My Body, My Data Act of 2025
- Sponsor
- Rep. Jacobs, Sara [D-CA-51]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Jun 11, 2025
Bottom line
The bill creates a new federal privacy standard specifically for reproductive and sexual health data, aiming to prevent its misuse by entities not covered by existing health privacy laws and empowering individuals with control over their sensitive information.
What it actually does
This bill establishes federal privacy protections for personal reproductive or sexual health information by requiring regulated entities to minimize the collection, retention, use, and disclosure of such data. It grants individuals rights to access, correct, and delete their data, mandates transparent privacy policies, and prohibits retaliation for exercising these rights. The Federal Trade Commission (FTC) is empowered to enforce the Act, and individuals are granted a private right of action.
Proponents argue
Supporters argue that the bill is crucial for protecting individuals' sensitive health information in an era where data brokers and unregulated entities can collect and monetize deeply personal data, especially in the post-Roe v. Wade landscape. They contend it empowers individuals to control their own health data and prevents its weaponization, closing critical loopholes in existing privacy frameworks.
Opponents contend
Critics might argue that the bill creates an overly broad definition of 'personal reproductive or sexual health information' that could stifle innovation or impose undue burdens on a wide range of businesses, including those not primarily focused on health. Concerns could also be raised about potential conflicts with existing state and federal data privacy laws, the scope of FTC enforcement, and the potential for excessive litigation due to the private right of action.
The bill is relatively concise and clearly structured, making it accessible for a reader to understand its core provisions within a reasonable timeframe.
Section 2(a) and 2(b)
Data Minimization Requirements
This section mandates that regulated entities can only collect, retain, use, or disclose personal reproductive or sexual health information when it is strictly necessary to provide a product or service requested by the individual. It also requires restricting employee access to this data to only those employees or service providers for whom access is necessary to provide the requested product or service.
Supporters argue
Supporters argue this is a fundamental privacy principle, ensuring that sensitive health data is not collected or used beyond what is absolutely essential, thereby reducing the risk of misuse and protecting individual autonomy.
Critics contend
Some entities might argue that 'strictly necessary' is too vague or restrictive, potentially hindering legitimate business operations or the development of beneficial services that rely on broader data insights.
Tradeoffs
This provision balances individual privacy rights against the operational flexibility and data utilization practices of businesses.
Section 3(a), (b), (c), (d)
Individual Data Rights (Access, Correction, Deletion)
This section grants individuals the right to access any personal reproductive or sexual health information a regulated entity holds about them, including data collected from third parties or inferred. It also provides the right to correct inaccurate information and delete any such data. Entities must provide a 'reasonable mechanism' for these requests, respond within 15 days, and cannot charge fees.
Section 4(a), (b), (c)
Transparent Privacy Policies
Regulated entities are required to maintain and prominently publish a clear and conspicuous privacy policy on their website. This policy must detail their practices for collecting, retaining, using, and disclosing personal reproductive or sexual health information, including categories of data, purposes, lists of specific third parties involved (and their uses), and how individuals can exercise control over their data.
Section 6(a), (b)
Federal Trade Commission and Private Right of Action Enforcement
This section grants enforcement authority to the Federal Trade Commission (FTC), treating violations as unfair or deceptive acts under the FTC Act. It also establishes a private right of action, allowing individuals to sue for violations and seek damages (not less than $100 and not greater than $1,000 per violation per day, or actual damages, whichever is greater), punitive damages, attorney's fees, and other relief. It explicitly states that a violation constitutes an 'injury in fact' and invalidates pre-dispute arbitration agreements and joint-action waivers for disputes under this Act.
Section 7
Key Definitions, especially 'Personal Reproductive or Sexual Health Information' and 'Regulated Entity'
This section defines critical terms, most notably 'personal reproductive or sexual health information' very broadly to include efforts to research/obtain services, conditions, surgeries, use of contraceptives/medication abortion, bodily functions related to menstruation/pregnancy, and any derived or extrapolated information. It also defines 'regulated entity' broadly to include persons, partnerships, corporations subject to FTC jurisdiction, common carriers, and non-profits, with specific exclusions for HIPAA-covered entities and certain Public Health Service Act entities.
This clause significantly expands the definition of 'personal reproductive or sexual health information' to include data inferred or extrapolated from non-health information, such as location data, search history, or purchase patterns, if it relates to reproductive or sexual health.
Section 7(5)(G)
Why it matters:While standard legislative practice for defining scope, its broad implications make it a critical detail that shapes the entire reach of the bill.
Case for: Supporters argue this is essential to prevent companies from circumventing the law by using indirect data to infer sensitive health information, thereby protecting privacy in the age of advanced data analytics.
Case against: Critics might argue this creates an extremely broad and potentially ambiguous standard, making it difficult for entities to determine what data might be considered 'inferred' reproductive health information and thus subject to the Act.
Estimated impact: Significantly expands the scope of protected data, impacting a vast array of data collection and processing activities by regulated entities.
This clause explicitly invalidates any pre-dispute arbitration agreements or pre-dispute joint-action waivers with respect to disputes arising under this Act, ensuring individuals can pursue civil actions in court, including class actions.
Section 6(b)(4)
Why it matters:This is a substantively significant carve-out from common business practices, often placed in enforcement details rather than highlighted as a primary policy change.
Case for: Proponents argue this is crucial for ensuring effective individual recourse, as arbitration clauses often limit consumers' ability to seek justice and hold companies accountable for privacy violations, especially for sensitive data.
Case against: Opponents, particularly businesses, typically argue that arbitration is a more efficient and less costly dispute resolution mechanism than litigation, and invalidating these agreements could lead to a surge in expensive class-action lawsuits.
Estimated impact: Significantly increases the legal exposure of regulated entities for non-compliance and empowers individuals to pursue collective legal action.