S. 5459: Agricultural Data Privacy Act of 2026

This bill would create a federal privacy and security framework for agricultural data, which includes data tied to a specific farmer or agricultural producer, such as crop and soil information, livestock information, weather data from equipment on the farm, farm management records, and sustainability-related data.

What data is covered

The bill defines agricultural data broadly, but it does not cover:

• Aggregated data that cannot reasonably be tied back to a specific producer, farm, parcel, device, or equipment
• Derived data, such as reports, insights, or predictive models based on the data
• Data already made public by a federal agency

Who owns the data

The bill says the agricultural producer — meaning the owner, lessee, or renter of the farm, land, livestock, device, or equipment where the data comes from — is the owner and controller of that data.

Companies or other entities that collect, store, or process the data would have only a limited, nonexclusive right to use it, and only for purposes such as providing services, maintaining equipment, or carrying out data processing authorized by the producer. That right would not include the right to sell the data.

Limits on selling agricultural data

The bill would generally prohibit a controller or processor from selling agricultural data unless the agricultural producer gives express written consent.

That consent would have to be obtained through a clear and conspicuous disclosure that is separate from the main terms of service or data-use agreement.

The bill also requires contracts or agreements entered into on or after January 1, 2027, that involve collecting or processing agricultural data to include a specific statement that the data cannot be sold without the producer’s written consent.

Any contract term that tries to waive or limit these protections would be void and unenforceable.

Exceptions to the sale rule

The bill lists several situations that would not count as a “sale,” including:

• Transfers to processors working for a controller
• Uses authorized by the producer to provide services
• Disclosures to an affiliate
• Disclosures the producer specifically directs or authorizes in writing to a chosen third party, such as an input provider, adviser, lender, insurer, cooperative, or digital platform
• Disclosures required by law, regulation, subpoena, investigative demand, or court order
• Disclosures needed for safety, emissions, or environmental compliance
• Information the producer intentionally made public without limiting the audience
• Transfers tied to a merger, acquisition, bankruptcy, or similar transaction
• Disclosures needed to detect or respond to fraud, cybersecurity threats, illegal conduct, data integrity issues, or equipment misuse

Security requirements

Any controller or processor that has agricultural data would have to use reasonable administrative, technical, and physical safeguards to protect the data’s confidentiality, integrity, and accessibility. The safeguards must be appropriate to the amount and type of data and designed to prevent unauthorized access, use, disclosure, modification, or loss.

Enforcement

The U.S. Attorney General would be the only party allowed to enforce this law in court. The Attorney General could seek an injunction or a civil penalty of $1,000 for each separate violation.

Before seeking civil penalties for violations involving the contract disclosure requirement or the security requirements, the Attorney General would have to give written notice describing the violation. The company or other covered entity would then have 45 days to fix the problem and provide written confirmation. The notice-and-cure process would not apply to violations of the sales rule.

The law would not create a private right of action, meaning individual producers would not be able to sue under this act itself.

Administration and scope

The Secretary of Agriculture would administer the act, except for enforcement actions, which would remain with the Attorney General.

The bill would not override other federal laws, would not relieve anyone from other legal duties, and would not affect private contracts made before the law is enacted.

Relevant Companies

• DE — Deere & Company could be affected because its farm equipment and related digital services often collect and process farm data that would fall under these rules.
• CNW — CNH Industrial N.V. could be affected through connected equipment, precision agriculture tools, and related data services.
• AGCO — AGCO Corporation could be affected because it provides farm machinery and technology that may collect and process agricultural data.
• CTVA — Corteva, Inc. could be affected if its digital agriculture tools, advisory services, or data-sharing arrangements involve covered agricultural data.
• TSN — Tyson Foods, Inc. could be indirectly affected if it handles livestock or supply-chain data tied to producers under covered arrangements.