This bill, the My Body, My Data Act of 2025, would set federal rules about personal reproductive and sexual health information. It defines that information broadly (for example, pregnancy, menstruation, contraception, abortion, attempts to obtain reproductive services, and data inferred from other information). Regulated entities could only collect, keep, use, or share that information when strictly necessary to provide a product or service the individual requested. The bill would require regulated entities to limit employee and service-provider access to only those who need the information to provide the requested product or service.
The bill gives individuals rights to access, correct, and delete their reproductive or sexual health information held by a regulated entity. Requests must be handled through a reasonable mechanism (including an online option), be easy to use, and be completed without undue delay and no later than 15 days after a verified request. Entities may not charge fees for these requests. Information must be provided in both a human-readable and a structured, machine-readable format. Privacy policies about these practices must be published prominently online and include specific lists of third parties that collect or receive such information and the purposes for those disclosures.
The bill bans retaliation against individuals who exercise these rights (for example, denying or worsening service or charging different prices). It allows the Federal Trade Commission to enforce the law and to write regulations. It also creates a private right of action: individuals may sue for violations and, if they win, may recover statutory damages of $100 to $1,000 per violation per day or actual damages, punitive damages, attorney’s fees, and other relief. The bill says a violation of this Act counts as a concrete injury in fact for standing. It also makes pre-dispute arbitration agreements and class-action waivers unenforceable for disputes under this Act.
The bill includes definitions for "regulated entity," "service provider," and other key terms. It excludes entities acting as HIPAA covered entities or business associates to the extent they are subject to HIPAA rules. The bill preserves First Amendment protections, does not preempt state laws that provide greater privacy protections, and preserves other federal authorities. It contains standard savings and severability provisions.
If passed, people would have clear rights to see, correct, and delete reproductive or sexual health information that companies keep about them. Companies and service providers would be limited in when they can collect or share that kind of information and would have to publish clear privacy policies about those practices. You could sue if a company violates these rules, and you could not be forced into pre-dispute arbitration for these disputes.
No publicly available information.
The bill aims to protect the privacy of personal reproductive and sexual health information by limiting collection, access, use, and disclosure; by giving individuals access, correction, and deletion rights; by requiring clear privacy policies; and by creating enforcement tools through the FTC and private lawsuits.
No publicly available information.