Protects people’s reproductive and sexual health information by limiting when companies and other regulated entities can collect, use, retain, or share it — only when strictly necessary to provide a requested product or service. It gives people clear rights to access, correct, and delete that data (with free, easy-to-use request mechanisms and a 15-day response deadline), requires public privacy policies, forbids retaliation for using those rights, and empowers the Federal Trade Commission and private lawsuits to enforce the rules. The law also preserves existing legal obligations (disclosures required by law or court order), includes standard savings and severability rules, protects First Amendment rights, and lets stronger state privacy laws remain in force where they give greater protections than this Act.
Preserves the Commission’s existing authority: Nothing in this Act shall be read to limit the authority of the Commission under any other provision of law.
Allows required disclosures of personal reproductive or sexual health information: Nothing in this Act, or a regulation under it, shall be construed to prohibit a regulated entity from disclosing personal reproductive or sexual health information to the Commission when the disclosure is (1) required by law, (2) in compliance with a court order, or (3) in compliance with a civil investigative demand or a similar legally authorized process.
If any provision of this Act, or the application of that provision to any person or circumstance, is held invalid, the remainder of the Act and the application of that provision to other persons not similarly situated or to other circumstances shall not be affected.
Regulated entities are prohibited from collecting, retaining, using, or disclosing personal reproductive or sexual health information except when such action is strictly necessary to provide a product or service that the individual requested from the regulated entity. This is a limitation on data handling and sharing by the regulated entity .
Regulated entities must restrict employee and service-provider access to personal reproductive or sexual health information so that only those employees or service providers who need the information to provide a product or service requested by the individual may access it. This is an access-control requirement for internal staff and contractors .
Who is affected and how:
Individuals and consumers: People who generate reproductive or sexual health information (for example, patients, users of health or fertility apps, people seeking sexual or reproductive health services) gain new legal rights to access, correct, and delete that data, and receive stronger protections against unauthorized collection, sharing, or retaliation.
Platform operators, technology companies, and app developers: Businesses that collect or process health- or sex-related information (including websites, mobile apps, advertising platforms, and analytics firms) must change data practices to collect only what is strictly necessary, implement tighter access controls, publish detailed privacy policies, and build systems to handle free, timely access/correction/deletion requests (including machine-readable exports). These firms will also face FTC oversight and elevated litigation risk.
Health care providers and related service providers (including clinics, labs, and insurers): Must ensure disclosures, internal access, and data sharing meet the strict-necessity standard and that patients can exercise access/correction/deletion rights quickly. Entities must also document policies and technical protections.
Employers and workplaces: Where employee reproductive or sexual health information is held, employers must restrict access to only those who need it to provide an employment-related product or service and may not retaliate against employees for exercising rights under the Act.
Small businesses and third parties that support regulated entities (e.g., cloud providers, analytics vendors, service providers): May be subject to contractual or compliance obligations as regulated service providers or third parties; contracts and operational practices likely will need updating.
Courts and regulators: The FTC will have a new enforcement role and federal courts will see private litigation asserting injury based on violations. The ban on pre-dispute arbitration and joint-action waivers may increase class or multi-plaintiff litigation.
Net effects: The law raises compliance and operational costs for entities that handle reproductive/sexual health information (policy drafting, data minimization, access systems, legal exposure) while increasing individual privacy protections and legal remedies. Businesses that already practice strong data minimization and transparency will face lower incremental costs; firms that rely on broad data collection, cross-platform sharing, or monetization of sensitive health signals will be more substantially affected.
Last progress June 11, 2025 (8 months ago)
Introduced on June 11, 2025 by Sara Jacobs
Referred to the House Committee on Energy and Commerce.
Updated 6 hours ago
Last progress June 11, 2025 (8 months ago)
