Section 1 Short title
This Act may be cited as the “Manage Your Data and Allow Only Trusted Access Act of 2025” or the “MY DATA Act of 2025”.
Manage Your Data and Allow Only Trusted Access Act of 2025
A BILL
To prohibit covered entities from preventing the use of certain data by individuals, and for other purposes.
Sec. 2 Prohibition on covered entity action against consumer privacy
Prohibition—
In general— A covered entity may not prevent an individual from using de-identified data or cloaked data.
Exception— The prohibition described in paragraph (1) does not apply to a covered entity to the extent that the covered entity acts as a service provider.
Enforcement by Federal Trade Commission—
Unfair or deceptive acts or practices— A violation of subsection (a)(1) shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
Powers of the Commission— The Federal Trade Commission shall enforce subsection (a)(1) in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section, and any person who violates subsection (a)(1) shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Definitions— In this section:
Cloaked data— The term cloaked data means unique persistent identifiers that serve to adequately replace and conceal the covered data and identity of an individual while enabling communication between a covered entity and the individual.
Covered data— The term covered data means information that identifies or is linked or reasonably linkable (alone or in combination with other information) to an individual (or a device that identifies or is linked or reasonably linkable to an individual).
Covered entity—
In general— The term covered entity means any person (other than an individual acting in a non-commercial context) who (alone or jointly with others) collects, processes, or transfers covered data.
Exclusions— The term covered entity does not include any of the following:
A Federal, State, or local government entity, such as a body, authority, board, bureau, commission, district, agency, or political subdivision of the Federal Government or a State or local government.
An entity that serves as a congressionally designated nonprofit, national resource center, and clearinghouse to provide assistance to victims, families, child-serving professionals, and the general public on issues relating to missing and exploited children.
De-identified data— The term de-identified data means information that does not identify and is not linked or reasonably linkable to an individual (or a device that identifies or is linked or reasonably linkable to an individual), regardless of whether such information is aggregated.
Unique persistent identifier— The term unique persistent identifier means an identifier—
to the extent that such identifier is linked or reasonably linkable to an individual (or a device that identifies or is linked or reasonably linkable to an individual); and
that is created uniquely for communication between such individual and a covered entity.