The My Body, My Data Act of 2025 requires companies and services handling personal reproductive or sexual health information - such as health apps, clinics, or digital platforms - to only collect, retain, or share this data when strictly necessary for a service a person has requested. It gives individuals the right to access, correct, or delete their data easily (within 15 days, without fees), and mandates clear privacy policies explaining how data is used. The bill also prohibits companies from retaliating against people who exercise these rights, such as by charging higher prices or denying services. Enforcement will be handled by the Federal Trade Commission, with individuals able to sue for violations and seek penalties of up to $1,000 per violation per day.
This bill prohibits data brokers from selling, reselling, licensing, trading, or otherwise sharing military servicemembers' personal information (such as names, addresses, or service details) with foreign adversaries or entities controlled by them. It requires data brokers to include contractual safeguards in agreements to prevent recipients from further sharing this information with covered nations. The Federal Trade Commission and state attorneys general can enforce these rules through civil actions to stop violations and seek remedies for affected servicemembers. The bill also mandates a congressional report within one year to assess enforcement and potential expansions of the protections.
The One Fair Price Act of 2025 prohibits businesses from charging different prices for the same product or service based on surveillance data (such as tracking online behavior or personal information). It specifically bans price discrimination using this data, while allowing price differences for legitimate reasons like cost-based pricing, broad group discounts (e.g., for teachers or veterans), or loyalty programs with clear disclosure. The Federal Trade Commission enforces the law, and states or individuals can sue for violations, seeking damages or injunctions. The bill also requires a joint study on its impact on small businesses within one year of enactment.
This bill requires large online platforms (with over 100 million monthly U.S. users) to disclose the economic value of individual user data to users every 90 days and provide simple deletion tools. It mandates public companies that rely on user data for revenue to report the aggregate value of that data in SEC filings, including collection methods and revenue streams. The law applies to entities generating significant revenue from user data, such as major social media or ad-driven services. Enforcement of user transparency falls to the FTC, while the SEC oversees the financial disclosures.
HR 4828 expands federal privacy law by adding biometric information, license plate numbers, workplace addresses, school addresses, and GPS coordinates to the list of "restricted personal information" under Title 18, U.S. Code. This directly affects businesses and organizations that collect personal data, requiring them to apply the same strict privacy safeguards to these newly protected data types. The bill modifies an existing legal definition rather than creating new requirements or enforcement mechanisms. It applies to any entity subject to current privacy regulations for restricted data. The key change clarifies which specific information categories receive enhanced protection under federal law.
This bill creates a federal private right of action for individuals whose "covered data" (including personal information, biometrics, location data, and inferred profiles) is used without their clear, upfront permission. It requires explicit consent for data collection, processing, or sharing with third parties, mandating specific disclosures separate from general terms. Individuals can sue for damages (minimum $1,000 per violation), punitive damages, or injunctions, and the law invalidates pre-dispute arbitration agreements for these claims. The bill does not override stricter state privacy laws but establishes a baseline federal standard for data misuse by AI systems and data processors.
The Auto Data Privacy and Autonomy Act requires automakers to obtain explicit, written consent from vehicle owners before accessing or sharing their vehicle data (including location and personal information), except for safety improvements or emergencies. It prohibits selling personal data to specific foreign governments (like China, Russia, and North Korea) and mandates that owners have free, real-time access to all vehicle data - without fees, proprietary tools, or restrictions - via open interfaces to delete data or adjust settings. The Federal Trade Commission must report to Congress within 180 days on how automakers handle data, including cybersecurity risks and foreign data sharing. The law takes effect three months after enactment and is enforced under existing FTC authority.
This bill modernizes the 1974 Privacy Act by updating definitions of key terms like "personally identifiable information" and "system of records" to better reflect current data practices. It strengthens protections by requiring agencies to use only the minimum necessary personal data for disclosures, disclose legal authorities for data uses, and prohibit adverse actions based on automated matching. The bill adds civil remedies including minimum $1,000 damages for violations and increases criminal penalties for misuse (e.g., up to $250,000 fines or 10 years imprisonment for commercial misuse). These changes directly affect federal agencies handling personal data and apply to all data collection, use, and disclosure activities governed by the Privacy Act.
The Platform Accountability and Transparency Act creates a structured process for researchers to access certain platform data for research while protecting user privacy. Platforms with at least 50 million US monthly users must provide specific data to qualified researchers (affiliated with US universities or nonprofits) whose projects are approved by the National Science Foundation and Federal Trade Commission. The bill requires platforms to publicly disclose information about advertising, algorithms, content moderation, and highly disseminated content, while establishing strict privacy and cybersecurity safeguards for the data. It also creates legal protections for platforms and researchers who comply with the law's requirements, ensuring researchers cannot be sued for accessing data through this process.
HR 5764, the "AI for Main Street Act," amends the Small Business Act to require the Small Business Administration (SBA) to provide guidance and training to small business concerns on using artificial intelligence. It directly affects small businesses by adding new SBA responsibilities to help them evaluate AI for operations, including best practices, cybersecurity, data protection, regulatory compliance, and customer trust. Key provisions mandate the SBA to offer information, training, and outreach on incorporating AI into business processes, such as planning for unexpected circumstances. The bill does not authorize new funding for these activities. It defines "artificial intelligence" using the existing term from the National AI Initiative Act.
