Data Care Act of 2025

This bill would require online service providers that collect data linked to individual users to follow duties of care, loyalty, and confidentiality. Providers would have to reasonably secure user data, promptly tell users about breaches of sensitive data, and not use data in ways that benefit the provider while harming users or that users would find unexpected and highly offensive. Providers could share or sell user data only with parties that sign contracts taking on the same duties, and providers would have to audit those parties regularly. The Federal Trade Commission and state attorneys general could enforce the law, including civil penalties, and the duties would apply 180 days after the law is enacted.

Full text and official record on Congress.gov

Sponsors

• Brian Schatz Democrat sponsor
• 14 cosponsors