This bill establishes a comprehensive federal framework for consumer data privacy and security, creating a uniform set of rules that would preempt most state privacy laws. It requires businesses that collect personal data to obtain consent from individuals before gathering or processing their information, with stricter requirements for sensitive data like health records and financial details. Covered entities must provide clear privacy policies, allow individuals to access, correct, or delete their data, and implement security programs to protect information from unauthorized access. The Federal Trade Commission would enforce these rules and has authority to impose civil penalties on violators, while also receiving additional funding to carry out enforcement duties.
HR 3218, the Reproductive Data Privacy and Protection Act, requires law enforcement and government agencies to swear under oath that they will not use reproductive or sexual health information in investigations or legal proceedings. It amends federal wiretap laws (18 U.S.C. § 2518) and communication disclosure rules (18 U.S.C. § 2703) to mandate this protection. The bill defines "reproductive or sexual health information" broadly to include details about abortion, contraception, IVF, pregnancy, sexual health conditions, and related medical services. This directly affects law enforcement, courts, and service providers by legally restricting how sensitive health data can be used in investigations. The law aims to prevent government use of such data to target individuals seeking or providing reproductive care.
The My Body, My Data Act of 2025 requires companies and services handling personal reproductive or sexual health information - such as health apps, clinics, or digital platforms - to only collect, retain, or share this data when strictly necessary for a service a person has requested. It gives individuals the right to access, correct, or delete their data easily (within 15 days, without fees), and mandates clear privacy policies explaining how data is used. The bill also prohibits companies from retaliating against people who exercise these rights, such as by charging higher prices or denying services. Enforcement will be handled by the Federal Trade Commission, with individuals able to sue for violations and seek penalties of up to $1,000 per violation per day.
This bill, HR 3916 (My Body, My Data Act of 2025), requires businesses and other "regulated entities" to minimize collection and sharing of personal reproductive or sexual health data - such as pregnancy status, contraceptive use, or abortion-related information - and gives individuals specific rights. It mandates that entities provide individuals with easy access to their data, the ability to correct inaccuracies, and the right to request deletion of such information within 15 days. The law also requires clear privacy policies detailing data practices and prohibits retaliation against individuals who exercise these rights, such as charging higher prices or denying services. It applies broadly to most businesses (excluding HIPAA-covered healthcare providers) and is enforced by the FTC with private lawsuits allowed for violations.
