S. 5459 — Agricultural Data Privacy Act of 2026

This section establishes the purpose of the Act as protecting the economic value of agricultural data and the autonomy of agricultural producers by safeguarding the sale and security of such data through reasonable measures.

This section defines terms used in the Act, including agricultural data as agronomic, climate, land, livestock, management, or sustainability information linked to an identified agricultural producer and excluding aggregated or derived data; agricultural producer as the owner, lessee, or renter of the relevant farm, livestock, land, device, or equipment; controller as the person or entity determining the purposes and means of processing such data; processor as the person or entity processing data on behalf of a controller; and sale of agricultural data as an exchange for monetary or other consideration, excluding disclosures to processors, affiliates, authorized third parties, or for legal compliance.

This section establishes that an agricultural producer owns and controls agricultural data originating from the producer's farm, land, device, or equipment. It grants controllers and processors a nonexclusive right to control the data solely to provide authorized services, maintain equipment, or perform processing, but prohibits any sale of the data.

This section prohibits controllers or processors from selling agricultural data without the express written consent of the agricultural producer. It requires that consent be obtained through a clear and conspicuous disclosure separate from the primary terms of service or data use agreement.

This section requires contracts or agreements entered into on or after January 1, 2027, involving the collection or processing of agricultural data to include a provision prohibiting the controller or processor from selling that data without the express written consent of the agricultural producer. It voids and renders unenforceable any contract provision that waives or limits these requirements.

This section requires any controller or processor in custody or possession of agricultural data to establish, implement, and maintain reasonable administrative, technical, and physical data security practices. The practices must be appropriate to the volume and nature of the data and protect against unauthorized access, use, disclosure, modification, or loss.

This section authorizes the Attorney General to sue controllers or processors in federal district court for injunctive relief or a civil penalty of $1,000 per violation. It deposits recovered penalties in the Treasury general fund and establishes this authority as the exclusive remedy, without creating any private cause of action.

This section requires the Attorney General to provide written notice identifying specific alleged violations of section 6 or 7 before initiating a civil penalty action against a controller or processor. It bars such actions if the entity cures the violations within 45 days and submits a written statement confirming the cure and committing to future compliance. The requirements do not apply to violations of section 5.

This section preserves all duties and obligations imposed by other federal laws and maintains the terms of any private contracts in existence prior to the date of enactment.