Data Care Act of 2025

Data Security and Breach Notification: Providers must reasonably secure identifying data and promptly tell users if their sensitive data is breached (Section 3(b)(1)).

Protection Against Harmful Data Use: Providers cannot use identifying data in ways that benefit the company while harming the user physically or financially, or in ways that would be highly offensive (Section 3(b)(2)).

Stricter Data Sharing Rules: Providers cannot sell or share identifying data unless the recipient signs a contract agreeing to the same duties of care, loyalty, and confidentiality (Section 3(b)(3)).

Accountability for Third Parties: The duties of care, loyalty, and confidentiality apply to any person or entity that receives identifying data from a provider (Section 3(c)).

Non-Waivable Rights: Users cannot be forced to give up the rights and remedies provided by this Act through a contract (Section 5).