Sponsor
Lori Trahan
Representative · D-MA
Representative · D-MA
The bill expands individuals' ability to use de-identified or cloaked data and clarifies FTC enforcement and definitions to enable privacy-preserving uses, but it increases compliance and enforcement exposure for businesses and raises re-identification and legal-uncertainty risks for consumers and service providers.
Individuals (end users and app developers) can access and use de-identified or 'cloaked' versions of their data for apps and services without covered entities blocking that use.
Clarifies and affirms FTC enforcement authority to act against entities that improperly block lawful use of de-identified data, strengthening consumer protections and enforcement tools.
Establishes statutory definitions for de-identified/cloaked data and unique persistent identifiers, giving businesses clearer compliance rules to support privacy-preserving data uses and innovation.
Allowing unique persistent identifiers that remain linkable, even when 'cloaked,' raises the risk of re-identification and privacy harms to consumers if technical or policy safeguards are insufficient.
Covered entities will face increased compliance costs and greater exposure to FTC enforcement or penalties for misclassifying data or identifiers, which can raise operational costs and prices.
Ambiguous legal terms (e.g., 'reasonably linkable') create uncertainty about what qualifies as de-identified data, inviting litigation and regulatory disputes that could disrupt services and increase legal costs.
Based on analysis of 2 sections of legislative text.
Prohibits covered entities from blocking individuals' use of de-identified or cloaked data and makes violations enforceable by the FTC under the FTC Act.
Official title: To prohibit covered entities from preventing the use of certain data by individuals, and for other purposes.
Introduced November 12, 2025 by Lori Trahan · Last progress November 12, 2025
Stops companies that collect personal data from forbidding people from using de-identified or “cloaked” versions of their data, while allowing an exception when those companies act as service providers; gives the FTC authority to enforce the rule under its existing powers. Defines key terms (covered data, de-identified data, cloaked data, unique persistent identifier, covered entity) and treats violations as violations under the FTC Act, enabling civil penalties and other FTC remedies.