HR3916-119

What This Bill Does

The My Body, My Data Act creates a federal privacy rule for personal reproductive or sexual health information held by covered businesses and service providers. A regulated entity may collect, keep, use, or disclose that information only when strictly necessary to provide a product or service the person requested, and internal access must be limited to employees or service providers who need the information for that requested product or service. Individuals get verified-request rights to see retained information, learn which third parties supplied or received it, correct inaccurate data, and delete retained data, including inferences and third-party-collected information. Entities must publish clear privacy policies listing categories of reproductive or sexual health data, purposes, third parties, controls, and safeguards. They may not retaliate by denying service, charging different prices, lowering quality, or suggesting worse terms because a person used these rights. Violations are treated like FTC unfair or deceptive practice rule violations, FTC may issue implementing regulations, individuals may sue for $100 to $1,000 per violation per day or actual damages, punitive damages, fees, costs, and equitable relief, and privacy violations count as concrete injuries. Pre-dispute arbitration agreements and joint-action waivers are unenforceable for disputes under the Act. State attorneys general may also enforce, stronger state privacy laws are preserved, First Amendment freedoms are not limited, and the FTC keeps its other authority.

Who Benefits and How

Patients seeking reproductive health care benefit because apps, websites, data brokers, and service providers must minimize sensitive data collection and disclosure. Abortion patients benefit from rights to delete, correct, and trace reproductive-health information that could reveal services, location, medication, or procedure history. Contraception users benefit because purchase and use data receive the same access, correction, deletion, and privacy-policy protections. State attorneys general benefit from explicit enforcement authority for reproductive and sexual health privacy violations. Privacy plaintiffs benefit from statutory damages, punitive damages, attorney fees, and limits on forced arbitration.

Who Bears the Burden and How

Regulated health app operators must rebuild data practices around strict necessity, access limits, verified requests, and privacy-policy disclosures. Third-party data brokers must disclose sources and recipients and may lose retention or resale opportunities for reproductive health data. FTC privacy staff must enforce the Act and may write implementing rules. Service providers handling sensitive data must restrict employee access and honor deletion or correction obligations through their business customers. Companies relying on arbitration clauses cannot force covered disputes into pre-dispute arbitration or block joint actions.

Key Provisions

• Limits reproductive or sexual health data collection, retention, use, and disclosure to what is strictly necessary for requested services.
• Creates individual rights to access, correct, delete, and trace third-party sources or recipients of sensitive health data.
• Requires clear privacy policies explaining data categories, purposes, third parties, user controls, and safeguards.
• Prohibits retaliation against individuals who exercise privacy rights.
• Provides FTC enforcement, private civil actions, statutory damages, punitive damages, fees, and state attorney general enforcement.
• Bars forced arbitration and joint-action waivers for disputes under the Act.
• Preserves stronger state privacy laws, FTC authority, and First Amendment protections.