Protecting Military Servicemembers Data from Foreign Adversaries Act of 2025

The term Commission means the Federal Trade Commission.

The term controlled by a covered nation means, with respect to a person, that such person is—

(A) a foreign person that is domiciled in, is headquartered in, has its principal place of business in, or is organized under the laws of a covered nation;

(B) an entity with respect to which 1 or more foreign persons described in subparagraph (A) directly or indirectly owns not less than a 20 percent stake; or

(C) a person subject to the direction or control of (including an affiliate or subsidiary) a foreign person described in subparagraph (A) or an entity described in subparagraph (B).

The term covered nation has the meaning given such term in section 4872(f) of title 10, United States Code.

The term data broker means a person that knowingly collects and sells, resells, licenses, trades, or otherwise provides or makes available for consideration to third parties the personal information of an individual with whom the business does not have a direct relationship.

The term military servicemember list means a list that includes personal information (other than public record information) about 1 or more individuals or households which is created for the express or implied purpose of compiling information about individuals who are current or former servicemembers (as that term is defined in section 101 of the Servicemembers Civil Relief Act (50 U.S.C. 3911).

It shall be unlawful for a data broker to sell, resell, license, trade, or otherwise provide or make available for consideration a military servicemember list to any covered nation or any person controlled by a covered nation.

Any data broker selling, reselling, licensing, trading, or otherwise providing or making available for consideration a military servicemember list to any other person shall require by contract that such person may not sell, resell, license, trade, or otherwise provide or make available such list to any covered nation or any person controlled by a covered nation.

It shall be unlawful for any person to—

(1) cause or conspire to cause another person to violate subsection (a) or (b); or

(2) engage in a transaction that has the purpose of evading such subsections.

A violation of section 3 shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

Except as provided in subparagraphs (D) and (E), the Commission shall enforce section 3 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

Any person who violates section 3 shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.

Notwithstanding section 4 of the Federal Trade Commission Act (15 U.S.C. 44) or any jurisdictional limitation of the Commission, the Commission shall also enforce this Act, in the same manner provided in subparagraphs (A) and (B), with respect to organizations not organized to carry on business for their own profit or that of their members.

In any case in which the Commission has reason to believe that a data broker is violating or has violated section 3, the Commission may bring a civil action in an appropriate district court of the United States—

(i) to enjoin further violation of such section by such data broker;

(ii) to compel compliance with such section; and

(iii) to obtain damages, restitution, or other compensation on behalf of aggrieved consumers.

Pursuant to section 553 of title 5, United States Code, the Commission shall promulgate regulations to carry out the provisions of this Act. The Commission shall issue a final rule by not later than 1 year after the date of enactment of this Act.

In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any data broker in a practice that violates section 3, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to—

(A) enjoin further violation of such section by such data broker;

(B) compel compliance with such section; and

(C) obtain damages, restitution, or other compensation on behalf of such residents.

Except as provided in clause (iii), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring a civil action under paragraph (1) not later than 10 days before initiating the civil action.

The notification required by clause (i) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action.

If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action.

The Commission may—

(i) intervene in any civil action brought by the attorney general of a State under paragraph (1); and

(ii) upon intervening—

(I) be heard on all matters arising in the civil action; and

(II) file petitions for appeal of a decision in the civil action.

Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.

If the Commission institutes a civil action or an administrative action with respect to a violation of section 3, the attorney general of a State may not, during the pendency of such action, bring a civil action under paragraph (1) against any defendant named in the complaint of the Commission for the violation with respect to which the Commission instituted such action.

Any action brought under paragraph (1) may be brought in—

(i) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or

(ii) another court of competent jurisdiction.

In an action brought under paragraph (1), process may be served in any district in which the defendant—

(i) is an inhabitant; or

(ii) may be found.

(1) an analysis of—

(A) the enforcement of this Act;

(B) whether additional resources or enforcement authorities may be necessary to protect the national security interests of the United States from threats posed by data brokers selling the sensitive personal information of people in the United States; and

(C) whether the national security interests of the United States would be advanced by expanding the protections of this Act to additional categories of individuals or types of personal information; and

(2) recommendations for such legislation and administrative action as the Comptroller General determines appropriate.