New privacy right—but only if you can find and use de-identified data
H.R. 6043 — MY DATA Act of 2025 · Filed by Lori Trahan (D-MA) · Introduced Nov 12, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
The MY DATA Act prohibits companies from blocking consumers from using de-identified or 'cloaked' data—data that has been stripped of identifying information or replaced with concealing identifiers. The FTC enforces this as an unfair practice. The bill aims to give individuals control over their personal data by preventing companies from punishing them for using privacy-protecting data versions.
Why we flagged it
The bill creates a narrow consumer right to use de-identified or cloaked data without corporate interference, enforced by the FTC. It is framed as privacy protection but does not grant affirmative data rights (access, deletion, portability); it only prevents retaliation for using privacy-protecting data versions.
What the text implies
- The bill does not define how individuals obtain de-identified or cloaked data in the first place—it only protects their use once obtained. This may limit practical utility if companies control data access upstream.
- The 'cloaked data' definition relies on 'unique persistent identifiers' that 'adequately replace and conceal' identity while enabling communication. This is circular and vague—it is unclear what technical standard qualifies, creating enforcement ambiguity.
The full analysis lists 5 implications of this text.
Who stands to gain
data privacy technology vendors; privacy-focused software companies; consumer advocacy organizations