Congress imposes fiduciary duties on data collectors—your data now has legal protection

What it does

The Data Care Act of 2025 requires online service providers (companies that collect user data over the internet) to treat user data with three legal duties: care (secure it and notify users of breaches), loyalty (don't use it in ways that harm users), and confidentiality (don't sell or share it without strict contracts). The FTC and state attorneys general can enforce these duties and impose civil penalties on violators.

Why we flagged it

The bill's core mechanism is a fiduciary-style duty framework (care, loyalty, confidentiality) imposed on data collectors, with FTC and state enforcement. It is fundamentally a consumer protection and privacy statute, not a technical amendment or narrow carve-out.

What the text implies

• The 'duty of loyalty' standard ('unexpected and highly offensive to a reasonable end user') is subjective and may generate significant litigation over what constitutes a breach, creating uncertainty for both companies and users about enforcement boundaries.
• The bill allows the FTC to exempt categories of providers via regulation, potentially creating loopholes for large or complex platforms if the FTC exercises this discretion narrowly.
• State attorneys general gain broad parens patriae authority to sue on behalf of residents, which may lead to duplicative or conflicting enforcement actions across states absent clear FTC coordination.
• The 180-day implementation window is tight for large data-driven companies to restructure data practices, potentially creating compliance costs that may be passed to consumers or lead to service degradation.
• The bill does not explicitly address algorithmic discrimination or bias in data use, focusing instead on data security and sales—leaving algorithmic harms potentially unaddressed.

Who it affects

Ordinary users gain enforceable legal protections against data misuse, unauthorized sales, and breaches—rights they currently lack under most state laws. The bill creates a private right of action and state enforcement mechanisms, giving citizens and their representatives tools to hold companies accountable. The duties are broad enough to cover most data-driven business models that harm users.

Who stands to gain

• privacy-focused software vendors
• data security and compliance consultants
• law firms specializing in consumer protection
• state attorneys general offices (enforcement resources)

Named in the bill

Federal Trade Commission (FTC), State Attorneys General, Online service providers, End users, Children's Online Privacy Protection Act (COPPA), Federal Trade Commission Act, Communications Act of 1934

Where it stands

14 cosponsors: 12 Democrats, 2 Independents.

• Dec 18, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• Dec 18, 2025 — Referred to Senate Committee on Commerce, Science, and Transportation · Congress.gov: “Read twice and referred to the Committee on Commerce, Science, and Transportation”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

2 lobbying clients named this bill on 3 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $1,205,758 in lobbying spend. A filing names 127 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 41% of bills with at least one filing.

Brian Schatz, the sponsor, reported $431,697 in PAC receipts in the 2026 cycle.

• National Association of Mutual Insurance Companies — $1,005,758 on 2 filings
• Transamerica Companies — $200,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.