Sponsors
The bill expands individuals' ability to use de-identified or cloaked data and strengthens FTC authority with clearer definitions to enable privacy-preserving uses, but does so at the cost of higher compliance burdens, legal uncertainty, and potential re-identification risks to users.
Individuals and app users can use de-identified or 'cloaked' versions of their data with apps and services without covered entities blocking that use, expanding user control over data.
Clarifies and affirms FTC enforcement authority over blocking or misuse of de-identified data, enabling stronger consumer protections and potential penalties for noncompliance.
Provides statutory definitions for 'de-identified', 'cloaked' data, and 'unique persistent identifiers', giving businesses clearer compliance rules to support privacy-preserving data uses.
Users and consumers face increased risk that 'unique persistent identifiers' and cloaked data could be re-identified if safeguards are insufficient, threatening privacy and safety.
Covered entities (businesses) will likely incur higher compliance costs and may face FTC enforcement actions for misclassifying data or identifiers, increasing operational burden.
Ambiguous terms (e.g., 'reasonably linkable') could create legal uncertainty and spur litigation over what qualifies as de-identification, risking disruptions to services and slower innovation.
Based on analysis of 2 sections of legislative text.
Prevents private data holders from stopping people from using de-identified or cloaked data and empowers the FTC to enforce that rule under its existing authority.
Introduced November 12, 2025 by Lori Trahan · Last progress November 12, 2025
Prohibits private entities that collect or handle personal data from stopping people from using de-identified data or ‘‘cloaked’’ data (unique persistent identifiers that hide personal details while enabling communication). The Federal Trade Commission is given authority to enforce this prohibition using its existing powers under the FTC Act. The bill excludes government entities and a specified nonprofit resource center from the definition of covered entities, and it allows covered entities to continue to impose limits when they act as service providers.