I 

118TH CONGRESS 

2D SESSION H. R. 7520 

To prohibit data brokers from transferring sensitive data of United States 

individuals to foreign adversaries, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 5, 2024 

Mr. PALLONE (for himself and Mrs. RODGERS of Washington) introduced the 

following bill; which was referred to the Committee on Energy and Commerce 

A BILL 

To prohibit data brokers from transferring sensitive data 

of United States individuals to foreign adversaries, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Americans’ 

5 Data from Foreign Adversaries Act of 2024’’. 

6 SEC. 2. PROHIBITION ON TRANSFER OF SENSITIVE DATA 

7 OF UNITED STATES INDIVIDUALS TO FOR8 EIGN ADVERSARIES. 

9 (a) PROHIBITION.—It shall be unlawful for a data 

10 broker to sell, license, rent, trade, transfer, release, disVerDate Sep 11 2014 00:48 Mar 06, 2024 Jkt 049200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H7520.IH H7520

ssavage on LAPJG3WLY3PROD with BILLS
2 

•HR 7520 IH

1 close, provide access to, or otherwise make available sen2 sitive data of a United States individual to— 

3 (1) any foreign adversary country; or 

4 (2) any entity that is controlled by a foreign ad5 versary. 

6 (b) ENFORCEMENT BY FEDERAL TRADE COMMIS7 SION.— 

8 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC9 TICES.—A violation of this section shall be treated 

10 as a violation of a rule defining an unfair or a de11 ceptive act or practice under section 18(a)(1)(B) of 

12 the Federal Trade Commission Act (15 U.S.C. 

13 57a(a)(1)(B)). 

14 (2) POWERS OF COMMISSION.— 

15 (A) IN GENERAL.—The Commission shall 

16 enforce this section in the same manner, by the 

17 same means, and with the same jurisdiction, 

18 powers, and duties as though all applicable 

19 terms and provisions of the Federal Trade 

20 Commission Act (15 U.S.C. 41 et seq.) were in21 corporated into and made a part of this section. 

22 (B) PRIVILEGES AND IMMUNITIES.—Any 

23 person who violates this section shall be subject 

24 to the penalties and entitled to the privileges 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•HR 7520 IH

1 and immunities provided in the Federal Trade 

2 Commission Act. 

3 (3) AUTHORITY PRESERVED.—Nothing in this 

4 section may be construed to limit the authority of 

5 the Commission under any other provision of law. 

6 (c) DEFINITIONS.—In this section: 

7 (1) COMMISSION.—The term ‘‘Commission’’ 

8 means the Federal Trade Commission. 

9 (2) CONTROLLED BY A FOREIGN ADVERSARY.— 

10 The term ‘‘controlled by a foreign adversary’’ means, 

11 with respect to an entity, that such entity is— 

12 (A) a foreign person that is domiciled in, 

13 is headquartered in, has its principal place of 

14 business in, or is organized under the laws of 

15 a foreign adversary country; 

16 (B) an entity with respect to which a for17 eign person or combination of foreign persons 

18 described in subparagraph (A) directly or indi19 rectly own at least a 20 percent stake; or 

20 (C) a person subject to the direction or 

21 control of a foreign person or entity described 

22 in subparagraph (A) or (B). 

23 (3) DATA BROKER.— 

24 (A) IN GENERAL.—The term ‘‘data 

25 broker’’ means an entity that, for valuable conVerDate Sep 11 2014 00:48 Mar 06, 2024 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H7520.IH H7520

ssavage on LAPJG3WLY3PROD with BILLS
4 

•HR 7520 IH

1 sideration, sells, licenses, rents, trades, trans2 fers, releases, discloses, provides access to, or 

3 otherwise makes available data of United States 

4 individuals, that the entity did not collect di5 rectly from such individuals, to another entity 

6 that is not acting as a service provider. 

7 (B) EXCLUSION.—The term ‘‘data broker’’ 

8 does not include an entity to the extent such 

9 entity— 

10 (i) is transmitting data, including 

11 communications of a United States indi12 vidual at the request or direction of such 

13 individual; 

14 (ii) is reporting, publishing, or other15 wise making available news or information 

16 that is available to the general public, in17 cluding information from a telephone book 

18 or online directory, a television, internet, 

19 or radio program, the news media, or an 

20 internet site that is available to the general 

21 public on an unrestricted basis, but not in22 cluding an obscene visual depiction (as 

23 such term is used in section 1460 of title 

24 18, United States Code); or 

25 (iii) is acting as a service provider. 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•HR 7520 IH

1 (4) FOREIGN ADVERSARY COUNTRY.—The term 

2 ‘‘foreign adversary country’’ means a country speci3 fied in section 4872(d)(2) of title 10, United States 

4 Code. 

5 (5) PRECISE GEOLOCATION INFORMATION.— 

6 The term ‘‘precise geolocation information’’ means 

7 information that— 

8 (A) is derived from a device or technology; 

9 and 

10 (B) reveals the past or present physical lo11 cation of an individual or device that identifies 

12 or is linked or reasonably linkable to 1 or more 

13 individuals, with sufficient precision to identify 

14 street level location information of an individual 

15 or device or the location of an individual or de16 vice within a range of 1,850 feet or less. 

17 (6) SENSITIVE DATA.—The term ‘‘sensitive 

18 data’’ includes the following: 

19 (A) A government-issued identifier, such as 

20 a Social Security number, passport number, or 

21 driver’s license number. 

22 (B) Any information that describes or re23 veals the past, present, or future physical 

24 health, mental health, disability, diagnosis, or 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•HR 7520 IH

1 healthcare condition or treatment of an indi2 vidual. 

3 (C) A financial account number, debit card 

4 number, credit card number, or information 

5 that describes or reveals the income level or 

6 bank account balances of an individual. 

7 (D) Biometric information. 

8 (E) Genetic information. 

9 (F) Precise geolocation information. 

10 (G) An individual’s private communica11 tions such as voicemails, emails, texts, direct 

12 messages, mail, voice communications, and 

13 video communications, or information identi14 fying the parties to such communications or 

15 pertaining to the transmission of such commu16 nications, including telephone numbers called, 

17 telephone numbers from which calls were 

18 placed, the time calls were made, call duration, 

19 and location information of the parties to the 

20 call. 

21 (H) Account or device log-in credentials, or 

22 security or access codes for an account or de23 vice. 

24 (I) Information identifying the sexual be25 havior of an individual. 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•HR 7520 IH

1 (J) Calendar information, address book in2 formation, phone or text logs, photos, audio re3 cordings, or videos, maintained for private use 

4 by an individual, regardless of whether such in5 formation is stored on the individual’s device or 

6 is accessible from that device and is backed up 

7 in a separate location. 

8 (K) A photograph, film, video recording, or 

9 other similar medium that shows the naked or 

10 undergarment-clad private area of an indi11 vidual. 

12 (L) Information revealing the video con13 tent requested or selected by an individual. 

14 (M) Information about an individual under 

15 the age of 17. 

16 (N) An individual’s race, color, ethnicity, 

17 or religion. 

18 (O) Information identifying an individual’s 

19 online activities over time and across websites 

20 or online services. 

21 (P) Information that reveals the status of 

22 an individual as a member of the Armed 

23 Forces. 

24 (Q) Any other data that a data broker 

25 sells, licenses, rents, trades, transfers, releases, 


ssavage on LAPJG3WLY3PROD with BILLS
8 

•HR 7520 IH

1 discloses, provides access to, or otherwise makes 

2 available to a foreign adversary country, or en3 tity that is controlled by a foreign adversary, 

4 for the purpose of identifying the types of data 

5 listed in subparagraphs (A) through (P). 

6 (7) SERVICE PROVIDER.—The term ‘‘service 

7 provider’’ means an entity that— 

8 (A) collects, processes, or transfers data on 

9 behalf of, and at the direction of— 

10 (i) an entity that is not a data broker 

11 and is not controlled by a foreign adver12 sary; or 

13 (ii) a Federal, State, Tribal, terri14 torial, or local government entity; and 

15 (B) receives data from or on behalf of an 

16 entity described in subparagraph (A)(i) or a 

17 Federal, State, Tribal, territorial, or local gov18 ernment entity. 

19 (8) UNITED STATES INDIVIDUAL.—The term 

20 ‘‘United States individual’’ means a natural person 

21 residing in the United States. 

22 (d) EFFECTIVE DATE.—This section shall take effect 

23 on the date that is 60 days after the date of the enactment 

24 of this Act. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS