Don’t Sell Kids’ Data Act of 2025

An entity acting as a data broker may not carry out the following:

(A) Collect, use, or maintain any personal data of an individual the data broker knows is a child or teen.

(B) Sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available any personal data of an individual the data broker knows is a child or teen.

An entity acting as a data broker may collect, use, or maintain only such personal data of an individual that the data broker knows is a child or teen that is necessary to ensure compliance with paragraph (1)(A) or subsection (b) and shall not collect, use, or maintain such personal data for any other purpose than for such compliance.

An entity acting as a data broker shall—

(A) delete any personal data of an individual the data broker knows is a child or teen that the data broker maintained; and

(B) establish a mechanism for any of the following individuals to submit a request to the data broker to delete any such personal data:

(i) Teen.

(ii) The parent or legal guardian of a child.

(iii) An agent acting at the request of a teen or the parent or legal guardian of a child.

Not later than 10 days after the date on which a teen, the parent or legal guardian of a child, or an agent acting at the request of a teen or the parent or legal guardian of a child submits a request pursuant to the mechanism established pursuant to paragraph (1)(B), the data broker shall carry out the following responsibilities:

(A) Identify any personal data of the child or teen that the data broker collected, used, or maintained.

(B) Delete any personal data identified under subparagraph (A).

(C) Notify the individual who submitted the request of the deletion under subparagraph (B) upon completion.

A data broker shall make publicly available (such as on a website of the data broker), in a clear and conspicuous manner, information written in plain language and relating to the following:

(A) The mechanism established by the data broker under paragraph (1)(B).

(B) The responsibilities of the data broker under paragraph (2).

A violation of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

Any entity who violates this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

Nothing in this Act may be construed to limit the authority of the Commission under any other provision of law.

In any case in which the attorney general of a State, or an official or agency of a State, has reason to believe that an interest of the residents of such State has been or is threatened or adversely affected by an act or practice in violation of this Act, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to—

(A) enjoin such act or practice;

(B) enforce compliance with such subsection;

(C) obtain damages, restitution, or other compensation on behalf of residents of the State; or

(D) obtain such other legal and equitable relief as the court may consider to be appropriate.

Before filing an action under this subsection, the attorney general, official, or agency of the State involved shall provide to the Commission a written notice of such action and a copy of the complaint for such action. If the attorney general, official, or agency determines that it is not feasible to provide the notice described in this paragraph before the filing of the action, the attorney general, official, or agency shall provide written notice of the action and a copy of the complaint to the Commission immediately upon the filing of the action.

On receiving notice under paragraph (2) of an action under this subsection, the Commission shall have the right—

(i) to intervene in the action; and

(ii) upon so intervening—

(I) to be heard on all matters arising therein; and

(II) to file petitions for appeal.

If the Commission or the Attorney General of the United States has instituted a civil action for violation of this Act (referred to in this subparagraph as the Federal action), no State attorney general, official, or agency may bring an action under this subsection during the pendency of the Federal action against any defendant named in the complaint in the Federal action for any violation of such subsection alleged in such complaint.

For purposes of bringing a civil action under this subsection, nothing in this Act shall be construed to prevent an attorney general, official, or agency of a State from exercising the powers conferred on the attorney general, official, or agency by the laws of such State to conduct investigations, administer oaths and affirmations, or compel the attendance of witnesses or the production of documentary and other evidence.

Nothing in this subsection may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State.

An individual may bring a civil action against a data broker for a violation of this Act related to the personal data of that individual in an appropriate Federal district court of the United States.

A violation of this Act related to the personal data of an individual constitutes a concrete and particularized injury in fact for that individual.

In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award the plaintiff—

(i) an amount equal to the sum of any actual damages, but not less than $1,000 for each violation of this Act;

(ii) injunctive relief;

(iii) declaratory relief; and

(iv) reasonable attorney fees and litigation costs.

If the court finds that the defendant willfully or knowingly violated this Act, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under subparagraph (A) of this paragraph.

The court shall award to a prevailing plaintiff in an action under this subsection the costs of such action and reasonable attorney’s fees, as determined by the court.

The rights and remedies provided by this subsection may not be waived by any terms of service, including by a predispute arbitration agreement.

The remedy provided by this subsection shall be in addition to any other remedy available to the person.

This Act shall take effect on the date that is 180 days after the date of the enactment of this Act.

In this section:

The term child means an individual under the age of 13 years.

The term Commission means the Federal Trade Commission.

The term data broker means an entity that, for valuable consideration, sells, licenses, rents, trades, transfers, releases, discloses, provides access to, or otherwise makes available to another entity personal data of an individual that the entity did not collect directly from such individual.

The term data broker does not include an entity to the extent the entity—

(i) acts as a service provider;

(ii) provides, maintains, or offers a product or service with respect to which personal data, or access to such data, is not the product or service;

(iii) transmits personal data of an individual, including any communication of such individual, at the request or direction of such individual; or

(iv) reports or publishes news or information that concerns local, national, or international events or other matters of public interest.

The term knows means to have actual knowledge or knowledge fairly implied on the basis of objective circumstances.

The term personal data —

(A) means information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies is linked or reasonably linkable to an individual; and

(B) includes derived data and unique persistent identifiers.

The term service provider means an entity that collects, processes, or transfers personal data on behalf of, and at the direction of—

(A) the individual to whom such information pertains;

(B) the parent or legal guardian of the individual to whom such information pertains;

(C) a Federal, State, or local government entity; or

(D) another entity acting at the direction of an individual or entity described in subparagraph (A), (B), or (C).

The term State means each State of the United States, the District of Columbia, each territory or possession of the United States, and each federally recognized Indian Tribe.

The term teen means an individual who has attained age 13 years and is under the age of 18 years.