My Body, My Data Act of 2025

Summary

Limits how companies and other covered organizations may collect, keep, use, and share personal reproductive and sexual health information, and gives people rights to access, correct, and delete that data. It requires clear privacy notices, prohibits retaliation for exercising rights, preserves law-enforcement and other legal exceptions, and gives the Federal Trade Commission enforcement power plus a private right of action with statutory damages and other remedies.

• Prohibits unnecessary collection, retention, use, or disclosure of personal reproductive and sexual health information.
• Gives individuals verified rights to access, correct, and delete their reproductive or sexual health data, with responses due within 15 days.
• Requires a prominent, detailed privacy policy listing categories, purposes, and named third parties for data sharing and collection.
• Bars retaliation by covered entities for exercising rights (no denial, price changes, or lower quality of service permitted).
• Enables FTC enforcement and creates a robust private right of action with statutory damages, punitive damages, and attorneys’ fees.
• Invalidates pre-dispute arbitration and class-action waiver clauses for disputes under the law.
• Defines covered data broadly to include inferred data and many types of reproductive and sexual health information, while excluding HIPAA-covered entities acting in that capacity.
• Preserves law-enforcement and court-ordered disclosures, First Amendment protections, and state laws that provide stronger privacy protections.