My Body, My Data Act of 2023

HR 3420, the My Body, My Data Act of 2023, restricts how companies can handle reproductive and sexual health data - such as pregnancy details, contraceptive use, or abortion-related information - by requiring them to collect only what’s necessary for requested services and limiting employee access. It gives individuals the right to access, correct, or delete their data, see which third parties received it, and get clear privacy policies explaining data practices. The Federal Trade Commission enforces the law, with penalties for violations including $100-$1,000 per violation per day, and bans retaliation for exercising these rights. The law applies to companies (like health apps or insurers) but excludes HIPAA-covered healthcare providers and entities subject to existing federal health privacy rules.