The Data Care Act of 2025 would establish new responsibilities for online service providers—companies that collect personal data from internet users—to protect and responsibly manage that information. The bill requires these providers to meet three main duties: (1) reasonably secure personal data and promptly notify users of security breaches involving sensitive information like Social Security numbers, financial accounts, or health data; (2) avoid using personal data in ways that would harm users or violate their reasonable expectations of privacy; and (3) maintain strict confidentiality by not selling or sharing personal data unless the recipient agrees to follow the same protections and practices. The Federal Trade Commission and state attorneys general would enforce these requirements, with violators facing civil penalties calculated by the number of days of non-compliance or number of affected users, capped at existing FTC penalty limits. The bill takes effect upon enactment, but companies would have 180 days to comply with its data protection requirements. The legislation covers online services broadly but allows the FTC to exempt certain categories of smaller providers based on privacy risk and compliance costs.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.