119-HR-6292 Corporate Impact Analysis

Summary

Scope: Prohibits data brokers from collecting/using/maintaining or sharing personal data of known children and teens; mandates a 10‑day deletion workflow and public-facing process; enforces via FTC, state AGs, and a private right of action with statutory damages. Alignment/tension points: state data‑broker laws (e.g., CA Delete Act DROP system) and pending CFPB moves to pull data brokers under FCRA. Net: compliance and litigation risk for brokers/adtech; reduced availability of minors’ third‑party data; possible advantage to large first‑party platforms. [4]Congress.gov — Text status page for H.R.6292 — 119th Congress[3]CPPA — Accessible Deletion Mechanism – Delete Request and Opt-out Platform (DRO…[5]CFPB — CFPB proposes rule to stop data brokers from selling sensitive personal…

• Economic: Constrains supply of minors’ third‑party data (children + teens ≈ 73.1M; ~21.7% of population), pressuring data-broker revenue tied to youth segments; 10‑day deletion SLAs and registry/process builds raise costs; private suits add tail risk. [6]U.S. Census Bureau — Vintage 2024 Population Estimates by Characteristics (Pres…[7]U.S. Census Bureau — U.S. Census Bureau QuickFacts: United States (Age shares)
• Social: Likely reduces stalking, doxxing, and other harms linked to location and profile trading; however, age‑assurance frictions (and unsettled verification tech) may create access barriers and new data‑collection vectors. [8]Federal Trade Commission — FTC order prohibits X‑Mode/Outlogic from selling sen…[9]Federal Trade Commission — FTC denies application for new parental‑consent mech…
• Environmental: Any storage reductions from mandatory deletions are marginal relative to rapidly growing data‑center electricity demand; effects directionally modest. [10]Congressional Research Service — CRS In Focus/Report: Data Centers and Their En…[11]International Energy Agency — Energy and AI – Executive summary (global DC elec…

Economic Effects

We evaluate direct costs to covered entities (data brokers and dependent buyers), revenue impacts from curtailed youth data, and competitive dynamics for first‑party platforms vs. third‑party brokers.

• Data access contraction: Brokers would be barred from collecting/maintaining or selling minors’ data absent the narrow compliance exception, removing a population cohort (~21.7% of U.S. residents) from third‑party datasets and youth-targetable audiences. Expect downstream pressure on list rentals, modeled audiences, and identity graphs touching K‑12 and high‑school segments. [4]Congress.gov — Text status page for H.R.6292 — 119th Congress[7]U.S. Census Bureau — U.S. Census Bureau QuickFacts: United States (Age shares)
• Compliance build-outs: Mandated 10‑day deletion workflow, public request mechanism, inventory/identification of minors’ records, and record‑keeping mirror (and add to) state broker‑law obligations (e.g., California’s DROP system effective Jan 1, 2026). Firms should budget for request‑intake platforms, identity resolution tuning, and vendor management. [3]CPPA — Accessible Deletion Mechanism – Delete Request and Opt-out Platform (DRO…
• Order‑of‑magnitude costs (analog evidence): Prior privacy regimes suggest meaningful upfront and ongoing spend. A California SRIA estimated up to $55B in initial CCPA compliance costs across affected firms; while not directly transferable, it indicates scale for enterprise remediation when rights-to-delete and opt‑out are operationalized. [12]CNBC — Report: CCPA could cost companies up to $55B (initial compliance)
• Litigation exposure: The private right of action with statutory damages (≥$1,000 per violation; treble for willful) introduces class‑action risk. Analogous experience under Illinois BIPA before its 2024 amendment saw outsized liabilities, prompting statutory recalibration to a per‑person damages model. Expect plaintiffs to test statutory‑damage stacking under H.R. 6292. [13]Reuters — Illinois governor approves overhaul of BIPA reducing per‑scan damages…
• Competitive shifts: Restrictions on third‑party youth data can push spend toward first‑party platforms with logged‑in relationships, consistent with empirical findings from Apple’s ATT natural experiment and GDPR studies showing reduced ad effectiveness, higher concentration, and potential price effects. This may advantage large incumbents relative to smaller brokers/ad networks. [14]NBER — Digital Advertising and Market Structure: Implications for Privacy Regul…[15]Stanford SIEPR — Balancing act: Protecting privacy, protecting competition (GDP…
• Government and enterprise buyers: Agencies and regulated buyers who source commercial datasets from brokers (e.g., via VENNTEL/others) would need to verify minors’ data exclusion, adding diligence costs and narrowing supply. [16]ACLU — ACLU press release: DHS purchase and use of vast quantities of cell‑phon…[17]U.S. Government Accountability Office — GAO‑06‑421: Agency and reseller adheren…[18]U.S. Government Accountability Office — GAO‑08‑543T: Government use of data fro…

Social Effects

Primary social vector is risk reduction for minors from the commercial trade in sensitive and identifiable data; secondary vectors include access and equity impacts from age‑assurance practices.

• Risk reduction from sensitive‑location and profile sales: FTC actions against data brokers describe how location and segment sales can expose individuals to discrimination, harassment, and physical risk. Removing minors’ data from these streams likely reduces such exposure. [8]Federal Trade Commission — FTC order prohibits X‑Mode/Outlogic from selling sen…
• Benefits for vulnerable teens: CFPB highlights how brokered identifiers and financial signals are used by scammers and bad actors; curbs on minors’ data may mitigate targeting of at‑risk youth (e.g., debt‑distress households). [5]CFPB — CFPB proposes rule to stop data brokers from selling sensitive personal…
• Equity and access trade‑offs: Robust age‑assurance is unsettled. The FTC recently denied a proposed facial age‑estimation consent method under COPPA, reflecting continuing uncertainty; poorly designed screens can over‑collect data or block legitimate teen access. [9]Federal Trade Commission — FTC denies application for new parental‑consent mech…[19]Web search · turn 3 #3
• Interaction with state kids’ privacy laws: Courts have allowed some non‑content privacy provisions to proceed while blocking content‑based obligations in California’s AADC; non‑speech privacy restrictions on data collection/uses for children have fared better, informing likely litigation contours if H.R. 6292 is challenged. [20]ACLU — ACLU statement on Ninth Circuit decision re: California AADC (privacy vs…

Environmental Effects

Environmental impacts are indirect and likely modest relative to macro data‑center trends.

• Data minimization via mandated deletion could reduce stored volumes at brokers and downstream recipients. However, relative to U.S. data‑center electricity demand (≈176 TWh in 2023; ~4.4% of U.S. consumption), any energy savings from minor data‑retention cuts are likely small. [10]Congressional Research Service — CRS In Focus/Report: Data Centers and Their En…
• Global data‑center demand is projected to more than double by 2030, with AI a primary driver, suggesting the bill’s deletion requirements will not materially alter sector‑level energy trajectories. [11]International Energy Agency — Energy and AI – Executive summary (global DC elec…[21]Web search · turn 8 #4

Temporal Analysis

Sequencing likely outcomes by horizon, assuming enactment and a 180‑day effective date.

1. 0–6 months post‑enactment: Program design and capex/opex ramp for deletion workflows, request portals, age‑flagging logic, data‑map remediation, and processor contract updates; risk assessments for high‑risk datasets (e.g., MAIDs with school‑geo signals). [4]Congress.gov — Text status page for H.R.6292 — 119th Congress
2. 6–18 months: Increased auditing by buyers; vendors offer “minors‑clean” feeds; early private suits test statutory damages theories; some brokers exit youth segments; spend shifts toward first‑party/contextual. Empirical analogs (ATT/GDPR) suggest concentration increases when targeting precision falls. [14]NBER — Digital Advertising and Market Structure: Implications for Privacy Regul…[15]Stanford SIEPR — Balancing act: Protecting privacy, protecting competition (GDP…
3. 2–5 years: Enforcement layering with state regimes (e.g., CA’s DROP live Jan 1, 2026) and any finalized CFPB FCRA rule; normalization of contractual minors‑exclusion warranties; insurance repricing for privacy class actions. [3]CPPA — Accessible Deletion Mechanism – Delete Request and Opt-out Platform (DRO…[2]CFPB — Protecting Americans from Harmful Data Broker Practices (Regulation V) –…

Unintended Consequences

Risks and second‑order effects to monitor.

• More data collected to prove less: Age‑gating may drive collection of additional attributes (IDs, selfies, inferences) to avoid “constructive knowledge,” paradoxically increasing data exposure. Regulators have cautioned about proportional age‑assurance and false positives. [9]Federal Trade Commission — FTC denies application for new parental‑consent mech…[22]Web search · turn 9 #1
• Market concentration: Privacy constraints on third‑party data have empirically increased concentration and prices post‑ATT/GDPR; H.R. 6292 may further tilt advantage to platforms with large first‑party graphs. [14]NBER — Digital Advertising and Market Structure: Implications for Privacy Regul…[15]Stanford SIEPR — Balancing act: Protecting privacy, protecting competition (GDP…
• Patchwork compliance and non‑registration: Civil‑society reviews show hundreds of brokers failing to register consistently across states, implying enforcement gaps that could blunt intended protections and complicate compliance benchmarking. [23]Electronic Frontier Foundation — EFF/Privacy Rights Clearinghouse: Why are hund…
• Public‑sector spillovers: Agencies that have historically acquired brokered data will incur diligence costs to avoid minors’ records, or face supply constraints for certain investigative datasets. [18]U.S. Government Accountability Office — GAO‑08‑543T: Government use of data fro…[16]ACLU — ACLU press release: DHS purchase and use of vast quantities of cell‑phon…

Assessment

Institutional summary (regulatory risk vs. opportunity).

Overall stance: Neutral. For data brokers and dependent adtech/analytics buyers, the bill is moderately unfavorable due to compliance and litigation burdens and the loss of minors’ third‑party data. For child and teen privacy outcomes, credible enforcement experience (FTC/CFPB) suggests risk reduction in sensitive‑data trade. Competitive effects likely favor scaled first‑party platforms. Net macroeconomic effects are small relative to the digital economy, with costs concentrated in a narrow segment. [8]Federal Trade Commission — FTC order prohibits X‑Mode/Outlogic from selling sen…[5]CFPB — CFPB proposes rule to stop data brokers from selling sensitive personal…

Sourcing

Principal sources underpinning this analysis (see inline markers for precise attributions).

• Bill status/text: Congress.gov H.R. 6292. [1]Congress.gov — H.R.6292 — 119th Congress: Bill overview[4]Congress.gov — Text status page for H.R.6292 — 119th Congress
• State data‑broker regime: California Delete Act and DROP regulations. [3]CPPA — Accessible Deletion Mechanism – Delete Request and Opt-out Platform (DRO…[24]CPPA — CPPA announcement on California Delete Act (SB 362)
• Federal enforcement context: FTC broker/location cases; COPPA guidance and recent actions. [8]Federal Trade Commission — FTC order prohibits X‑Mode/Outlogic from selling sen…[25]Federal Trade Commission — FTC finalizes order with X‑Mode/Outlogic banning sal…[26]Federal Trade Commission — Kids’ Privacy (COPPA) overview and case list
• CFPB proposed rule to bring data‑broker practices under FCRA. [2]CFPB — Protecting Americans from Harmful Data Broker Practices (Regulation V) –…[5]CFPB — CFPB proposes rule to stop data brokers from selling sensitive personal…
• Population baselines: U.S. Census under‑18 counts and shares (Vintage 2024). [6]U.S. Census Bureau — Vintage 2024 Population Estimates by Characteristics (Pres…[7]U.S. Census Bureau — U.S. Census Bureau QuickFacts: United States (Age shares)
• Competition/effectiveness under privacy constraints: NBER and SIEPR analyses; ATT natural experiment; GDPR impacts. [14]NBER — Digital Advertising and Market Structure: Implications for Privacy Regul…[15]Stanford SIEPR — Balancing act: Protecting privacy, protecting competition (GDP…
• Data‑center energy context: CRS and IEA. [10]Congressional Research Service — CRS In Focus/Report: Data Centers and Their En…[11]International Energy Agency — Energy and AI – Executive summary (global DC elec…
• Litigation risk analog: Illinois BIPA amendment coverage. [13]Reuters — Illinois governor approves overhaul of BIPA reducing per‑scan damages…
• Government use of brokered data: GAO and ACLU FOIA records. [18]U.S. Government Accountability Office — GAO‑08‑543T: Government use of data fro…[16]ACLU — ACLU press release: DHS purchase and use of vast quantities of cell‑phon…