What does Preamble of Data Care Act of 2025 do?

This bill aims to establish duties for online service providers. The duties relate to end user data collected and used by these providers.

What does SHORT TITLE. of Data Care Act of 2025 do?

This bill is formally titled the Data Care Act of 2025.

What does DEFINITIONS. of Data Care Act of 2025 do?

This section defines key terms used throughout the Act. The 'Commission' is defined as the Federal Trade Commission. An 'end user' is an individual who engages with or uses an online service provider's services. 'Individual identifying data' refers to data collected online that is linked to a specific end user or a device routinely used by them. An 'online service provider' is an entity engaged in interstate commerce that collects individual identifying data about end users. 'Sensitive data' includes a wide range of information, such as social security numbers, biometric data, financial account information, and health information.

What does PROVIDER DUTIES. of Data Care Act of 2025 do?

This section establishes duties of care, loyalty, and confidentiality for online service providers regarding individual identifying data. Online service providers must reasonably secure individual identifying data from unauthorized access and promptly inform end users of breaches involving sensitive data. Providers are prohibited from using individual identifying data in ways that harm end users or are unexpected and highly offensive. Disclosure or sale of individual identifying data is restricted unless a contract imposes similar duties on the recipient. If an online service provider transfers data to another person, the same duties apply to that person. The Commission can regulate breach notification requirements to apply to categories of data beyond 'sensitive data'. The Commission may also exempt certain online service providers from these requirements, considering privacy risks and costs/benefits.

What does ENFORCEMENT. of Data Care Act of 2025 do?

This section outlines enforcement mechanisms for violations of section 3. The Federal Trade Commission (FTC) is authorized to enforce this Act similarly to how it enforces the Federal Trade Commission Act. Nonprofit organizations and common carriers are specifically included in the FTC's enforcement authority. State attorneys general may bring civil actions on behalf of state residents against online service providers or persons violating section 3. Civil penalties for violations found in state actions are calculated based on the number of days of non-compliance or the number of harmed end users. State attorneys general must notify the FTC before initiating a civil action, except when immediate notification is not feasible. The FTC has the power to intervene in state civil actions and appeal decisions. State attorneys general retain their investigatory powers under state law. If the FTC initiates an action, state attorneys general cannot bring a separate action based on the same facts. Venue for state actions can be in a U.S. district court meeting venue requirements or another court of competent jurisdiction.

What does NONENFORCEABILITY OF CERTAIN PROVISIONS WAIVING RIGHTS AND of Data Care Act of 2025 do?

This section prohibits the waiver or limitation of rights and remedies provided under this Act. Contractual agreements cannot be used to waive or limit these rights and remedies.

What does RELATION TO OTHER PRIVACY AND SECURITY LAWS. of Data Care Act of 2025 do?

This section clarifies that the Act does not modify, limit, or supersede existing federal or state privacy or security laws. The Act does not limit the authority of the Commission under other laws.

What does EFFECTIVE DATE. of Data Care Act of 2025 do?

This Act generally takes effect on the date of its enactment. Section 3 will apply to online service providers or persons described in section 3(c) 180 days after the date of enactment.

Back to bills

Data Care Act of 2025

Last updated: 12/18/2025 · Introduced: 12/18/2025

Author: Brian Schatz (D-HI)

TL;DR (AI)

This bill establishes duties of care, loyalty, and confidentiality for online service providers regarding individual identifying data collected from end users.
The Federal Trade Commission (FTC) and state attorneys general are authorized to enforce the Act and impose civil penalties for violations.
The Act prohibits online service providers and their data recipients from using individual identifying data in ways that harm end users or are unexpected and highly offensive, and prevents contractual waivers of rights provided by the Act.

119th Congressin committeeOfficial page

Verified Votes

No verified votes yet.

Community Votes

No community votes yet. Be the first!

Voting as guest · Sign in for verified votes

Other Sections

Includes provisions on preamble, short title., and 6 more.

8 sections

Click "Show details" to explore individual sections. Use the community vote above or visit All Sections to vote per section.

Read official text

Want the full experience?

Create a free account to cast verified votes on each section, get a personalized summary, and track your voting history.

Create Free Account