Democrats won control of both the House and the Senate in Tuesday’s midterm elections, and the result changes who sets the agenda on privacy, artificial intelligence and technology oversight when the 120th Congress convenes in January 2027. As of early Wednesday, with ballots still being counted, Democrats had secured at least 231 House seats and at least 54 Senate seats, according to Ballotpedia’s tally. They flipped Senate seats in Iowa, Kansas, Maine, North Carolina, Ohio, South Carolina and Texas.
For companies that collect personal data or build and deploy AI, the practical effect will come less from floor votes than from committee gavels. Committee chairs decide which bills get hearings and markups, which executives are invited or compelled to testify, and which document requests go out. Down the ballot, Democratic wins in several state attorney general races, including an upset in Texas, could reshape one of the most aggressive privacy enforcement offices in the country.
The committees that will matter most
Committee leadership will not be formally settled until the parties organize in January, so the names below are projections based on seniority, public statements and reporting, including law-firm briefings published Wednesday. With that caveat, five panels stand out for privacy and AI:
- Senate Commerce, Science and Transportation. Sen. Maria Cantwell of Washington, the ranking member, is expected to return as chair, a post she held in the last Democratic Senate. On October 7 she released a six-principle framework for frontier AI calling for NIST-developed safety standards, independent audits before covered models are released, incident reporting, developer liability, whistleblower protections and human oversight of consequential decisions in employment, health care and credit. We broke that plan down in our analysis of Cantwell’s six-point AI governance plan. Sen. Ted Cruz of Texas, the current chair, would become ranking member and has pushed a federal AI framework that could override state laws.
- Senate Judiciary. Sen. Sheldon Whitehouse of Rhode Island is reported to be planning to succeed the retiring Sen. Dick Durbin. Judiciary handles surveillance authorities, law enforcement access to data, antitrust and Big Tech liability questions.
- House Energy and Commerce. Rep. Frank Pallone of New Jersey, who chaired the committee in the 116th and 117th Congresses, is the presumptive chair. Energy and Commerce is the committee of jurisdiction for comprehensive federal privacy legislation, kids’ online safety and much of consumer protection. Pallone has also targeted data centers and algorithmic pricing.
- House Oversight and Government Reform. Rep. Robert Garcia of California, the current ranking member, is expected to chair. Oversight can investigate “any matter” within the jurisdiction of other House committees, and Garcia’s stated priorities include the federal workforce cuts and data access tied to the Department of Government Efficiency.
- House Judiciary. Rep. Jamie Raskin of Maryland is expected to chair and has named the Justice Department, the FBI, antitrust and Big Tech among his focus areas.
House Democrats are also reported to be weighing a select committee on AI. It would require a full House vote to create, and Pallone has reportedly opposed the idea on the ground that it would slow the legislative process. Whether that panel exists will say a lot about how leadership intends to handle AI: through investigations and hearings, or through the regular committee process that produces bills.
What changes on oversight
The most immediate shift is investigative power. In the House, standing committees have subpoena authority under House Rule XI, and most delegate it to the chair. In the Senate, most committees, including Commerce and Judiciary, generally need the ranking member’s agreement or a committee vote before issuing a subpoena, while the Homeland Security and Governmental Affairs Committee and its Permanent Subcommittee on Investigations let the chair act alone with notice. Those rules can change when the new Congress adopts them in January.
Expect that power to be pointed in two directions. One is the executive branch: how agencies use AI, how federal data is shared and how procurement decisions are made. Our coverage of the privacy questions raised by DOGE’s data access outlines the kind of record that a Democratic Oversight Committee is likely to revisit. The other direction is industry. Hearings on social media design, AI chatbots and children, and personalized pricing are plausible early agenda items, and they tend to come with document requests before any executive takes the witness chair.
Legislation is harder to predict. Democrats will control both chambers, but President Trump retains the veto, and most bills still need 60 votes to clear a Senate filibuster. A comprehensive federal privacy law has failed in every recent Congress over two questions, whether it would preempt stronger state laws and whether individuals could sue. Those questions do not go away with a change in majority. The catalog of pending proposals in our review of the 49 federal privacy bills introduced in 2026 shows how crowded and divided the field already is.
The fight over preempting state AI laws is where the change in control may matter most. The White House and congressional Republicans have pursued federal preemption through executive action and must-pass legislation, a push described in our report on the fresh momentum behind preemption. With Democrats running the committees from January, a broad moratorium on state AI laws becomes much less likely to pass in the new Congress. The lame-duck session between now and January is still controlled by Republicans, though, and remains a window for attempts to attach preemption language to year-end bills.
The state attorney general results
The biggest privacy enforcement story of the night may be in Austin. Democratic state Sen. Nathan Johnson defeated Republican Mayes Middleton for Texas attorney general, becoming the first Democrat elected to the office since 1994, the Texas Tribune reported. Under Ken Paxton, who ran for the Senate this year rather than seek re-election and lost to Democrat James Talarico, Texas became one of the most active state privacy enforcers, using its biometric privacy law, the Texas Data Privacy and Security Act and its deceptive trade practices statute against large technology companies. Johnson campaigned on returning the office to “core functions” such as consumer protection, antitrust enforcement and anti-corruption work while dropping what he called culture war litigation.
That combination makes the direction of Texas privacy enforcement genuinely uncertain. Consumer protection is where privacy cases live, so a narrower political docket does not automatically mean fewer privacy actions. It may mean different targets and more multistate cooperation. Businesses tracking how Texas privacy enforcement has escalated should not assume pending matters will simply be dropped.
Elsewhere, according to unofficial results compiled Wednesday, Democrats won attorney general races in Nevada, Michigan, Colorado, Georgia and Iowa, Minnesota’s Keith Ellison won a third term, and Republican James Uthmeier held Florida. Races in Ohio and Kansas, where Democrats led, had not been called by the Associated Press when those results were compiled. Democrats also gained governorships in Georgia, Iowa, Ohio and Texas, giving them a majority of governors for the first time since 2010, according to Ballotpedia, which affects which state privacy and AI bills get signed or vetoed in 2027.
What compliance teams should do before January
None of this changes a single legal obligation today. It does change the odds of being asked hard questions in public. Practical steps:
- Review your public record. Privacy notices, AI disclosures, transparency reports and past testimony are what investigators read first. Make sure they match what your systems actually do.
- Check document retention and legal hold readiness. Congressional requests can reach internal emails, risk assessments and product decision logs. Know where they are and who can preserve them quickly.
- Map your AI uses against the Cantwell framework. Independent audits, incident reporting and human review of consequential decisions are likely to anchor Senate Commerce’s AI agenda, and many state laws already move in that direction.
- Do not pause state compliance work. A federal moratorium on state AI laws is now less likely, so state privacy and AI laws taking effect in 2026 and 2027 remain the binding obligations.
- Re-map state enforcement contacts. New attorneys general bring new consumer protection chiefs and priorities. Recalibrate assumptions about Texas in particular.
Frequently asked questions
When does the new Congress take over?
The 120th Congress convenes in early January 2027. Until then, the current Republican majorities control both chambers during the lame-duck session.
Are the committee chairs confirmed?
No. Chairs are chosen when each party organizes in January. The names in this article are the expected or presumptive chairs based on seniority and reporting as of November 4, 2026.
Will Congress now pass a federal privacy law?
It is possible but not likely to be quick. A Democratic Congress still needs a presidential signature, and in the Senate most bills need 60 votes. Preemption and a private right of action remain the sticking points.
Does a Democratic attorney general in Texas mean the state’s privacy lawsuits will end?
Not necessarily. Johnson has emphasized consumer protection, which is the legal basis for most state privacy cases. Pending cases will be reviewed by the new office, and outcomes will depend on their merits and the new leadership’s priorities.
Gavels, not ballots
The election settled who holds power. It did not settle how Democrats will use it. Pallone has called for a federal pause on data center construction, while Cantwell has built a working relationship with Cruz that produced bipartisan bills this Congress. Those are different instincts about how hard to push. The first real signal will come in January, when the new chairs publish their hearing schedules and decide whether their first witnesses are agency heads or tech executives. Companies that wait for that list to start preparing will already be behind.
