Data Care Act of 2025

Key Points

• Would require online companies that collect data about you to follow three basic rules: protect it, don’t use it against you, and don’t share it carelessly.
• Sets a “duty of care” to reasonably secure your identifying data and to quickly tell you if your sensitive data is exposed in a breach.
• Sets a “duty of loyalty” so a company can’t use your data in ways that benefit the company but harm you, including uses that could cause real physical or financial harm or feel shocking and offensive to most people.
• Sets a “duty of confidentiality” limiting selling or sharing your identifying data, and requires contracts and regular checks when data is shared with other companies.
• Gives the Federal Trade Commission and state attorneys general power to enforce the rules; companies can’t take away these rights in fine-print contracts, and most duties would start 180 days after the bill becomes law.