Creates new privacy rules for personal reproductive and sexual health information held by private companies and other regulated entities: limits collection and sharing to what is strictly necessary to provide a requested product or service, requires easy access/correction/deletion on verified request, mandates public privacy policies, and bans retaliation for using these rights. It gives the Federal Trade Commission enforcement power and a private right of action with monetary damages and other remedies, while preserving exceptions for legal process and existing law. Imposes operational requirements (access timelines, no fees, employee access limits), defines covered terms and entities, and clarifies that the Act does not reduce other federal authorities or First Amendment protections; state laws that offer greater privacy protection are not preempted.
The Act must not be interpreted to limit the authority of the Commission under any other provision of law.
The Act, and any regulation made under it, must not be interpreted to prohibit a regulated entity from disclosing personal reproductive or sexual health information to the Commission when that disclosure is required by law, is made in compliance with a court order, or is made in compliance with a civil investigative demand or similar legally authorized process.
If any provision of this Act, or the application of any provision to any person or circumstance, is held invalid, the remainder of the Act shall not be affected by that invalidation.
An invalidation of a provision's application to a particular person or circumstance does not affect the application of that provision to other persons not similarly situated or to other circumstances.
Regulated entities may not collect, retain, use, or disclose personal reproductive or sexual health information except when it is strictly necessary to provide a product or service that the individual requested.
Primary effects:
Individuals: Gains stronger control over reproductive and sexual health data held by private companies and service providers—rights to access, correct, and delete data; clearer notice of collection and sharing; protection from retaliation. Faster remedies and clearer standing to sue may increase individuals’ ability to enforce rights.
Businesses and platforms (period‑tracking apps, telehealth providers, pharmacies, clinics, social platforms, ad networks, payment processors, and other regulated entities): Must limit data collection to strictly necessary uses, implement role-based access controls, build or update mechanisms for verified access/correction/deletion requests, publish enhanced privacy policies, and train personnel to avoid prohibited uses and retaliation. Compliance will require operational changes, privacy engineering, and legal counsel; potential increased costs for implementation, recordkeeping, and responding to private litigation or FTC enforcement actions.
Third parties and service providers: Entities receiving data must fit within the Act’s defined categories and follow restrictions on use and disclosure; contractual relationships and vendor-management practices will need revision to reflect limitations and verification procedures.
Federal agencies and courts: The FTC will have expanded enforcement responsibilities for these privacy protections, including potential rulemaking and increased investigations; courts will adjudicate private suits with statutory damages and punitive possibilities; pre-dispute arbitration and class/joint-action waiver enforcement will be curtailed for covered disputes.
Public interest and public-health research: The strict necessity standard could limit some secondary uses of reproductive/sexual health data (e.g., research, public-health surveillance) unless those uses are structured so data collection/use is necessary to deliver the service requested or another lawful exception applies; researchers and public‑health entities may need to rely on different legal bases or enhanced consent models.
Interaction with state law and constitutional rights: State laws that provide greater privacy protections remain effective; the Act preserves First Amendment protections and other federal authorities. Litigation may arise over the scope of definitions (what counts as reproductive/sexual health information), the “strictly necessary” standard, and the balance between privacy and lawful disclosures.
Overall, the Act increases privacy protections and individual control over sensitive reproductive and sexual health information but also raises compliance burdens for covered entities and the likelihood of regulatory and private enforcement actions.
Last progress June 11, 2025 (8 months ago)
Introduced on June 11, 2025 by Mazie Hirono
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Updated 5 hours ago
Last progress June 11, 2025 (8 months ago)