HR 6292, the Don’t Sell Kids’ Data Act of 2025, prohibits data brokers from collecting, using, selling, or sharing the personal information of children (under 13) and teens (13-18). It requires data brokers to delete such data upon request from the teen, parent, or guardian and establish a clear process for these requests within 10 days. The law empowers the Federal Trade Commission (FTC) to enforce the ban as a deceptive practice, allows states to sue on behalf of residents, and lets individuals file lawsuits for violations - awarding at least $1,000 per violation. The bill directly affects data brokers and aims to protect minors’ privacy by restricting how their personal information is handled online.
The Election Worker Protection Act of 2025 provides federal grants to states for election worker recruitment, training, and safety. It establishes new criminal penalties for threatening or harassing election workers, with fines up to $100,000 and up to 5 years in prison. The bill creates a grant program to protect election workers' personally identifiable information from public disclosure, including through redaction of personal data in public records. States would receive funding based on their voting age population, with requirements for diversity-focused recruitment and regular reporting on program outcomes.
The SHIELD Act of 2025 establishes a one-year pilot program requiring the Secretary of Defense to develop digital literacy training for members of the Armed Forces. The training teaches service members to identify fact-based journalism, disinformation, conspiracy theories, hate-based ideologies (including antisemitism and white supremacy), assess online source credibility, protect personal information, and recognize threats to individual or military security. The program will use in-person, virtual, and hybrid training methods equally, with a geographically and demographically diverse group of service members as participants. After the pilot, the Secretary must survey participants and submit a report to Congress comparing training methods and recommending how often permanent digital literacy training should occur and how often the curriculum should be updated.
The STOP CSAM Act of 2025 strengthens protections for child victims of sexual abuse and exploitation by expanding definitions of abuse to include psychological abuse and kidnapping, and by imposing new reporting requirements on internet service providers. The bill requires providers with over 1 million monthly users to report apparent child sexual abuse material to the CyberTipline within 60 days, with penalties for noncompliance including fines up to $1 million for large providers. It creates new civil remedies allowing victims to sue providers who host or promote child pornography, and establishes protections for "covered persons" (children under 18 who are victims or witnesses) by limiting public disclosure of their personal information. The bill also enhances law enforcement's ability to investigate online child exploitation while maintaining privacy safeguards for victims.
The LIFE with AI Act establishes a "Golden Seal of Excellence in Student Data Privacy" for schools that implement robust parental notification systems for educational technology. It requires schools to use real-time consent systems ("instant verification technology") for parental approval of student data use, simplifies opt-out processes for directory information, and prohibits using student photos for facial recognition without consent. The bill also creates new requirements for schools to review third-party educational technology contracts for privacy compliance and establishes a Privacy Technical Assistance Center to help schools navigate data privacy rules. These changes primarily affect elementary and secondary schools, local educational agencies, and educational technology providers, with the goal of strengthening student data privacy protections while enabling responsible AI use in education.
The Unsubscribe Act of 2025 protects consumers from unexpected charges by regulating "negative option" contracts, where services automatically renew unless the consumer actively cancels (e.g., free trials turning into paid subscriptions). It requires merchants to clearly disclose all terms before charging, obtain explicit consent (like a checkbox), and provide a simple cancellation method - such as a direct online link - before the first payment. For free-to-paid contracts, merchants must detail introductory pricing, future recurring costs, and total estimated charges before the first billing. The Federal Trade Commission and state attorneys general will enforce these rules, with penalties for violations, ensuring consumers have transparent choices and easy cancellation options.
HR 4819, the Click to Cancel Act of 2025, makes the Federal Trade Commission's November 2024 "Negative Option Rule" permanent law. This rule directly affects businesses that use automatic renewal subscriptions (like streaming services or software) and their consumers, requiring clear, easy cancellation options. The bill codifies the FTC's existing rule, treating violations as unfair or deceptive practices under the FTC Act, and grants the FTC full authority to enforce it using existing powers and penalties. The key change is that businesses must now explicitly obtain consumer consent for recurring charges and provide straightforward cancellation methods, moving beyond the previous rule-based guidance.
This bill prohibits the Department of Veterans Affairs (VA) from sharing veterans' personal data - including health, financial, and identifying information - with the U.S. DOGE Service (Department of Government Efficiency). It bans any special government employee from accessing or using veteran data for commercial purposes or non-governmental reasons, requiring them to return all data upon termination. The law specifically protects sensitive information like medical records, Social Security numbers, and biometric data from unauthorized use or retention. It directly affects VA data-sharing practices and ensures veteran privacy by restricting access to their personal information.
This bill requires the Department of Defense (DOD) to strengthen protections for personal data tied to operational security of military personnel and civilian employees. It prohibits storing such sensitive data on non-DOD servers or cloud services unless under specific contracts or with data subject permission, and mandates strict waiver conditions for exceptions. The DOD must review privacy guidance by June 2026, implement new security standards for system owners, and notify Congress within 30 days of policy changes, data storage violations, or security incidents involving this data. These requirements aim to prevent data breaches that could endanger personnel or national security. The bill applies directly to DOD data handling practices and personnel managing sensitive information.
This bill increases fines for unauthorized access to or disclosure of sensitive government data. It raises the maximum civil penalty for violating the Privacy Act from $5,000 to $30,000 per violation (Section 2), and increases criminal fines for unauthorized computer access to up to $750,000 for individuals (Section 3). Specific provisions also raise fines for improper disclosure of Social Security data ($10,000 → $25,000), tax information ($5,000 → $25,000), and census data ($5,000 → $25,000) (Sections 4-6). The bill directly affects government employees, contractors, and others handling protected data by making violations more costly. It focuses solely on penalty adjustments without creating new data collection or oversight requirements. (Note: "DOGE BROS" is a non-official, informal reference in the bill's title.)
