The NO FAKES Act of 2025 establishes legal rights for individuals to control how their voice and visual likeness is used in AI-generated digital replicas. It defines "digital replicas" as highly realistic computer-generated representations that are readily identifiable as an individual's voice or appearance, granting individuals (and their heirs) the right to authorize or prohibit such uses. The law creates liability for unauthorized use of digital replicas or distribution of products designed to create them without authorization, while providing safe harbors for online services that follow specific procedures for handling claims. It preempts state laws regarding voice and visual likeness rights in digital replicas (with limited exceptions) and establishes a 10-year post-mortem right that can be renewed for additional 5-year periods if there's active public use.
The My Body, My Data Act of 2025 requires companies and services handling personal reproductive or sexual health information - such as health apps, clinics, or digital platforms - to only collect, retain, or share this data when strictly necessary for a service a person has requested. It gives individuals the right to access, correct, or delete their data easily (within 15 days, without fees), and mandates clear privacy policies explaining how data is used. The bill also prohibits companies from retaliating against people who exercise these rights, such as by charging higher prices or denying services. Enforcement will be handled by the Federal Trade Commission, with individuals able to sue for violations and seek penalties of up to $1,000 per violation per day.
This bill prohibits data brokers from selling, reselling, licensing, trading, or otherwise sharing military servicemembers' personal information (such as names, addresses, or service details) with foreign adversaries or entities controlled by them. It requires data brokers to include contractual safeguards in agreements to prevent recipients from further sharing this information with covered nations. The Federal Trade Commission and state attorneys general can enforce these rules through civil actions to stop violations and seek remedies for affected servicemembers. The bill also mandates a congressional report within one year to assess enforcement and potential expansions of the protections.
This bill amends the Children's Online Privacy Protection Act (COPPA) to extend protections to teens aged 12-17 in addition to children under 13. It requires operators of websites, online services, applications, and mobile apps to obtain verifiable consent from parents for children's personal information and from teens themselves for teens' personal information. The bill prohibits operators from using children's or teens' personal information for individual-specific advertising without consent, mandates clear privacy notices, and requires data deletion upon request. It also establishes new reporting requirements for the Federal Trade Commission regarding high-impact social media companies that affect children or teens.
The One Fair Price Act of 2025 prohibits businesses from charging different prices for the same product or service based on surveillance data (such as tracking online behavior or personal information). It specifically bans price discrimination using this data, while allowing price differences for legitimate reasons like cost-based pricing, broad group discounts (e.g., for teachers or veterans), or loyalty programs with clear disclosure. The Federal Trade Commission enforces the law, and states or individuals can sue for violations, seeking damages or injunctions. The bill also requires a joint study on its impact on small businesses within one year of enactment.
This bill directs the FBI to lead a working group of 18 federal agencies - including the FTC, CFPB, and Department of Homeland Security - to develop a National Strategy for Combating Scams within two years. The strategy must establish a common scam definition, coordinate federal efforts, and incorporate input from scam survivors, older adults, businesses, and law enforcement. It requires agencies to improve data sharing, prevent scams through evidence-based methods, and update the strategy every five years. The FBI, FTC, and CFPB must adopt the agreed-upon scam definition within one year of the strategy's publication.
This bill requires large online platforms (with over 100 million monthly U.S. users) to disclose the economic value of individual user data to users every 90 days and provide simple deletion tools. It mandates public companies that rely on user data for revenue to report the aggregate value of that data in SEC filings, including collection methods and revenue streams. The law applies to entities generating significant revenue from user data, such as major social media or ad-driven services. Enforcement of user transparency falls to the FTC, while the SEC oversees the financial disclosures.
HR 4828 expands federal privacy law by adding biometric information, license plate numbers, workplace addresses, school addresses, and GPS coordinates to the list of "restricted personal information" under Title 18, U.S. Code. This directly affects businesses and organizations that collect personal data, requiring them to apply the same strict privacy safeguards to these newly protected data types. The bill modifies an existing legal definition rather than creating new requirements or enforcement mechanisms. It applies to any entity subject to current privacy regulations for restricted data. The key change clarifies which specific information categories receive enhanced protection under federal law.
This bill creates a federal private right of action for individuals whose "covered data" (including personal information, biometrics, location data, and inferred profiles) is used without their clear, upfront permission. It requires explicit consent for data collection, processing, or sharing with third parties, mandating specific disclosures separate from general terms. Individuals can sue for damages (minimum $1,000 per violation), punitive damages, or injunctions, and the law invalidates pre-dispute arbitration agreements for these claims. The bill does not override stricter state privacy laws but establishes a baseline federal standard for data misuse by AI systems and data processors.
The Children and Teens' Online Privacy Protection Act (S 836) extends COPPA protections to teens aged 13-17 by requiring websites, apps, and online services to obtain verifiable consent from parents for children or from teens themselves before collecting or using their personal information for purposes beyond the service. It defines "personal information" broadly to include biometric data, voice recordings, persistent identifiers, and geolocation information, and prohibits using such information for individual-specific advertising without consent. The bill mandates clear notice about data practices and gives children and teens rights to access, correct, and delete their personal information. Additionally, it requires the FTC to conduct studies on mobile app oversight and the GAO to study teen privacy in financial technology products.
