Data Care Act of 2025
- Sponsor
- Sen. Schatz, Brian [D-HI]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Dec 18, 2025
Bottom line
The Data Care Act of 2025 seeks to create a federal privacy framework by imposing fiduciary-like obligations on online service providers for handling user data, with significant enforcement powers granted to federal and state authorities.
What it actually does
This bill establishes federal duties of care, loyalty, and confidentiality for online service providers regarding the individual identifying data they collect from end users. It mandates reasonable data security, prohibits data use detrimental to users, and restricts data sharing unless third parties agree to uphold the same duties, requiring providers to audit such third parties. The Federal Trade Commission and State Attorneys General are empowered to enforce these new standards.
Proponents argue
Supporters argue that this bill is essential for protecting consumers in the digital age by establishing clear, enforceable standards for how online companies handle personal data. They contend that the current regulatory landscape is insufficient to prevent data breaches, misuse, and deceptive practices, and that imposing fiduciary duties will foster greater trust and accountability, ensuring that companies act in the best interest of their users.
Opponents contend
Critics may argue that the bill's broad definitions and potentially subjective standards, such as what constitutes 'highly offensive to a reasonable end user,' could create significant legal uncertainty and lead to excessive litigation. They might also contend that the compliance burdens, particularly the requirement to audit third-party data recipients, could stifle innovation and disproportionately impact smaller online service providers, potentially leading to market consolidation.
The bill is relatively concise for its scope, making it accessible for an informed reader to understand its core provisions and implications within a reasonable timeframe.
Section 2
Definitions of Key Terms
This section defines critical terms that determine the bill's scope and applicability. It specifies 'end user' as an individual engaging with an online service provider, 'individual identifying data' as data linked to a specific user or device, and 'online service provider' as any entity engaged in interstate commerce that collects such data. Crucially, it provides a comprehensive list of 'sensitive data,' including social security numbers, financial information, biometric data, health information, and nonpublic communications.
Supporters argue
Supporters argue that clear and comprehensive definitions are foundational for effective data protection legislation, ensuring that the scope of the law is well-understood by both regulated entities and protected individuals. The detailed list of 'sensitive data' is seen as crucial for providing enhanced protection to the most vulnerable types of personal information.
Critics contend
Some critics might argue that the broad definition of 'online service provider' and 'individual identifying data' could inadvertently capture a wide range of entities and data types, potentially imposing unforeseen compliance burdens on businesses not traditionally considered 'tech companies.'
Tradeoffs
The tension lies between casting a wide enough net to cover all relevant data handlers and avoiding overreach that could burden entities with minimal data collection or processing activities.
Section 3(a) and (b)
Establishment of Core Data Duties (Care, Loyalty, Confidentiality)
This section establishes three core duties for online service providers: a duty of care to reasonably secure individual identifying data and promptly inform users of sensitive data breaches; a duty of loyalty prohibiting data use that harms users or is 'unexpected and highly offensive'; and a duty of confidentiality restricting disclosure or sale of data unless consistent with the other duties and only to third parties who contractually agree to uphold the same duties, with the provider taking reasonable steps to ensure their compliance, including auditing.
Section 3(c)
Application of Duties to Third Parties
This provision clarifies that if an online service provider transfers or provides access to individual identifying data to another person (a third party), those same duties of care, loyalty, and confidentiality apply to that third party with respect to the data. This ensures that data protection obligations are not circumvented by simply sharing data with other entities.
Section 4(a)
Federal Trade Commission Enforcement Powers
This section grants the Federal Trade Commission (FTC) primary federal enforcement authority for violations of the Act. It stipulates that violations will be treated as unfair or deceptive acts or practices under the Federal Trade Commission Act, giving the FTC broad powers, including the ability to levy civil penalties. Notably, it expands the FTC's jurisdiction to include non-profit organizations and common carriers, entities typically exempt from some FTC oversight.
Section 4(b)
State Enforcement Powers and Civil Penalties
This section authorizes State Attorneys General (and other authorized state consumer protection officers) to bring civil actions against online service providers or third parties for violations of the Act on behalf of their state's residents. Such actions can include seeking civil penalties for knowing or repeated violations, calculated based on the number of days of non-compliance or the number of harmed end users, multiplied by the maximum FTC civil penalty. States must notify the FTC before initiating action, and the FTC has the right to intervene.
The duty of loyalty prohibits using individual identifying data in a way that 'would be unexpected and highly offensive to a reasonable end user.'
Section 3(b)(2)(B)(ii)
Why it matters:The use of subjective standards like 'reasonable end user' is common in law to allow for flexibility and adaptation to evolving societal norms and technological changes. However, it can also be seen as a way to defer precise definition to future regulatory interpretation or judicial precedent.
Case for: Proponents argue that such a standard is necessary to capture unforeseen harms and evolving consumer expectations regarding data privacy, providing a flexible framework that can adapt to future technological developments and data practices. It allows for a common-sense approach to data ethics.
Case against: Critics contend that the subjectivity of 'unexpected and highly offensive' creates significant legal uncertainty for online service providers, making it difficult to proactively ensure compliance. This ambiguity could lead to a chilling effect on innovation or an increase in litigation as companies and courts grapple with its interpretation.
Estimated impact: This standard could significantly influence how online service providers design services and use data, potentially restricting practices that, while not causing direct physical or financial harm, are perceived as intrusive or exploitative by users.
The duty of confidentiality requires online service providers to take 'reasonable steps to ensure that the practices of any person to whom the online service provider discloses or sells, or with whom the online service provider shares, individual identifying data fulfill the duties of care, loyalty, and confidentiality assumed by the person under the contract... including by auditing, on a regular basis, the data security and data information practices of any such person.'
Section 3(b)(3)(C)
Why it matters:This level of detail regarding oversight mechanisms is often placed within the operational specifics of a duty rather than in a headline provision. It represents a concrete, albeit burdensome, compliance requirement.
Case for: Proponents argue that regular auditing of third-party data recipients is essential to ensure that data protection doesn't end once data leaves the primary provider. This provision creates a strong incentive for all parties in the data chain to maintain high standards of security and privacy, preventing data leakage through less scrupulous partners.
Case against: Critics, particularly from the tech industry, would argue that mandating 'regular auditing' of all third-party data recipients is an extremely onerous and potentially impractical requirement, especially for providers who work with numerous vendors globally. This could significantly increase operational costs and complexity, potentially leading companies to reduce data sharing even for legitimate purposes.
Estimated impact: This provision could fundamentally alter how online service providers manage their vendor relationships and data supply chains, leading to significant investments in compliance, auditing tools, and potentially a reduction in the number of third-party partners.
Expands the Federal Trade Commission's enforcement jurisdiction to include 'organizations not organized to carry on business for their own profit or that of their members' (non-profits) and 'common carriers subject to the Communications Act of 1934.'
Section 4(a)(2)(C)
Why it matters:Jurisdictional carve-outs and expansions are often found in the technical enforcement sections of legislation. While critical, they may not be highlighted as prominently as the core duties themselves.
Case for: Proponents argue that data privacy protections should apply universally, regardless of an entity's tax status or traditional regulatory classification. They contend that non-profits and common carriers often handle vast amounts of sensitive personal data, and their exemption from FTC privacy enforcement creates a significant loophole that this provision closes, ensuring consistent consumer protection.
Case against: Opponents, particularly from the affected sectors, would argue that non-profits often operate with limited resources and different motivations than commercial entities, making FTC enforcement inappropriate or overly burdensome. Common carriers are already regulated by the FCC for many aspects of their operations, and this could lead to duplicative or conflicting regulatory regimes.
Estimated impact: This provision would bring a significant number of new entities under FTC privacy enforcement, potentially leading to increased compliance costs for these organizations and a broader scope of enforcement actions for the FTC.