Read twice and referred to the Committee on Commerce, Science, and Transportation.
The My Body, My Data Act of 2025 establishes federal privacy rules for "personal reproductive or sexual health information." It requires regulated entities (broadly defined businesses and organizations subject to FTC jurisdiction, excluding HIPAA-covered entities in their covered roles) to minimize collection, retention, use, and disclosure of such information unless strictly necessary to provide a requested product or service, and to limit employee access. The bill creates individual rights to access, correct, and delete this information (including inferred data), requires public privacy policies with specified disclosures, bans retaliation for exercising rights, and authorizes enforcement by the Federal Trade Commission and by private lawsuits with statutory and punitive damages; it also voids pre-dispute arbitration and class-waiver agreements for claims under the Act.
Scope of covered data: liberals and centrists value inclusion of inferred data to close privacy gaps; conservatives see that as overly broad and uncertain.
Relative to its intended legislative type, this bill is a well-structured substantive privacy statute: it clearly defines covered data and actors, enumerates individual rights, prescribes specific duties for regulated entities, and creates both administrative (FTC) and private enforcement pathways.
The My Body, My Data Act of 2025 establishes federal privacy rules for "personal reproductive or sexual health information." It requires regulated entities (broadly defined businesses and organizations subject to FTC jurisdiction, excluding HIPAA-covered entities in their covered roles) to minimize collection, retention, use, and disclosure of such information unless strictly necessary to provide a requested product or service, and to limit employee access.
The bill creates individual rights to access, correct, and delete this information (including inferred data), requires public privacy policies with specified disclosures, bans retaliation for exercising rights, and authorizes enforcement by the Federal Trade Commission and by private lawsuits with statutory and punitive damages; it also voids pre-dispute arbitration and class-waiver agreements for claims under the Act.
Definitions, a severability clause, First Amendment and state-law preservation provisions, and rulemaking authority for the FTC are included.
On substance, the bill advances a clear and enforceable privacy regime for a politically sensitive category of data. However, because it addresses a highly contentious policy area, imposes wide-ranging obligations and significant private liability, and removes arbitration waivers, it is likely to provoke organized opposition and require substantial compromise to attract the cross-chamber, bipartisan support typically needed to become law.
Relative to its intended legislative type, this bill is a well-structured substantive privacy statute: it clearly defines covered data and actors, enumerates individual rights, prescribes specific duties for regulated entities, and creates both administrative (FTC) and private enforcement pathways. It integrates with existing law through explicit exclusions and preemption rules.
Scope of covered data: liberals and centrists value inclusion of inferred data to close privacy gaps; conservatives see that as overly broad and uncertain.
These are examples from the analysis, not a ranked list of the most-affected groups.
Scope of covered data: liberals and centrists value inclusion of inferred data to close privacy gaps; conservatives see that as overly broad and uncertain.
A mainstream liberal would likely view this bill favorably as a targeted federal privacy protection designed to shield reproductive and sexual health information—especially non-HIPAA digital traces—from exploitation by advertisers, data brokers, or others that could be used to surveil or penalize people seeking reproductive care.
They would see the access, correction, and deletion rights and the broad definition of covered data (including inferred data) as important remedies following limits on reproductive rights in many states.
The private right of action and prohibition on arbitration would be seen as necessary enforcement tools to hold companies accountable.
A mainstream centrist would generally support the goal of protecting reproductive and sexual health data but would have pragmatic concerns about the bill’s operational details, compliance costs, and litigation risks.
They would welcome consumer-control mechanisms and transparency requirements while seeking clearer definitions, phased implementation, and proportional enforcement to avoid undue burdens on small businesses or innovation.
The 15-day compliance deadline, statutory damages per violation per day, and the ban on pre-dispute arbitration would stand out as provisions that could invite litigation and uncertainty.
A mainstream conservative would be skeptical of the bill’s expansion of federal regulatory power over a broad range of entities and would view many provisions as imposing heavy compliance costs and litigation exposure on businesses.
While sympathetic to the idea of protecting individual privacy, they would be concerned that the Act’s broad definitions (including inferred data) and the private right of action with statutory damages, plus the voiding of arbitration clauses, create significant legal and economic uncertainty.
They would also worry about federal overreach into areas better handled by states or market solutions, and about the potential chilling effect on online services and advertising-supported business models.
Reached or meaningfully advanced
Reached or meaningfully advanced
Still ahead
Still ahead
Still ahead
On substance, the bill advances a clear and enforceable privacy regime for a politically sensitive category of data. However, because it addresses a highly contentious policy area, imposes wide-ranging obligations and significant private liability, and removes arbitration waivers, it is likely to provoke organized opposition and require substantial compromise to attract the cross-chamber, bipartisan support typically needed to become law.
The bill has not accumulated any surfaced votes yet.
Scope of covered data: liberals and centrists value inclusion of inferred data to close privacy gaps; conservatives see that as overly broa…
On substance, the bill advances a clear and enforceable privacy regime for a politically sensitive category of data. However, because it ad…
Relative to its intended legislative type, this bill is a well-structured substantive privacy statute: it clearly defines covered data and actors, enumerates individual rights, prescribes specific duties for regulated e…
Go beyond the headline summary with full stakeholder mapping, legislative design analysis, passage barriers, and lens-by-lens tradeoff breakdowns.