Congress imposes fiduciary duties on data collectors—your data now has legal protection
S. 3570 — Data Care Act of 2025 · Filed by Brian Schatz (D-HI) · 14 cosponsors · Introduced Dec 18, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
The Data Care Act of 2025 requires online service providers (companies that collect user data over the internet) to treat user data with three legal duties: care (secure it and notify users of breaches), loyalty (don't use it in ways that harm users), and confidentiality (don't sell or share it without strict contracts). The FTC and state attorneys general can enforce these duties and impose civil penalties on violators.
Why we flagged it
The bill's core mechanism is a fiduciary-style duty framework (care, loyalty, confidentiality) imposed on data collectors, with FTC and state enforcement. It is fundamentally a consumer protection and privacy statute, not a technical amendment or narrow carve-out.
What the text implies
- The 'duty of loyalty' standard ('unexpected and highly offensive to a reasonable end user') is subjective and may generate significant litigation over what constitutes a breach, creating uncertainty for both companies and users about enforcement boundaries.
- The bill allows the FTC to exempt categories of providers via regulation, potentially creating loopholes for large or complex platforms if the FTC exercises this discretion narrowly.
The full analysis lists 5 implications of this text.
Who stands to gain
privacy-focused software vendors; data security and compliance consultants; law firms specializing in consumer protection