My Body, My Data Act of 2025
- Bill Number
- S. 2029
- Origin Chamber
- Senate
- Congress
- 119th Congress, Session 1
- Policy Area
- Commerce
- Status
- Introduced
- Latest Action
- 2025-06-11: Read twice and referred to the Committee on Commerce, Science, and Transportation.
- Last Updated
- 2026-04-21T11:03:28Z
AI-Generated Summary
Purpose
The "My Body, My Data Act of 2025" aims to safeguard the privacy of personal reproductive or sexual health information by limiting how companies and other entities handle such data. It establishes rules to prevent unnecessary collection, sharing, or misuse of this sensitive information, giving individuals greater control over it.
Key Provisions
- Data Minimization (Section 2): Companies (called "regulated entities") can only collect, keep, use, or share personal reproductive or sexual health information if it is absolutely necessary to provide a specific product or service that the individual has requested. Access by employees or contractors is also limited to what's needed for that purpose.
- Individual Rights (Section 3): People have the right to:
- Access their information, including how it was collected (e.g., from third parties) and where it was shared, provided in easy-to-read and digital formats.
- Correct inaccurate information.
- Delete their information.
Requests must be verified, and companies must respond within 15 days without charging fees. Mechanisms for these rights must be user-friendly, online, and prominent.
- Privacy Policy Requirements (Section 4): Regulated entities must create and publicly post a clear privacy policy on their website detailing how they handle this data, including categories collected, purposes, third-party sharing, sources of data, user controls, and security measures.
- Prohibition on Retaliation (Section 5): Companies cannot punish individuals (e.g., by denying services, charging higher prices, or reducing quality) for exercising their rights under the Act.
- Enforcement (Section 6):
- The Federal Trade Commission (FTC) treats violations as unfair or deceptive practices, with powers to investigate, fine, and regulate like under existing consumer protection laws.
- Individuals can sue in court for violations, seeking damages ($100–$1,000 per violation per day or actual harm, whichever is greater), punitive damages, legal fees, and other remedies. Violations automatically count as a real injury for standing to sue. Pre-dispute arbitration clauses and class action waivers are invalid for these cases.
- Definitions (Section 7):
- Personal reproductive or sexual health information includes data on reproductive/sexual health conditions (e.g., pregnancy, contraception use, abortions), related searches or purchases, symptoms (e.g., menstrual tracking), and even inferred data from non-health sources.
- Regulated entity covers most businesses affecting commerce (e.g., tech companies, apps), including nonprofits and telecoms, but excludes HIPAA-covered health providers (like doctors' offices) when acting under those rules.
- Other terms define "collect," "disclose," "service provider" (contractors handling data only for the company), and "third party" (anyone else).
- Other Rules (Sections 8–11): The Act preserves First Amendment rights, does not override stronger federal or state laws (but preempts conflicting weaker ones), allows disclosures required by law (e.g., court orders), and includes a severability clause to keep the law intact if parts are invalidated.
Significant Changes to Existing Law
This Act introduces targeted federal privacy protections for reproductive and sexual health data, filling gaps in current laws like HIPAA (which mainly covers healthcare providers and insurers) and general FTC rules on data practices. It expands oversight to non-health entities (e.g., period-tracking apps, social media, or retailers) that collect or infer such data, mandates specific user rights and transparency not uniformly required before, and enables private lawsuits with guaranteed standing—unlike some privacy laws that limit enforcement to agencies. It also invalidates forced arbitration for these disputes, promoting court access.
Potential Impacts
- On Citizens: Empowers individuals, especially those seeking reproductive or sexual health services, by reducing risks of data misuse (e.g., tracking abortions or contraception). It could prevent discrimination or harassment based on shared data but may limit personalized services if data use is overly restricted.
- On Government Agencies: The FTC gains expanded enforcement tools and rulemaking authority, potentially increasing its workload and budget needs for oversight. It preserves other agencies' powers without conflict.
- On Businesses: Regulated entities face compliance costs for policies, access mechanisms, and data limits, possibly curbing data-driven advertising or analytics. Service providers must adhere to strict contracts. Nonprofits and telecoms are newly included, broadening accountability.
- On International Relations: Minimal direct impact, though U.S. companies operating globally may need to align practices, potentially influencing data privacy standards in trade or tech agreements.
Main Stakeholders Affected
- Individuals: Primary beneficiaries, particularly women, LGBTQ+ people, and those using health-related apps or services, who gain privacy controls over sensitive data.
- Technology and Consumer Companies: App developers, social media platforms, retailers, and data brokers must comply, facing restrictions on data monetization.
- Healthcare and Service Providers: Excluded if under HIPAA, but affected if they operate apps or non-clinical services; contractors (service providers) have new obligations.
- Nonprofits and Telecoms: Newly regulated, impacting advocacy groups or carriers handling user data.
- Federal Trade Commission (FTC): Leads enforcement, with increased responsibilities.
- State Governments and Courts: Can maintain or strengthen their laws; courts handle individual lawsuits.
Notable Legal, Constitutional, or Political Implications
- Legal: Establishes a concrete injury standard for lawsuits, easing access to courts under Article III. Preempts only conflicting state laws, allowing states like California (with strong privacy rules) to offer more protection. Savings clauses ensure it complements existing FTC authority without limiting disclosures for legal processes.
- Constitutional: Explicitly protects First Amendment rights (e.g., free speech in data handling), avoiding challenges to compelled disclosures. No direct conflicts with other rights, but could face scrutiny over regulating inferred data as "personal information."
- Political: Introduced post-Dobbs decision (overturning Roe v. Wade), it addresses fears of data tracking for reproductive rights enforcement. Bipartisan sponsorship signals broad support for privacy amid polarized abortion debates, but enforcement via FTC and private suits could spark industry lobbying against regulatory burdens.
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Cosponsors (22)
Sen. Wyden, Ron [D-OR], Sen. Blumenthal, Richard [D-CT], Sen. Blunt Rochester, Lisa [D-DE], Sen. Cantwell, Maria [D-WA], Sen. Duckworth, Tammy [D-IL], Sen. Gallego, Ruben [D-AZ], Sen. Gillibrand, Kirsten E. [D-NY], Sen. Heinrich, Martin [D-NM], Sen. Kaine, Tim [D-VA], Sen. Klobuchar, Amy [D-MN], Sen. Merkley, Jeff [D-OR], Sen. Murray, Patty [D-WA], Sen. Schiff, Adam B. [D-CA], Sen. Shaheen, Jeanne [D-NH], Sen. Smith, Tina [D-MN], Sen. Welch, Peter [D-VT], Sen. Whitehouse, Sheldon [D-RI], Sen. Baldwin, Tammy [D-WI], Sen. Alsobrooks, Angela D. [D-MD], Sen. Durbin, Richard J. [D-IL], Sen. Cortez Masto, Catherine [D-NV], Sen. Coons, Christopher A. [D-DE]
Recent Actions
- 2025-06-11: Read twice and referred to the Committee on Commerce, Science, and Transportation.
- 2025-06-11: Introduced in Senate
Bill Versions
- My Body, My Data Act of 2025 — issued 2025-06-11 — PDF (19 pages)