118THCONGRESS
2
DSESSION H. R. 7520
AN ACT
To prohibit data brokers from transferring personally identi-
fiable sensitive data of United States individuals to for-
eign adversaries, and for other purposes.
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2 2
•HR 7520 EH
SECTION 1. SHORT TITLE. 1
This Act may be cited as the ‘‘Protecting Americans’ 2
Data from Foreign Adversaries Act of 2024’’. 3
SEC. 2. PROHIBITION ON TRANSFER OF PERSONALLY IDEN-4
TIFIABLE SENSITIVE DATA OF UNITED 5
STATES INDIVIDUALS TO FOREIGN ADVER-6
SARIES. 7
(a) P
ROHIBITION.—It shall be unlawful for a data 8
broker to sell, license, rent, trade, transfer, release, dis-9
close, provide access to, or otherwise make available per-10
sonally identifiable sensitive data of a United States indi-11
vidual to— 12
(1) any foreign adversary country; or 13
(2) any entity that is controlled by a foreign ad-14
versary. 15
(b) E
NFORCEMENT BY FEDERALTRADECOMMIS-16
SION.— 17
(1) U
NFAIR OR DECEPTIVE ACTS OR PRAC -18
TICES.—A violation of this section shall be treated 19
as a violation of a rule defining an unfair or a de-20
ceptive act or practice under section 18(a)(1)(B) of 21
the Federal Trade Commission Act (15 U.S.C. 22
57a(a)(1)(B)). 23
(2) P
OWERS OF COMMISSION .— 24
(A) I
N GENERAL.—The Commission shall 25
enforce this section in the same manner, by the 26 3
•HR 7520 EH
same means, and with the same jurisdiction, 1
powers, and duties as though all applicable 2
terms and provisions of the Federal Trade 3
Commission Act (15 U.S.C. 41 et seq.) were in-4
corporated into and made a part of this section. 5
(B) P
RIVILEGES AND IMMUNITIES .—Any 6
person who violates this section shall be subject 7
to the penalties and entitled to the privileges 8
and immunities provided in the Federal Trade 9
Commission Act. 10
(3) A
UTHORITY PRESERVED .—Nothing in this 11
section may be construed to limit the authority of 12
the Commission under any other provision of law. 13
(c) D
EFINITIONS.—In this section: 14
(1) C
OMMISSION.—The term ‘‘Commission’’ 15
means the Federal Trade Commission. 16
(2) C
ONTROLLED BY A FOREIGN ADVERSARY .— 17
The term ‘‘controlled by a foreign adversary’’ means, 18
with respect to an individual or entity, that such in-19
dividual or entity is— 20
(A) a foreign person that is domiciled in, 21
is headquartered in, has its principal place of 22
business in, or is organized under the laws of 23
a foreign adversary country; 24 4
•HR 7520 EH
(B) an entity with respect to which a for-1
eign person or combination of foreign persons 2
described in subparagraph (A) directly or indi-3
rectly own at least a 20 percent stake; or 4
(C) a person subject to the direction or 5
control of a foreign person or entity described 6
in subparagraph (A) or (B). 7
(3) D
ATA BROKER.— 8
(A) I
N GENERAL .—The term ‘‘data 9
broker’’ means an entity that, for valuable con-10
sideration, sells, licenses, rents, trades, trans-11
fers, releases, discloses, provides access to, or 12
otherwise makes available data of United States 13
individuals that the entity did not collect di-14
rectly from such individuals to another entity 15
that is not acting as a service provider. 16
(B) E
XCLUSION.—The term ‘‘data broker’’ 17
does not include an entity to the extent such 18
entity— 19
(i) is transmitting data of a United 20
States individual, including communica-21
tions of such an individual, at the request 22
or direction of such individual; 23
(ii) is providing, maintaining, or offer-24
ing a product or service with respect to 25 5
•HR 7520 EH
which personally identifiable sensitive data, 1
or access to such data, is not the product 2
or service; 3
(iii) is reporting or publishing news or 4
information that concerns local, national, 5
or international events or other matters of 6
public interest; 7
(iv) is reporting, publishing, or other-8
wise making available news or information 9
that is available to the general public— 10
(I) including information from— 11
(aa) a book, magazine, tele-12
phone book, or online directory; 13
(bb) a motion picture; 14
(cc) a television, internet, or 15
radio program; 16
(dd) the news media; or 17
(ee) an internet site that is 18
available to the general public on 19
an unrestricted basis; and 20
(II) not including an obscene vis-21
ual depiction (as such term is used in 22
section 1460 of title 18, United States 23
Code); or 24
(v) is acting as a service provider. 25 6
•HR 7520 EH
(4) FOREIGN ADVERSARY COUNTRY .—The term 1
‘‘foreign adversary country’’ means a country speci-2
fied in section 4872(d)(2) of title 10, United States 3
Code. 4
(5) P
ERSONALLY IDENTIFIABLE SENSITIVE 5
DATA.—The term ‘‘personally identifiable sensitive 6
data’’ means any sensitive data that identifies or is 7
linked or reasonably linkable, alone or in combina-8
tion with other data, to an individual or a device 9
that identifies or is linked or reasonably linkable to 10
an individual. 11
(6) P
RECISE GEOLOCATION INFORMATION .— 12
The term ‘‘precise geolocation information’’ means 13
information that— 14
(A) is derived from a device or technology 15
of an individual; and 16
(B) reveals the past or present physical lo-17
cation of an individual or device that identifies 18
or is linked or reasonably linkable to 1 or more 19
individuals, with sufficient precision to identify 20
street level location information of an individual 21
or device or the location of an individual or de-22
vice within a range of 1,850 feet or less. 23
(7) S
ENSITIVE DATA.—The term ‘‘sensitive 24
data’’ includes the following: 25 7
•HR 7520 EH
(A) A government-issued identifier, such as 1
a Social Security number, passport number, or 2
driver’s license number. 3
(B) Any information that describes or re-4
veals the past, present, or future physical 5
health, mental health, disability, diagnosis, or 6
healthcare condition or treatment of an indi-7
vidual. 8
(C) A financial account number, debit card 9
number, credit card number, or information 10
that describes or reveals the income level or 11
bank account balances of an individual. 12
(D) Biometric information. 13
(E) Genetic information. 14
(F) Precise geolocation information. 15
(G) An individual’s private communica-16
tions such as voicemails, emails, texts, direct 17
messages, mail, voice communications, and 18
video communications, or information identi-19
fying the parties to such communications or 20
pertaining to the transmission of such commu-21
nications, including telephone numbers called, 22
telephone numbers from which calls were 23
placed, the time calls were made, call duration, 24 8
•HR 7520 EH
and location information of the parties to the 1
call. 2
(H) Account or device log-in credentials, or 3
security or access codes for an account or de-4
vice. 5
(I) Information identifying the sexual be-6
havior of an individual. 7
(J) Calendar information, address book in-8
formation, phone or text logs, photos, audio re-9
cordings, or videos, maintained for private use 10
by an individual, regardless of whether such in-11
formation is stored on the individual’s device or 12
is accessible from that device and is backed up 13
in a separate location. 14
(K) A photograph, film, video recording, or 15
other similar medium that shows the naked or 16
undergarment-clad private area of an indi-17
vidual. 18
(L) Information revealing the video con-19
tent requested or selected by an individual. 20
(M) Information about an individual under 21
the age of 17. 22
(N) An individual’s race, color, ethnicity, 23
or religion. 24 9
•HR 7520 EH
(O) Information identifying an individual’s 1
online activities over time and across websites 2
or online services. 3
(P) Information that reveals the status of 4
an individual as a member of the Armed 5
Forces. 6
(Q) Any other data that a data broker 7
sells, licenses, rents, trades, transfers, releases, 8
discloses, provides access to, or otherwise makes 9
available to a foreign adversary country, or en-10
tity that is controlled by a foreign adversary, 11
for the purpose of identifying the types of data 12
listed in subparagraphs (A) through (P). 13
(8) S
ERVICE PROVIDER.—The term ‘‘service 14
provider’’ means an entity that— 15
(A) collects, processes, or transfers data on 16
behalf of, and at the direction of— 17
(i) an individual or entity that is not 18
a foreign adversary country or controlled 19
by a foreign adversary; or 20
(ii) a Federal, State, Tribal, terri-21
torial, or local government entity; and 22
(B) receives data from or on behalf of an 23
individual or entity described in subparagraph 24 10
•HR 7520 EH
(A)(i) or a Federal, State, Tribal, territorial, or 1
local government entity. 2
(9) U
NITED STATES INDIVIDUAL .—The term 3
‘‘United States individual’’ means a natural person 4
residing in the United States. 5
(d) E
FFECTIVEDATE.—This section shall take effect 6
on the date that is 60 days after the date of the enactment 7
of this Act. 8
Passed the House of Representatives March 20,
2024.
Attest:
Clerk. 118
TH
CONGRESS
2
D
S
ESSION
H. R. 7520
AN ACT
To prohibit data brokers from transferring person-
ally identifiable sensitive data of United States
individuals to foreign adversaries, and for other
purposes.