New privacy right—but only if you can find and use de-identified data

What it does

The MY DATA Act prohibits companies from blocking consumers from using de-identified or 'cloaked' data—data that has been stripped of identifying information or replaced with concealing identifiers. The FTC enforces this as an unfair practice. The bill aims to give individuals control over their personal data by preventing companies from punishing them for using privacy-protecting data versions.

Why we flagged it

The bill creates a narrow consumer right to use de-identified or cloaked data without corporate interference, enforced by the FTC. It is framed as privacy protection but does not grant affirmative data rights (access, deletion, portability); it only prevents retaliation for using privacy-protecting data versions.

What the text implies

• The bill does not define how individuals obtain de-identified or cloaked data in the first place—it only protects their use once obtained. This may limit practical utility if companies control data access upstream.
• The 'cloaked data' definition relies on 'unique persistent identifiers' that 'adequately replace and conceal' identity while enabling communication. This is circular and vague—it is unclear what technical standard qualifies, creating enforcement ambiguity.
• The service-provider exception may swallow the rule: companies can argue they are 'service providers' for data brokers, analytics firms, or ad networks, exempting them from the prohibition.
• The bill does not address data minimization, collection limits, or consent—only retaliation for using privacy-protected versions. Companies can still collect, retain, and monetize personal data; they simply cannot punish individuals for opting into de-identified alternatives.
• FTC enforcement depends on the agency's capacity and political will. The bill creates a new unfair-practice category but does not fund additional FTC resources or establish private right of action, limiting real-world deterrence.

Who it affects

The bill creates a new consumer right to use de-identified data without corporate retaliation, which benefits privacy-conscious individuals. However, the definitions of 'cloaked data' and 'de-identified data' are vague and may be difficult to enforce, and the bill does not affirmatively grant individuals the right to access, delete, or control their data—only to use privacy-protected versions if they obtain them. The practical benefit depends entirely on implementation and FTC enforcement capaci

Who stands to gain

• data privacy technology vendors
• privacy-focused software companies
• consumer advocacy organizations
• potentially data brokers (if they can claim service-provider status)

Named in the bill

Federal Trade Commission (FTC), covered entities (data collectors), service providers, de-identified data, cloaked data, unique persistent identifiers

Where it stands

• Nov 12, 2025 — Introduced · Congress.gov: “Introduced in House”
• Nov 12, 2025 — Referred to House Committee on Energy and Commerce · Congress.gov: “Referred to the House Committee on Energy and Commerce”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

1 lobbying clients named this bill on 2 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $140,000 in lobbying spend. A filing names 2 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 0% of bills with at least one filing.

Lori Trahan, the sponsor, reported $869,250 in PAC receipts in the 2026 cycle.

• Cloaked, Inc. — $140,000 on 2 filings

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.