope4
Warrant gap2
Speech risk5
Data grab4
Agency discretion5
What to Contest in the Mechanism
Contest the open-ended harm list and any statutory age-inference duty. Prefer concrete technical product rules: non-algorithmic default feeds, stranger contact blocks, and an outright ban on selling minors' behavioral data.
Call
Invasive as drafted in the Senate. The goal is intelligible, but a duty of care linked to subjective harms hands broad censorship power to the FTC and forces mass identity collection.
Operative Rule. Prohibits federal agencies and contractors from operating automatic license-plate readers (ALPR) or purchasing vehicular location records from state/local police, parking operators, or commercial data brokers, unless a future law authorizes a specific use with a mandatory 48-hour data retention cap. Toll collection is exempted. Withholds certain federal law enforcement grant funds from municipal police departments that continue operating ALPR camera networks.
Status: Proposed (Introduced Oct 2026; referred to committee)
Public tally
This bill
Analysis, scores, case, and remedy
Privacy effect
Eliminates federal dragnet vehicular tracking by banning federal ALPR deployments and closing the commercial data-broker purchase workaround.
The case for the function
Stops federal agencies from circumventing Fourth Amendment warrant requirements through commercial plate databases and caps data retention at 48 hours.
The case against the tool
Conditioning federal grants penalizes municipal police departments that utilize automated plate readers for real-time stolen-vehicle or amber alert recovery.
Bundled case comparison
No case bundled.
Contradiction with other items
Contradiction with Border Biometrics in H.R. 1: H.R. 10691 would bar federal plate-data purchase and mandate a 48-hour cap, while H.R. 1 appropriates funds for permanent ongoing location sensors and biometric matching without statutory retention limits.
Scores · 1 narrow, 5 unchecked
Scope3
Warrant gap1
Speech risk1
Data grab2
Agency discretion2
What to Contest in the Mechanism
Contest only the punitive grant withholding on local police. Maintain the federal use ban, the broker purchase prohibition, and the 48-hour retention limit.
Call
Makes sense. Closes the purchase loophole and caps retention if authorized. The invasive risk is the municipal grant cutoff, not the federal-use ban.
Operative Rule. Prohibits the development, training, and deployment of advanced artificial intelligence models above an unspecified frontier capability threshold until a new federal Department of Artificial Intelligence is established to supervise frontier systems, conduct intrusive safety audits, and exercise unilateral authority aimed at the seizure or destruction of artificial superintelligence systems.
Status: Proposed (Introduced Sep 2026; referred to committee)
Public tally
This bill
Analysis, scores, case, and remedy
Privacy effect
Creates sweeping federal regulatory authority to audit private computational clusters, inspect proprietary algorithms, and monitor technical research without judicial warrants.
The case for the function
Sponsors argue private technology labs should not unilaterally deploy frontier systems capable of catastrophic autonomous cyber-attacks or critical infrastructure disruption.
The case against the tool
"Superintelligence" lacks an objective technical definition; granting an executive agency power to veto development and destroy systems establishes an arbitrary computational research veto.
Unhinged / worst case
An executive department with undefined destruction powers carries out warrantless physical and digital raids against open-source developers, academic research labs, and private server farms, declaring standard open-weight neural networks to be "illegal superintelligence."
Bundled case comparison
No case bundled.
Contradiction with other items
Contradiction with the AI Tax and Work Protection Act: both create a new supervisor or ratchet over model operations without a privacy check; do not treat either as a privacy statute.
Scores · 1 narrow, 5 unchecked
Scope5
Warrant gap2
Speech risk4
Data grab3
Agency discretion5
What to Contest in the Mechanism
Contest the undefined threshold and the unilateral administrative destruction mandate. A separate transparency bill focused on incident reporting is the narrower alternative.
Call
Invasive. A blanket research veto until a new federal bureaucracy is formed sets a dangerous precedent for government control over general-purpose computational research.
Operative Rule. Imposes an excise tax on large artificial intelligence firms based on computational token volume or AI service revenue (whichever is higher), features an automatic tax rate escalator indexed to the national unemployment rate, and creates a Work Protection Administration inside the Department of Labor to oversee workforce displacement metrics.
Mandates continuous federal auditing of software compute usage, user token consumption logs, and internal enterprise automation processes.
The case for the function
Captures automation rents from compute-heavy technologies to fund transition benefits and retraining programs for displaced workers.
The case against the tool
Token counts are a crude proxy for harm, and an automatic tax ratchet punishes technological efficiency during broader macroeconomic recessions.
Unhinged / worst case
To verify token tax obligations and unemployment ratchet compliance, the Labor Department installs mandatory telemetry probes and logging taps across private cloud providers, tracking and auditing every computational prompt, query, and software workflow in real time.
Bundled case comparison
No case bundled.
Contradiction with other items
Contradiction with Superintelligence Ban: both create a new supervisor or ratchet over model operations without a privacy check; do not treat either as a privacy statute.
Scores · 1 narrow, 5 unchecked
Scope3
Warrant gap1
Speech risk2
Data grab2
Agency discretion4
What to Contest in the Mechanism
Contest the unemployment ratchet and the new Labor agency; treat revenue through normal corporate taxation rather than token-level telemetry mandates.
Call
Mixed, and only in this index because token metering is a data and process mandate. Taxing concentrated economic rents can make sense, but indexing rates to unemployment and building a new agency around it does not.
Notices of what should be known about a law, a proposed bill, or a check on an established statute. Support means you are for that item. Disapprove means you are against it, including laws already in force.
Checking session…
Makes senseLaw or billBundled baseline
Homebuyers Privacy Protection Act
H.R. 2808 · Public Law 119-36 · Signed Sep 5, 2025
Consumer reporting agencies (credit bureaus) are prohibited from furnishing a consumer report containing a mortgage inquiry ("trigger lead") to third parties for marketing purposes, unless the recipient has a firm offer of credit and either the consumer's explicit prior consent or an existing mortgage or deposit account relationship with the consumer.
This one makes sense. The harm is specific, the restriction is narrow, and citizens shopping for a home are not drafted into an unconsented telemarketing broadcast.
InvasiveEstablished lawBundled baseline
FISA Section 702 extensions
S. 4465 · Public Law 119-87 · Enacted Apr 30, 2026 · Sunset moved to Jun 12, 2026
Authorizes the Attorney General and DNI to compel U.S. electronic communication service providers to assist in targeting non-U.S. persons reasonably believed to be located outside the U.S. for foreign intelligence collection without individual warrants. Communications of U.S. persons in contact with those targets are swept into the repository, and the FBI is permitted to query the database using U.S.-person identifiers without a criminal probable-cause warrant. Public Law 119-87 temporarily extended the statutory sunset from April 30 to June 12, 2026.
InvasiveProposed amendmentBundled baseline
Proposed check · FISA Section 702 extensions
S. 4465 · Public Law 119-87 · Enacted Apr 30, 2026 · Sunset moved to Jun 12, 2026
Mandate a probable-cause warrant or equivalent court order before any U.S.-person query, enforce tighter minimization protocols, and require unclassified public disclosures of domestic query counts.
MixedEstablished lawBundled baseline
Border biometrics inside the reconciliation law
H.R. 1 · Public Law 119-21 · Signed Jul 4, 2025
Enacts multi-billion appropriations for border security technologies within a broad reconciliation package: reporting cites approximately $2.77 billion allocated for autonomous surveillance towers (ASTs) with AI detection, and about $5.2 billion tied to ICE modernization, including real-time facial and biometric fingerprint matching systems. Tax and budget provisions in the statute are out of scope.
MixedProposed amendmentBundled baseline
Proposed check · Border biometrics inside the reconciliation law
H.R. 1 · Public Law 119-21 · Signed Jul 4, 2025
Enact a statutory data retention cap, ban federal purchases of commercial broker data, mandate judicial warrants for interior facial searches, and set an explicit sunset on tower and biometric matching appropriations.
Requires a probable-cause warrant for real-time interception of wire, oral, and electronic communications (Wiretap Act) and for stored communication content held by third-party service providers. However, under Section 2703(d) of the Stored Communications Act, law enforcement can compel non-content transactional records and metadata using court orders based on "reasonable grounds" rather than a full probable-cause warrant.
Require a probable-cause warrant for all stored content and precise location records regardless of age or storage medium; make user notice the mandatory default.
MixedEstablished lawBundled baseline
FISA business-records and pen-register authorities
50 U.S.C. §§ 1861–1862 and 1841–1846 (Distinct from Section 702)
Authorizes FBI applications to the Foreign Intelligence Surveillance Court (FISC) for orders compelling production of tangible things (business records) and the installation of pen register / trap and trace (PR/TT) devices to collect dialing, routing, addressing, and signaling metadata in foreign intelligence and counter-terrorism investigations, under a statutory relevance standard lower than criminal probable cause.
MixedProposed amendmentBundled baseline
Proposed check · FISA business-records and pen-register authorities
50 U.S.C. §§ 1861–1862 and 1841–1846 (Distinct from Section 702)
Align the statutory showing with Fourth Amendment probable cause whenever the target or subject of the record is a U.S. person.
InvasiveLaw or billBundled baseline
Kids Online Safety Act (KOSA)
S. 1748 / H.R. 6484 · 119th Congress · Senate fast-track blocked Sep 30, 2026
Imposes a statutory "duty of reasonable care" on covered online platforms to prevent and mitigate a listed set of mental health and behavioral harms to minors, enforced primarily by the FTC. The House companion draft is narrower, limits safeguards to users known to be minors, and explicitly states it does not mandate age verification. Sen. Rand Paul blocked a Senate unanimous-consent vote on Sep 30, 2026.
What to weigh: Contest the open-ended harm list and any statutory age-inference duty. Prefer concrete technical product rules: non-algorithmic default feeds, stranger contact blocks, and an outright ban on selling minors' behavioral data.
Makes senseLaw or billBundled baseline
Ban Flock Act
H.R. 10691 · Introduced Oct 2026
Prohibits federal agencies and contractors from operating automatic license-plate readers (ALPR) or purchasing vehicular location records from state/local police, parking operators, or commercial data brokers, unless a future law authorizes a specific use with a mandatory 48-hour data retention cap. Toll collection is exempted. Withholds certain federal law enforcement grant funds from municipal police departments that continue operating ALPR camera networks.
What to weigh: Contest only the punitive grant withholding on local police. Maintain the federal use ban, the broker purchase prohibition, and the 48-hour retention limit.
Prohibits the development, training, and deployment of advanced artificial intelligence models above an unspecified frontier capability threshold until a new federal Department of Artificial Intelligence is established to supervise frontier systems, conduct intrusive safety audits, and exercise unilateral authority aimed at the seizure or destruction of artificial superintelligence systems.
What to weigh: Contest the undefined threshold and the unilateral administrative destruction mandate. A separate transparency bill focused on incident reporting is the narrower alternative.
MixedLaw or billBundled baseline
AI Tax and Work Protection Act
H.R. 10044 · Introduced 2026 · Not Enacted
Imposes an excise tax on large artificial intelligence firms based on computational token volume or AI service revenue (whichever is higher), features an automatic tax rate escalator indexed to the national unemployment rate, and creates a Work Protection Administration inside the Department of Labor to oversee workforce displacement metrics.
What to weigh: Contest the unemployment ratchet and the new Labor agency; treat revenue through normal corporate taxation rather than token-level telemetry mandates.
Bundled civic privacy database
All nine enacted laws and watchlist bills shipped with this reader.
No case bundled. Unchecked supervisor over computing models.
AI Tax and Work Protection Act H.R. 10044
Proposed
Mixed
Token volume/revenue tax indexed to unemployment; new Labor agency.
Contest unemployment ratchet & new agency; use standard corporate tax.
No case bundled. Data and process mandate without privacy checks.
Method and civic scoring
A statute can name a real problem and still use an overbroad tool. Bill Lens separates the claimed harm from the mechanism. This is civic analysis, not legal advice, and the score is not a vote recommendation.
Makes sense. A defined harm, a limited set of people bound, and a real check: consent, a probable-cause warrant, a short retention sunset, or a private right of action.
Mixed. A defensible core tied to money, discretion, or scope that outruns the problem.
Invasive. Warrantless collection, speech pressure, or a duty that cannot be met without identifying everyone.
Scores run from 1 (narrow and checked) to 5 (broad and unchecked) across scope, warrant gap, speech risk, data grab, and agency discretion. Case notes are bundled summaries. A live refresh changes only the status line and the Congress.gov record. It does not rewrite the decipher, the scores, or the call.