DASHBOARD Act of 2025

Bill Number

H.R. 4402

Origin Chamber

House

Congress

119th Congress, Session 1

Policy Area

Finance and Financial Sector

Status

Introduced

Latest Action

2025-07-15: Referred to the Committee on Energy and Commerce, and in addition to the Committee on Financial Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

Last Updated

2025-08-01T15:14:26Z

AI-Generated Summary

Purpose of the Legislation

The DASHBOARD Act of 2025 aims to increase transparency and accountability for large companies that collect and monetize user data online. It requires the Securities and Exchange Commission (SEC) to create rules for public companies to disclose the value and handling of user data in financial reports. It also imposes direct obligations on "commercial data operators" (large online service providers or data brokers) to inform users about their data practices and give users more control over their information, enforced by the Federal Trade Commission (FTC).

Key Provisions

• Definitions (Section 2):
• "Commission" refers to the SEC.
• "Issuer" means a company that issues securities (like stocks), as defined in existing securities law.
• "Commercial data operator," "user," and "user data" are defined under amendments to the Securities Exchange Act of 1934, with specifics in Section 4 (e.g., user data includes any information that identifies or links to an individual, whether directly provided or observed).

• Requirements for Commercial Data Operators (Section 3):
• Every 90 days, operators must provide each user with an assessment of the economic value their data holds to the company.
• In a clear, visible way, disclose the types of data collected (by the operator or partners) and any uses not directly tied to the online service provided.
• Allow users to delete all or specific parts of their data via a single easy setting or clear mechanism.
• Exceptions to deletion: Data can be kept if legally required, needed for legal claims, or to prevent/detect security threats, fraud, or illegal activity—but only the minimum necessary.
• Disclosures must remain accessible through the service's normal interfaces.
• Violations are treated as unfair or deceptive practices under the FTC Act, giving the FTC enforcement powers like fines and investigations.
• The FTC must issue implementing regulations within 1 year of enactment.

• SEC Disclosure Requirements (Section 4):
• Amends the Securities Exchange Act of 1934 to require public companies that are commercial data operators (those with over 100 million unique U.S. monthly users for most of the prior year and significant revenue from user data) to report the aggregate (total) value of user data they hold, if material to finances.
• Also disclose contracts with third parties for data collection and other items the SEC deems important for investor protection.
• The SEC must develop standardized methods to value user data, consulting experts for comparability across similar companies while allowing variations by sector or business model.
• Within 1 year, the SEC must update its regulations (in the Code of Federal Regulations) to require both numerical (quantitative) and descriptive (qualitative) disclosures, including:
• Security measures to protect data.
• Financial and legal risks from holding large amounts of data.
• Sources of data (e.g., direct from users, purchases, or indirect relationships).
• Revenue operations relying on data.
• Contracts over $10 million for data collection, licensing, or sharing.
• Revenue from user data activities.
• How data value changes impact financial reports.
• Acquisitions of user data over $100 million.
• Within 3 years, the SEC must report to Congress on disclosure practices, valuation methods, delivery formats, and recommendations for improvements; proposed rules must follow within 180 days.

Significant Changes to Existing Law

• Adds a new subsection (13(s)) to the Securities Exchange Act of 1934, mandating disclosures of user data value in annual/quarterly reports—previously, such data handling was not explicitly required in financial filings.
• Amends SEC Regulation S-K (17 CFR 229.306) to expand disclosure rules beyond traditional assets, incorporating data as a key financial element with both quantitative and qualitative details.
• Introduces FTC oversight for non-public data operators' user-facing practices, treating violations like deceptive business practices under the FTC Act (15 U.S.C. 41 et seq.), which did not previously cover these specific data transparency and deletion rights.
• No changes to core securities filing requirements, but integrates data valuation into them, potentially reclassifying user data as a reportable asset.

Potential Impacts

• On Citizens/Users: Greater awareness of data value and uses could empower individuals to manage their privacy, with easier deletion options reducing unwanted data retention. This may lead to more informed choices about online services but could involve more frequent notifications.
• On Government Agencies: The SEC gains new rulemaking and reporting duties, including valuation standards, increasing workload for investor protection. The FTC gets expanded enforcement tools for consumer data practices, potentially leading to more investigations of large tech firms.
• On Businesses/Commercial Data Operators: Large companies (e.g., social media or data brokers) face compliance costs for disclosures, deletions, and valuations, which could affect profitability but provide clearer investor insights. Smaller operators (under 100 million users) are exempt from SEC rules.
• On International Relations: Minimal direct impact, though global companies operating in the U.S. (e.g., with U.S. users) must comply, possibly influencing international data privacy standards or trade discussions on digital economies.

Main Stakeholders Affected

• Commercial Data Operators: Primarily large online platforms and data brokers (e.g., those with 100+ million U.S. users deriving significant revenue from data), required to implement user tools and disclosures.
• Users/Consumers: Individuals using online services, gaining rights to data value info and deletion.
• Investors and Public Companies (Issuers): Benefit from enhanced financial transparency on data assets, aiding investment decisions.
• Government Agencies: SEC (rulemaking, oversight of disclosures) and FTC (enforcement of user protections).
• Third Parties: Data collection partners or buyers, subject to contract disclosures if deals exceed thresholds.

Notable Legal, Constitutional, or Political Implications

• Legal: Strengthens consumer privacy by codifying data deletion rights with limited exceptions, aligning with but expanding beyond existing laws like the FTC Act's deception rules. It treats data as a financial asset for securities purposes, potentially increasing litigation over valuation accuracy or compliance failures. Enforcement relies on administrative agencies, avoiding new courts.
• Constitutional: No major challenges anticipated; it regulates commercial speech and practices under Congress's commerce power, without restricting core rights like free speech (disclosures are factual and required only for business operations).
• Political: Promotes bipartisan interests in tech accountability and investor protection, but could spark debates on regulatory burden for innovation versus privacy safeguards. The 1-3 year timelines allow for adjustments, and the congressional report enables future refinements without immediate overreach.

This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.

Sponsor

Rep. Foster, Bill [D-IL-11]

Recent Actions

• 2025-07-15: Referred to the Committee on Energy and Commerce, and in addition to the Committee on Financial Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
• 2025-07-15: Referred to the Committee on Energy and Commerce, and in addition to the Committee on Financial Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
• 2025-07-15: Introduced in House
• 2025-07-15: Introduced in House

Bill Versions

• Designing Accounting Safeguards to Help Broaden Oversight And Regulations on Data Act of 2025 — issued 2025-07-15 — PDF (11 pages)