My Body, My Data Act of 2025
- Sponsor
- Sen. Hirono, Mazie K. [D-HI]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Jun 11, 2025
Bottom line
This bill creates new federal privacy standards for sensitive health data outside of HIPAA, granting individuals more control over their reproductive and sexual health information and expanding FTC jurisdiction.
What it actually does
This bill establishes federal privacy protections for personal reproductive or sexual health information by requiring regulated entities to minimize data collection, retention, use, and disclosure. It grants individuals rights to access, correct, and delete their data, mandates clear privacy policies, and prohibits retaliation for exercising these rights. The bill also provides for enforcement by the Federal Trade Commission and through a private right of action.
Proponents argue
Proponents argue that the bill is essential to protect highly sensitive personal reproductive and sexual health information in an era of increasing data collection and evolving legal landscapes regarding reproductive rights. They contend it empowers individuals to control their own data, closes gaps in existing privacy laws, and prevents the misuse or weaponization of such information.
Opponents contend
Opponents might argue that the bill imposes significant and potentially overly broad compliance burdens on a wide range of businesses, including those not traditionally involved in healthcare, which could stifle innovation or increase costs. They may also raise concerns about the expansive definitions of protected information and regulated entities, as well as the potential for increased litigation through the private right of action.
The bill is relatively concise and its provisions are clearly laid out, making it accessible for a reader to understand its core impacts within a reasonable timeframe.
Section 2
Minimization Requirements
This section mandates that regulated entities can only collect, retain, use, or disclose personal reproductive or sexual health information when it is strictly necessary to provide a product or service requested by the individual. It also requires entities to restrict employee access to such information to only those who need it for service provision.
Supporters argue
Proponents argue that data minimization is a fundamental principle of privacy, ensuring that sensitive information is only handled when absolutely essential, thereby reducing the risk of misuse or breaches.
Critics contend
Critics might contend that defining 'strictly necessary' can be ambiguous and difficult to implement across diverse services, potentially hindering legitimate business operations or service improvements that rely on broader data insights.
Tradeoffs
This provision balances the individual's right to privacy with the operational needs of businesses to collect and use data to provide services. It prioritizes privacy by setting a high bar for data handling.
Section 3
Right of Access, Correction, and Deletion
This section grants individuals the right to access any personal reproductive or sexual health information a regulated entity holds about them, including inferred data and third-party sources. It also allows individuals to request correction of inaccurate information and deletion of their data. These requests must be fulfilled within 15 days without a fee, and information must be provided in human-readable and machine-readable formats.
Section 4
Privacy Policy Requirements
Regulated entities are required to maintain and prominently publish a clear and conspicuous privacy policy on their website. This policy must describe their practices for collecting, retaining, using, and disclosing personal reproductive or sexual health information, including categories of data, purposes, lists of specific third parties involved, and how individuals can exercise control over their data.
Section 5
Prohibition Against Retaliation
This section explicitly prohibits regulated entities from retaliating against an individual for exercising any of their rights under the Act. Retaliation includes denying goods or services, charging different prices or rates, or providing a different level or quality of services.
Section 6
Enforcement Mechanisms
This section establishes a dual enforcement framework. Violations are treated as unfair or deceptive acts under the Federal Trade Commission Act, granting the FTC enforcement powers, including rulemaking authority. Additionally, individuals can bring civil actions for violations, seeking damages (not less than $100 and not greater than $1,000 per violation per day, or actual damages, whichever is greater), punitive damages, attorney's fees, and other relief. It also explicitly states that a violation constitutes an injury in fact and invalidates pre-dispute arbitration agreements and joint-action waivers for disputes under this Act.
Section 7
Key Definitions
This section defines critical terms for the Act's scope. 'Personal reproductive or sexual health information' is broadly defined to include past, present, or future health, efforts to research/obtain services (including location data), conditions (like pregnancy, menstruation), procedures (like abortion), use of contraceptives, bodily functions, and any derived or inferred data. 'Regulated entity' includes persons, partnerships, or corporations subject to FTC jurisdiction, explicitly extending to common carriers and non-profits, but excludes HIPAA-covered entities and certain public health entities when acting in those capacities.
The definition of 'personal reproductive or sexual health information' is exceptionally broad, encompassing not only direct health conditions and services but also 'efforts to research or obtain' such information (including location data), 'inferred' data, and even basic bodily functions like menstruation and basal temperature.
Section 7(5)
Why it matters:While definitions are standard legislative practice, the expansive nature of this particular definition is highly consequential and could be easily overlooked by a casual reader focusing on the main operative sections.
Case for: Proponents argue this broad definition is essential to prevent circumvention of privacy protections by capturing all forms of data, including indirect or inferred information, that could be used to identify or track individuals' reproductive health decisions.
Case against: Critics might contend that the definition is overly broad and vague, potentially encompassing data points (like general location data or fitness tracker information) not traditionally considered 'health information,' leading to excessive compliance burdens and unintended consequences for a wide range of apps and services.
Estimated impact: Significantly expands the scope of data that must be protected under the Act, impacting a vast array of digital services and data brokers beyond traditional healthcare providers.
The definition of 'regulated entity' explicitly includes common carriers subject to the Communications Act of 1934 and organizations not organized for profit, overriding typical jurisdictional limitations of the Federal Trade Commission (FTC).
Section 7(6)(A)(ii)
Why it matters:This is a technical legislative maneuver to broaden the scope of entities subject to FTC oversight, which might be missed by those not familiar with the nuances of FTC jurisdiction.
Case for: Proponents argue that this expansion is necessary to ensure comprehensive protection for reproductive health data, as common carriers and non-profits often handle significant amounts of personal information that could be sensitive.
Case against: Critics, particularly from the telecom industry and some non-profit sectors, would argue that this extends FTC authority beyond its traditional scope and imposes new, potentially unfamiliar regulatory burdens on entities not equipped to handle health privacy compliance.
Estimated impact: Significantly broadens the range of entities subject to the Act's stringent privacy requirements, including telecommunications companies and various non-profit organizations.
This subsection explicitly invalidates pre-dispute arbitration agreements and pre-dispute joint-action waivers with respect to disputes arising under this Act, ensuring individuals can pursue civil actions in court, including class or collective actions.
Section 6(b)(4)
Why it matters:While common in strong consumer protection legislation, the invalidation of arbitration clauses is a significant policy choice that can be politically sensitive and is often placed within the enforcement mechanisms.
Case for: Proponents argue that this provision is essential to ensure meaningful access to justice for individuals, as arbitration clauses often limit consumers' ability to seek redress and prevent class actions that are crucial for addressing widespread violations.
Case against: Businesses typically favor arbitration agreements, arguing they provide a more efficient and less costly means of dispute resolution compared to court litigation, and critics would contend this provision will lead to an increase in expensive lawsuits.
Estimated impact: Significantly strengthens individuals' ability to seek legal redress for privacy violations under the Act, potentially leading to more class-action lawsuits against regulated entities.