My Body, My Data Act of 2025

This bill sets strong privacy rules for reproductive and sexual health data. Companies and organizations could collect, use, keep, or share this data only when it’s strictly needed to provide a service you asked for, and they must limit which workers and service providers can see it. You would have clear rights to see your data, know where it came from and who it was shared with (including any inferences made about you), fix mistakes, and delete it. Companies must offer an easy, online way to do this, reply within 15 days, and can’t charge a fee . They must also post a clear website privacy policy that explains what they collect, why, who they share it with and why, where they get it, how you can control it (with direct links), and how they protect it.

Companies can’t punish you for using your rights—for example, by denying service, charging more, or lowering quality. If a company breaks the rules, the Federal Trade Commission can act, and you can sue in court for damages, legal fees, and other relief. A violation counts as harm on its own, and companies can’t force you into private arbitration or block class actions for these disputes. The bill does not limit free speech and does not weaken stronger state privacy laws; it only overrides conflicting state rules that offer less protection. It also allows required disclosures to the government when the law or a court order demands it, and if one part is struck down, the rest stays in place.

• Who is affected: People whose reproductive or sexual health information is handled; companies and their service providers that collect, use, or share it.
• What changes: Collect only what’s strictly needed; limit employee access; give easy, free, 15-day tools to see/correct/delete data; post a clear privacy policy; no retaliation for using your rights .
• Enforcement and remedies: FTC enforcement, plus your right to sue, seek damages and fees, and bring or join class actions; no forced arbitration for these disputes .