My Body, My Data Act of 2025

Key Points

• The bill strictly limits how companies can collect, keep, use, or share personal reproductive and sexual health information. Companies can only handle this data when it is strictly necessary to provide a product or service that the person specifically asked for.
• People would gain the right to see what reproductive health data a company holds about them, where it came from, and who it was shared with. They could also request corrections to inaccurate data or full deletion, and companies must respond within 15 days at no charge.
• The bill covers an extremely broad range of data, from period tracking and pregnancy symptoms to location data suggesting someone visited a clinic. It even covers information that companies guess or infer about a person, like predicting pregnancy from shopping habits.
• The FTC would enforce the law, but individuals can also sue companies directly. Courts could award $100 to $1,000 per violation per day, plus punitive damages and attorney fees. Pre-dispute arbitration agreements cannot block these lawsuits.
• Companies cannot punish people for exercising their privacy rights. They cannot deny services, charge different prices, or provide lower quality goods or services in retaliation. State laws that offer even stronger protections are preserved.