The "My Body, My Data Act of 2025" aims to establish comprehensive federal privacy protections for individuals' personal reproductive and sexual health information. It broadly defines this sensitive data to include details about seeking services, health conditions, procedures like abortion, use of contraceptives, and even inferred or derived information. A core provision is minimization , requiring regulated entities to collect, retain, use, or disclose such information only as strictly necessary to provide a product or service requested by the individual. Employee access to this data is similarly restricted to essential personnel. The bill grants individuals significant rights of access, correction, and deletion regarding their reproductive and sexual health information. Upon a verified request, entities must provide access to all retained data, including sources from third parties and inferred information, in both human-readable and machine-readable formats. Individuals can also direct the correction of inaccurate data and the deletion of any retained information, with requests to be fulfilled within 15 days and without charge. Regulated entities are mandated to maintain and prominently publish a clear privacy policy . This policy must detail their data practices, categories of information handled, purposes for collection and disclosure, lists of specific third parties involved, and how individuals can exercise control over their data. To ensure these rights are meaningful, the Act prohibits retaliation against individuals for exercising their privacy rights, preventing entities from denying services or charging different prices. Enforcement mechanisms include actions by the Federal Trade Commission , treating violations as unfair or deceptive acts, and empowering individuals to bring private civil actions for damages, punitive damages, and attorney's fees. Importantly, pre-dispute arbitration agreements are invalidated for disputes under this Act, and state laws offering greater privacy protections are preserved.
The "My Body, My Data Act of 2025" aims to establish comprehensive federal privacy protections for individuals' personal reproductive and sexual health information. It broadly defines this sensitive data to include details about seeking services, health conditions, procedures like abortion, use of contraceptives, and even inferred or derived information. A core provision is minimization , requiring regulated entities to collect, retain, use, or disclose such information only as strictly necessary to provide a product or service requested by the individual. Employee access to this data is similarly restricted to essential personnel. The bill grants individuals significant rights of access, correction, and deletion regarding their reproductive and sexual health information. Upon a verified request, entities must provide access to all retained data, including sources from third parties and inferred information, in both human-readable and machine-readable formats. Individuals can also direct the correction of inaccurate data and the deletion of any retained information, with requests to be fulfilled within 15 days and without charge. Regulated entities are mandated to maintain and prominently publish a clear privacy policy . This policy must detail their data practices, categories of information handled, purposes for collection and disclosure, lists of specific third parties involved, and how individuals can exercise control over their data. To ensure these rights are meaningful, the Act prohibits retaliation against individuals for exercising their privacy rights, preventing entities from denying services or charging different prices. Enforcement mechanisms include actions by the Federal Trade Commission , treating violations as unfair or deceptive acts, and empowering individuals to bring private civil actions for damages, punitive damages, and attorney's fees. Importantly, pre-dispute arbitration agreements are invalidated for disputes under this Act, and state laws offering greater privacy protections are preserved.