Section 1 Short title
This Act may be cited as the “Protecting Military Servicemembers Data from Foreign Adversaries Act of 2025”.
Protecting Military Servicemembers Data from Foreign Adversaries Act of 2025
A BILL
To prohibit data brokers from selling, reselling, trading, licensing, or otherwise providing for consideration lists of military servicemembers to any covered nation or person controlled by a covered nation.
Sec. 2 Definitions
In this Act:
Commission— The term Commission means the Federal Trade Commission.
Controlled by a covered nation— The term controlled by a covered nation means, with respect to a person, that such person is—
a foreign person that is domiciled in, is headquartered in, has its principal place of business in, or is organized under the laws of a covered nation;
an entity with respect to which 1 or more foreign persons described in subparagraph (A) directly or indirectly owns not less than a 20 percent stake; or
a person subject to the direction or control of (including an affiliate or subsidiary) a foreign person described in subparagraph (A) or an entity described in subparagraph (B).
Covered nation— The term covered nation has the meaning given such term in section 4872(f) of title 10, United States Code.
Data broker— The term data broker means a person that knowingly collects and sells, resells, licenses, trades, or otherwise provides or makes available for consideration to third parties the personal information of an individual with whom the business does not have a direct relationship.
Military service list— The term military servicemember list means a list that includes personal information (other than public record information) about 1 or more individuals or households which is created for the express or implied purpose of compiling information about individuals who are current or former servicemembers (as that term is defined in section 101 of the Servicemembers Civil Relief Act (50 U.S.C. 3911).
Sec. 3 Prohibiting providing servicemember lists to any covered nation or person controlled by a covered nation
In general— It shall be unlawful for a data broker to sell, resell, license, trade, or otherwise provide or make available for consideration a military servicemember list to any covered nation or any person controlled by a covered nation.
Required contracts— Any data broker selling, reselling, licensing, trading, or otherwise providing or making available for consideration a military servicemember list to any other person shall require by contract that such person may not sell, resell, license, trade, or otherwise provide or make available such list to any covered nation or any person controlled by a covered nation.
Conspiracies and certain transactions— It shall be unlawful for any person to—
cause or conspire to cause another person to violate subsection (a) or (b); or
engage in a transaction that has the purpose of evading such subsections.
Sec. 4 Enforcement
Enforcement by the Commission—
Unfair or deceptive acts or practices— A violation of section 3 shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Powers of the Commission—
In general— Except as provided in subparagraphs (D) and (E), the Commission shall enforce section 3 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.
Privileges and immunities— Any person who violates section 3 shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Authority preserved— Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.
Nonprofit organizations— Notwithstanding section 4 of the Federal Trade Commission Act (15 U.S.C. 44) or any jurisdictional limitation of the Commission, the Commission shall also enforce this Act, in the same manner provided in subparagraphs (A) and (B), with respect to organizations not organized to carry on business for their own profit or that of their members.
Independent litigation authority— In any case in which the Commission has reason to believe that a data broker is violating or has violated section 3, the Commission may bring a civil action in an appropriate district court of the United States—
to enjoin further violation of such section by such data broker;
to compel compliance with such section; and
to obtain damages, restitution, or other compensation on behalf of aggrieved consumers.
Rulemaking— Pursuant to section 553 of title 5, United States Code, the Commission shall promulgate regulations to carry out the provisions of this Act. The Commission shall issue a final rule by not later than 1 year after the date of enactment of this Act.
Enforcement by States—
In general— In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any data broker in a practice that violates section 3, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to—
enjoin further violation of such section by such data broker;
compel compliance with such section; and
obtain damages, restitution, or other compensation on behalf of such residents.
Rights of the Commission—
Notice to the Commission—
In general— Except as provided in clause (iii), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring a civil action under paragraph (1) not later than 10 days before initiating the civil action.
Contents— The notification required by clause (i) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action.
Exception— If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action.
Intervention by the Commission— The Commission may—
intervene in any civil action brought by the attorney general of a State under paragraph (1); and
upon intervening—
be heard on all matters arising in the civil action; and
file petitions for appeal of a decision in the civil action.
Investigatory powers— Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.
Preemptive action by the Commission— If the Commission institutes a civil action or an administrative action with respect to a violation of section 3, the attorney general of a State may not, during the pendency of such action, bring a civil action under paragraph (1) against any defendant named in the complaint of the Commission for the violation with respect to which the Commission instituted such action.
Venue; service of process—
Venue— Any action brought under paragraph (1) may be brought in—
the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or
another court of competent jurisdiction.
Service of process— In an action brought under paragraph (1), process may be served in any district in which the defendant—
is an inhabitant; or
may be found.
Sec. 5 Report
Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States (referred to in this section as the Comptroller General) shall submit to Congress a report containing—
an analysis of—
the enforcement of this Act;
whether additional resources or enforcement authorities may be necessary to protect the national security interests of the United States from threats posed by data brokers selling the sensitive personal information of people in the United States; and
whether the national security interests of the United States would be advanced by expanding the protections of this Act to additional categories of individuals or types of personal information; and
recommendations for such legislation and administrative action as the Comptroller General determines appropriate.