# My Body, My Data Act of 2023: What You Need to Know

This bill creates new privacy protections specifically for information about your reproductive and sexual health. It applies to companies and organizations that collect data about things like pregnancy, contraception, abortion, fertility treatments, menstruation, sexually transmitted infections, and even your searches for information about these topics. The law is designed to prevent companies from collecting, keeping, sharing, or selling this sensitive information unless it's absolutely necessary to provide a service you've actually requested.

The core rule is simple: companies can only gather and use your reproductive or sexual health data if they genuinely need it to deliver something you asked for. For example, a telehealth company providing birth control could collect that information, but they couldn't keep it longer than necessary or share it with advertisers. This applies not just to obvious health companies but also to apps, websites, and services that might collect this data indirectly—like period-tracking apps, fertility apps, or even search engines that know you're looking up abortion clinics. The law also restricts how many employees within a company can access your sensitive information, limiting it only to those who actually need it to help you.

You get powerful rights under this bill. You can request to see all the reproductive and sexual health information a company has about you, find out exactly where they got it and who they've shared it with, correct any wrong information, and ask them to delete it entirely. Companies must respond to these requests within 15 days and can't charge you a fee. They also have to publish clear privacy policies explaining what data they collect, why they collect it, and who they share it with. Importantly, companies can't punish you for exercising these rights—they can't deny you services, charge you more, or give you worse service just because you asked to see or delete your data.

If a company violates this law, you can sue them in court. If you win, you could receive between $100 and $1,000 per violation per day (or actual damages if that's higher), plus punitive damages, attorney's fees, and other relief. The Federal Trade Commission can also enforce the law and issue regulations. Notably, the bill prevents companies from forcing you into arbitration or blocking class-action lawsuits—you have the right to take them to court. The law doesn't apply to traditional healthcare providers covered by existing medical privacy laws (HIPAA), but it covers almost everyone else handling this data, from tech companies to nonprofits to phone carriers.