US House advances three data bills

The U.S. House of Representatives is moving three bills with direct implications for personal data, digital infrastructure, and AI compliance. H.R.10207, known as the Child Privacy Protection Mandate or GUARDIAN Act, would require verifiable parental consent before collecting or using data from children under 16. H.R.10284 seeks to limit the commercial use of smart meter data. H.R.7885 would create a grant pilot for cybersecurity training.

What would the GUARDIAN Act change?

H.R.10207 would require covered platforms to obtain verifiable parental consent before collecting or using personal data from children under 16. It would also let parents withdraw that consent at any time and require deletion of the data when the child turns 16, unless parents request retention. According to Praveta, the mandate would take effect 18 months after enactment.

The bill was introduced in the House on Sept. 1, 2026, and referred to the Energy and Commerce Committee. AI Law Tracker says it has not moved beyond that referral, so the text could still change during committee work.

Quorum Civic adds that violations would be treated as unfair or deceptive practices under FTC oversight, with possible action from state attorneys general. It also says platforms would have to provide a download option for the child’s data and stop processing, or close the account, within 10 days of the parent’s withdrawal of consent.

Who would the smart meter data bill apply to?

H.R.10284, also identified as the Smart Meter Data Privacy Protection Act and Consumer Data Privacy Protection, targets state-regulated electric utilities that are not wholly U.S.-owned. The bill, now under legislative review, aims to restrict the sale, licensing, or monetization of detailed electricity consumption data collected by smart meters.

Quorum Civic says the exceptions would be narrowed to essential grid operations. The same analysis says the bill would also require annual reports to the FTC on the data collected and how it is used, along with triple damages in favor of affected customers if the law is violated.

QuiverQuant and Digital Policy Alert confirm that the bill remains under deliberation in the 119th Congress, so its monetization and reporting requirements could still change before any possible enactment.

What does the AI agent security bill propose?

H.R.7885, the Cybersecurity Skills Integration Act, is not aimed at regulating AI deployment. Instead, it seeks to strengthen workforce capacity by directing the Department of Education to establish a pilot grant program for partnerships between postsecondary institutions and employers in critical infrastructure sectors, with a focus on cybersecurity training programs.

The same broader legislative package also includes the Stop Rogue AI Act, introduced by Josh Gottheimer and Mike Lawler, which does seek to set a technical framework for AI agents. According to the cited coverage, NIST would have to develop standards, guidance, and best practices for secure deployments, maintain a continuous inventory of AI agents, coordinate with CISA, and publish those standards within one year of any enactment.

Later analysis cited by Scand.ai, Cryptorank, Lawler.house.gov, Servola, and Quasa says that inventory would need to be continuous, up to date, and machine-readable, tied to developers and vendors. Those analyses also describe guidance covering continuous action verification, immutable logs, and reliability assessments for agents.

The same sources say the framework would be mandatory mainly for federal contractors and voluntary for everyone else, at least until the law takes effect. Quasa adds that the Stop Rogue AI Act is still a bipartisan draft and has not been enacted, and that NIST has not issued specific standards yet.