Data Care Act of 2025

The Data Care Act of 2025 requires online service providers (like social media platforms or apps that collect user data) to securely handle "individual identifying data," especially sensitive information like health details, biometrics, financial data, or precise location. It imposes three key duties: (1) reasonably securing data from breaches, (2) not misusing data to harm users or benefit themselves, and (3) restricting data sharing to third parties only with strict confidentiality contracts. The Federal Trade Commission and state attorneys general can enforce these rules through penalties for violations, with civil fines calculated based on the number of affected users or days of noncompliance. The law directly affects major digital platforms collecting user data and takes effect 180 days after enactment.