It's open season on personal data: We need a Data Protection Agency now

The absence of comprehensive federal regulation protecting data privacy has made protecting everyday Americans from scams and harmful data practices very challenging.

A few months ago, a New York mom answered a call from what sounded like her 14-year-old daughter, who was screaming and crying that she’d been arrested. A “police officer” then came on the line and told the mother that she needed to deliver $15,500 to bail her daughter out. 

In reality, the girl’s voice on the other end was an AI-powered voice clone — possibly generated using clips compiled from social media.  

It’s just one example of the growing number of scams using AI technology to exploit a person’s online data. Across the country, Americans lose billions of dollars every year to cybercrimes. From phishing, social media and phone scams to data breaches and ransomware attacks, criminals are finding new and innovative ways to collect consumer data and exploit it.  

It’s not just criminals who are using our personal data in dangerous and concerning ways, however. 

In certain states, law enforcement has been using text messages and internet search history data to arrest and prosecute women for seeking reproductive health care. AI is being utilized for dirty political tricks as well; in New Hampshire, a robocall imitating President Biden urged people not to vote in the state’s presidential primary, and in New York, someone released fake, AI-generated audio of the Manhattan Democratic Party leader disparaging a member of the assembly. While both instances were exposed quickly, they are cause for serious concern.  

The reality is that most people don’t think twice about the digital information being collected about them. Young people across the country often use platforms like Instagram, TikTok and YouTube to share selfies, create elaborate dance videos or interact with influencers, celebrities or politicians. But many give little thought to who might be keeping track of their activities.  

Every day, companies are gathering massive amounts of our data — from search histories, consumer habits and location data to health data, photos and videos. This data can be very useful to the companies that collect it, but it can also be extremely valuable to those who seek to sell, share or hack it. The advent of generative AI has only intensified data privacy concerns and made data misuse more effective and costly for consumers.  

The absence of comprehensive federal regulation protecting data privacy has made protecting everyday Americans from scams and harmful data practices very challenging. Without guardrails for how an individual’s personal data can be obtained or used, the risks to all Americans will only grow. It’s time we do something about it.  

I wrote the Data Protection Act to help address this growing problem. It would create an independent federal agency to promote data protection in the United States and to provide a broad range of enforcement tools. This agency would be able to set and enforce data protection rules to mitigate data breaches, minimize their effects and fight against phishing and other scams, including those utilizing artificial intelligence.  

The U.S. is one of the only democracies, and virtually the only member of the Organization for Economic Cooperation and Development, without a federal data protection agency. Instead, authorities have to rely on a patchwork of protections that make jurisdictional oversight very nebulous.  

But as technology evolves and grows, we must make sure society is equipped to address the challenges and opportunities these advancements bring. Establishing a federal agency whose sole purpose is to protect our data and privacy would allow the federal government to crack down on bad actors and promote more transparency and accountability within the digital landscape.  

It hasn’t been long since the generative AI arms race began. But just in the last year, we’ve seen our world change exponentially before our very eyes. Unless we act quickly to regulate this digital Wild West, the consequences could be catastrophic for our communities, our families, and our children. 

Sen. Kirsten Gillibrand (D-N.Y.) has served in the U.S. Senate since 2009.