Beyond Smart Meters: The Expanding Regulatory Focus on Sensitive Consumer Data

Morgan Lewis writes that the proposed Smart Meter Data Privacy Protection Act "would impose restrictions on certain utilities' sale of data collected from smart meters"[1] and would have the FTC set standards for keeping that data secure and how long it is held. Josh Riley (NY-19), he and Rep. Mike Kennedy (UT-03) introduced the bill as bipartisan legislation[2]. LegiScan shows it was introduced on September 3, 2026 and referred to the House Committee on Energy and Commerce[3].Riley's office says the bill limits utilities to using energy-usage data for core functions like billing, grid reliability, outages, and regulatory compliance[2]. Riley said utilities are "raking in millions selling all the data the smart meters collect."[2]Morgan Lewis says the bill appears to focus on state-regulated electric utilities that are not wholly owned by US persons[1]. The firm adds that this comes as privacy and national security concerns are converging[1] around foreign access to sensitive data.The firm also notes that state attorneys general and the FTC could both enforce the bill, which could give state regulators another tool for scrutinizing data practices[1].Morgan Lewis says regulators are looking more widely at connected vehicles, wearables, thermostats, smart TVs, and other Internet of Things products[1]. It also points to Delaware's amended privacy law, which it says will require a clear and conspicuous link[1] that consumers can use to opt out.Fingerlakes1.com reports that the bill would need to advance through Congress before any of its privacy restrictions[4] could take effect.