# My Body, My Data Act of 2022: What You Need to Know

This bill creates strict new rules about how companies can collect, use, and share your personal information related to reproductive and sexual health. It applies to almost any business that handles this sensitive data—from period-tracking apps and fertility websites to health retailers and data brokers—with the main goal of preventing your intimate health information from being bought, sold, or shared without your explicit permission.

The core rule is simple: companies can only collect and use your reproductive or sexual health data in two situations. First, they can do it if you give them clear, written permission specifically for that purpose. Second, they can do it only to the extent necessary to provide a service you've actually requested from them. This means a period-tracking app couldn't sell your data to advertisers, and a fertility clinic couldn't share your information with insurance companies or law enforcement without your direct consent. The bill also prevents companies from sharing this data with their own employees unless those employees specifically need it to help you with something you asked for.

You get powerful new rights under this law. You can request to see all the reproductive and sexual health information a company has about you, including where they got it and who they've shared it with. You can also demand that companies delete this information, and they must respond within 15 days at no cost to you. Companies must also publish clear privacy policies explaining exactly what reproductive and sexual health data they collect, why they collect it, and who they share it with. If a company violates these rules, you can sue them in court for between $100 and $1,000 per violation per day, plus actual damages, attorney's fees, and punitive damages. The Federal Trade Commission can also enforce the law and impose penalties on violators.

One important limitation: the law doesn't apply to traditional healthcare providers covered by existing medical privacy laws (HIPAA), so your doctor's office operates under different rules. Additionally, news organizations can still publish newsworthy information about reproductive health as long as they have safeguards preventing commercial misuse. The law also makes it illegal for companies to force you into arbitration or prevent you from joining class-action lawsuits over violations—you have the right to take them to court.

My Body, My Data Act of 2022

My Body, My Data Act of 2022 This bill establishes protections, subject to certain limits, for personal reproductive or sexual health information. This includes information relating to past, present, or future surgeries or procedures, such as the termination of a pregnancy. Specifically, commercial entities, including individuals, nonprofits, and common carriers, may not collect, retain, use, or disclose personal reproductive or sexual health information except (1) with the express written consent of the individual to whom such information relates, or (2) as is strictly necessary to provide a requested product or service. Commercial entities also must provide individuals with access to, and a reasonable mechanism to delete, any of their reproductive or sexual health information upon request. Further, commercial entities must maintain and publish a privacy policy describing their practices with respect to such information. The bill's provisions do not apply to entities that are subject to certain existing health-related privacy regulations, such as the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996. Additionally, the provisions do not apply to the disclosure of personal reproductive or sexual health information for the publication of newsworthy information of legitimate public concern. The bill provides for enforcement by the Federal Trade Commission and by private civil actions.