Congress moves to lock down your reproductive health data

What it does

This bill restricts companies from collecting, keeping, using, or sharing personal reproductive and sexual health information unless strictly necessary to provide a service the person requested. It gives individuals the right to see what data companies hold about them, correct inaccurate information, and demand deletion—all within 15 days and for free. Companies must publish clear privacy policies, cannot retaliate against people who exercise these rights, and the FTC and individuals can sue for violations, with damages of $100–$1,000 per day per violation or actual damages, whichever is greater.

Why we flagged it

The bill's core mechanism is a data minimization and individual-control regime for a specific sensitive category (reproductive/sexual health data), enforced through FTC action and private litigation. It is fundamentally a consumer protection statute, not a tax, subsidy, or commemorative measure.

What the text implies

• The bill's definition of 'personal reproductive or sexual health information' includes inferred and algorithmic data derived from non-health information (e.g., location patterns, search history, purchase behavior), meaning companies cannot use proxy signals to circumvent the rule—a significant constraint on data brokers and ad-tech firms.
• The invalidation of pre-dispute arbitration agreements and class-action waivers for reproductive health data disputes may enable large-scale litigation against tech platforms, data brokers, and healthcare-adjacent companies, potentially creating precedent for other sensitive data categories.

The full analysis lists 5 implications of this text.

Who stands to gain

privacy-focused technology companies; data deletion/privacy management services; plaintiff-side litigation firms specializing in consumer privacy