Common Law Privacy and Consumer Protection Act

Prior to task force meetings, ALEC posts these legislative member-submitted draft model policies to our website. The draft model policies are then discussed, debated, and voted on by ALEC task force members. Policies that receive final approval by legislators on the ALEC Board of Directors become official ALEC model policy. Draft model policies that fail to become official ALEC model policy are removed from the website.

Policy Status

  • Type: Model Policy
  • Status: Draft
  • Date Introduced: July 24, 2026

Task Forces

  • Communications and Technology

    • Tags

  • 2026 Annual Meeting

    • Summary

    The Common Law Privacy and Consumer Protection Act would make clear in state law that people have privacy and property interests in their personal information when they entrust it to service providers. It would do so by providing in state law that bailments of information exist. A bailment is simply the ability to hand property to another for safekeeping. When you give your car keys to a valet or take your dog to a kennel, that is bailment. The car and the dog are in care of others, but they are still yours. The same would hold true for personal information, such as emails, text messages, health records, and documents, under the Common Law Privacy and Consumer Protection Act.  Passing the Common Law Privacy and Consumer Protection Act would put digital materials on the same plane as physical ones. Whether stored in the home or stored with secure service providers through bailment, unpublished digital materials are people’s private papers and effects. They should be protected against illegal searches and seizures. The Common Law Privacy and Consumer Protection Act would do that without intruding into existing business processes and without creating new regulations. Recognition of bailments creates no new obligations on service providers, and bailments can be modified by contract. Bailment simply says that a person’s private information really is theirs.    AN ACT relative to the classification and protection of personal digital information and cloud-stored files. 
    Draft

    Common Law Privacy and Consumer Protection Act

    Be it Enacted by ___________________________: 

    Section 1: Short Title.  

    This act shall be known as the “Common Law Privacy and Consumer Protection Act.” 

    Section 2: Findings and Purpose.  

    The _____________ finds that: 

    • (A) Advances in technology and business practices involving the transfer of personal information to third-party platforms and cloud service providers have put consumers and citizens at considerable risk of being divested of rights in their information that they actually retain. 
    • (B) Common law recognition of people’s retained rights in information so transferred has not been sufficiently recognized. 
    • (C) Recognition of the rights people retain in information they share with others in controlled contexts, such as procuring online services or sharing in confidential relationships, will help protect privacy without hindering information flows or the development of new business models and services. 
    • (D) Individuals often retain property rights in information they share subject to appropriate controls, so that it is legally and constitutionally their information. 
    • (E) The transfer of possession without change of ownership is called “bailment;” a bailment implies duties of reasonable care that third-party platforms and cloud service providers already promise by contract in most cases, and that they can amend and disclaim by contract. 

    Section 3: Property Treatment of Personal Information. 

    • (A) One who for commercial purposes takes possession of and places the unpublished personal information of another into a digital record, including but not limited to those stored in a cloud server, is presumed to create a bailment for mutual benefit, subject to terms established by contract. 
    • (B) Personal information that remains identifiable after incorporation in a digital record is presumed to remain the property of its original owner. 
    • (C) A digital record derivative of such a record containing no personal information is presumed to belong to its creator by rules of accession. 

     

    Section 4: Constitutional Protection. 

    For purposes of the ______________ Constitution and the Fourth Amendment to the United States Constitution, a digital document or record, whether stored locally on a device or in a cloud server subject to contractual protections against disclosure, shall be presumed the person’s “papers” or “effects,” and is protected from unreasonable search or seizure. No government entity shall access, search, or seize the contents of such documents or records except pursuant to a warrant issued upon probable cause by a court of competent jurisdiction, except in case of exigent circumstances.   

    Section 5: Unpublished Personal Information. 

    Unpublished personal information shall be presumed not to include any information: 

    • (A) whose owner has made it public; 
    • (B) lawfully obtained and disclosed for news reporting or public commentary on matters of public concern; or 
    • (C) representing or derived from activities conducted as a public official or agent of the state. 

     

    Section 6: Severability.  

    If any provision of this subdivision or its application is held invalid, the invalidity does not affect other provisions or applications that can be given effect without the invalid provision.