My Body, My Data Act of 2025
- Bill Number
- H.R. 3916
- Origin Chamber
- House
- Congress
- 119th Congress, Session 1
- Policy Area
- Commerce
- Status
- Introduced
- Latest Action
- 2025-06-11: Referred to the House Committee on Energy and Commerce.
- Last Updated
- 2026-05-13T08:06:26Z
AI-Generated Summary
Purpose of the Legislation
The "My Body, My Data Act of 2025" aims to safeguard the privacy of personal reproductive or sexual health information by limiting how companies and other entities collect, use, share, or store this sensitive data. It ensures individuals have control over their data while allowing necessary use for providing requested services.
Key Provisions
- Data Minimization (Section 2): Regulated entities (e.g., companies involved in commerce) can only collect, keep, use, or share personal reproductive or sexual health information if it is absolutely necessary to deliver a product or service the individual has requested. Access by employees or contractors is also restricted to what's needed for that purpose.
- Rights of Individuals (Section 3): People can request:
- Access to their data, including how it was collected (e.g., from third parties) and to whom it was shared, in both easy-to-read and machine-readable formats.
- Correction of inaccurate data, including information gathered from others or inferred by the entity.
- Deletion of their data, including from contractors.
Requests must be handled via user-friendly online tools, free of charge, within 15 days. Entities don't have to create new data or keep it longer than planned.
- Privacy Policy Requirements (Section 4): Entities must publish a clear, detailed privacy policy on their website explaining data practices, categories of information handled, purposes for use, lists of third parties involved, user controls, and security measures.
- Prohibition on Retaliation (Section 5): Entities cannot punish individuals (e.g., by denying services, charging higher prices, or reducing quality) for exercising their rights under the Act.
- Enforcement (Section 6):
- The Federal Trade Commission (FTC) treats violations as unfair or deceptive practices, with powers to investigate, fine, and issue rules.
- Individuals can sue in court for violations, seeking at least $100–$1,000 per day per violation (or actual damages), punitive damages, legal fees, and other remedies. Violations automatically count as a real harm for standing to sue. Pre-dispute arbitration clauses and class action waivers are invalid for these cases—courts, not arbitrators, decide applicability.
- Definitions (Section 7): Key terms include:
- Personal reproductive or sexual health information: Broadly covers data on reproductive/sexual health conditions (e.g., pregnancy, contraception use), searches for related services, inferred data from non-health sources, and location info suggesting such activities.
- Regulated entity: Most businesses in commerce under FTC jurisdiction, plus common carriers (e.g., telecoms) and nonprofits; excludes HIPAA-covered health providers and certain substance abuse record keepers when acting in those roles.
- Service provider: Contractors handling data only for the entity, with strict limits on further sharing.
- Third party: Anyone outside the entity, individual, or their contractors.
- Other Rules (Sections 8–11): Preserves First Amendment rights; doesn't override stronger state or federal laws (but preempts conflicting weaker ones); allows FTC-required disclosures; includes severability (invalid parts don't void the whole Act).
Significant Changes to Existing Law
This Act creates new, targeted federal privacy rules for reproductive and sexual health data, which aren't specifically addressed in laws like HIPAA (Health Insurance Portability and Accountability Act, which protects general health data but excludes many non-medical entities). It expands FTC oversight to include nonprofits and telecoms (normally outside full FTC reach) and introduces a private right of action (allowing individuals to sue directly), which is stronger than FTC-only enforcement in existing privacy frameworks like the FTC Act. It also bans forced arbitration for disputes, differing from many consumer contracts.
Potential Impacts
- On Citizens: Empowers individuals with tools to control and erase sensitive data, potentially reducing risks of data misuse (e.g., tracking for legal or discriminatory purposes). It could build trust in digital services but requires users to actively exercise rights.
- On Government Agencies: The FTC gains rulemaking and enforcement authority, increasing its workload and budget needs for oversight. No direct impacts on other agencies like HHS (Department of Health and Human Services), as HIPAA entities are exempt.
- On Businesses: Regulated entities face compliance costs for data audits, policy updates, and request-handling systems; minimization rules may limit data-driven business models (e.g., targeted ads). Service providers must align contracts tightly.
- On International Relations: No direct effects mentioned; focuses on U.S. commerce, but could influence global tech firms operating in the U.S. by raising data privacy standards.
Main Stakeholders Affected
- Individuals: Anyone whose reproductive or sexual health data is collected (e.g., via apps, searches, or purchases), gaining privacy protections.
- Regulated Entities: Tech companies, retailers, telecoms, nonprofits, and other commerce-involved organizations handling such data; must overhaul data practices.
- Service Providers: Contractors (e.g., cloud storage firms) processing data for entities, bound by stricter sharing limits.
- Federal Trade Commission: Primary enforcer, responsible for rules and investigations.
- Exempt Entities: HIPAA-covered health providers (e.g., doctors, insurers) and substance abuse programs, unaffected in their core roles.
- Third Parties: Data brokers or advertisers, restricted from receiving or using shared information without necessity.
Notable Legal, Constitutional, or Political Implications
- Legal: Establishes violations as concrete injuries for lawsuits, easing access to courts and potentially increasing litigation. Preempts only conflicting state laws, allowing stronger state protections (e.g., California's privacy law) to stand, which could lead to a patchwork of rules.
- Constitutional: Explicitly protects First Amendment rights (e.g., free speech in data contexts), avoiding challenges on expression grounds.
- Political: Addresses privacy vulnerabilities in reproductive health post-major court decisions (e.g., on abortion), potentially reducing data's role in enforcement or discrimination without taking sides on policy debates. May spark debates on federal vs. state authority and business burdens.
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Cosponsors (99)
Rep. McClellan, Jennifer L. [D-VA-4], Rep. Escobar, Veronica [D-TX-16], Rep. Crockett, Jasmine [D-TX-30], Rep. Doggett, Lloyd [D-TX-37], Rep. Moulton, Seth [D-MA-6], Rep. Peters, Scott H. [D-CA-50], Rep. Tokuda, Jill N. [D-HI-2], Rep. Sherrill, Mikie [D-NJ-11], Rep. Velázquez, Nydia M. [D-NY-7], Rep. Kamlager-Dove, Sydney [D-CA-37], Rep. Brownley, Julia [D-CA-26], Rep. Tlaib, Rashida [D-MI-12], Rep. Gomez, Jimmy [D-CA-34], Rep. Carson, André [D-IN-7], Rep. Salinas, Andrea [D-OR-6], Rep. Leger Fernandez, Teresa [D-NM-3], Rep. Jayapal, Pramila [D-WA-7], Rep. McGarvey, Morgan [D-KY-3], Rep. Bonamici, Suzanne [D-OR-1], Rep. Sewell, Terri A. [D-AL-7], Rep. McCollum, Betty [D-MN-4], Rep. Golden, Jared F. [D-ME-2], Rep. Krishnamoorthi, Raja [D-IL-8], Rep. Huffman, Jared [D-CA-2], Rep. Trahan, Lori [D-MA-3], Rep. Vargas, Juan [D-CA-52], Rep. Wilson, Frederica S. [D-FL-24], Rep. Brown, Shontel M. [D-OH-11], Rep. Costa, Jim [D-CA-21], Rep. Barragán, Nanette Diaz [D-CA-44], Del. Norton, Eleanor Holmes [D-DC-At Large], Rep. Matsui, Doris O. [D-CA-7], Rep. Deluzio, Christopher R. [D-PA-17], Rep. Keating, William R. [D-MA-9], Rep. Morelle, Joseph D. [D-NY-25], Rep. Bynum, Janelle S. [D-OR-5], Rep. Auchincloss, Jake [D-MA-4], Rep. Garcia, Sylvia R. [D-TX-29], Rep. Balint, Becca [D-VT-At Large], Rep. Johnson, Henry C. "Hank" [D-GA-4], Rep. Thanedar, Shri [D-MI-13], Rep. Titus, Dina [D-NV-1], Rep. Ross, Deborah K. [D-NC-2], Rep. Swalwell, Eric [D-CA-14], Rep. Stanton, Greg [D-AZ-4], Rep. Panetta, Jimmy [D-CA-19], Rep. Cohen, Steve [D-TN-9], Rep. Davis, Danny K. [D-IL-7], Rep. Carbajal, Salud O. [D-CA-24], Rep. Scanlon, Mary Gay [D-PA-5] and 49 more
Recent Actions
- 2025-06-11: Referred to the House Committee on Energy and Commerce.
- 2025-06-11: Introduced in House
- 2025-06-11: Introduced in House
Bill Versions
- My Body, My Data Act of 2025 — issued 2025-06-11 — PDF (18 pages)