IIB 

118TH CONGRESS 

2D SESSION H. R. 7520 

IN THE SENATE OF THE UNITED STATES 

MARCH 21, 2024 

Received; read twice and referred to the Committee on Commerce, Science, 

and Transportation 

AN ACT 

To prohibit data brokers from transferring personally identifiable sensitive data of United States individuals to foreign adversaries, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

HR 7520 RFS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Protecting Americans’ 

3 Data from Foreign Adversaries Act of 2024’’. 

4 SEC. 2. PROHIBITION ON TRANSFER OF PERSONALLY IDEN5 TIFIABLE SENSITIVE DATA OF UNITED 

6 STATES INDIVIDUALS TO FOREIGN ADVER7 SARIES. 

8 (a) PROHIBITION.—It shall be unlawful for a data 

9 broker to sell, license, rent, trade, transfer, release, dis10 close, provide access to, or otherwise make available per11 sonally identifiable sensitive data of a United States indi12 vidual to— 

13 (1) any foreign adversary country; or 

14 (2) any entity that is controlled by a foreign ad15 versary. 

16 (b) ENFORCEMENT BY FEDERAL TRADE COMMIS17 SION.— 

18 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC19 TICES.—A violation of this section shall be treated 

20 as a violation of a rule defining an unfair or a de21 ceptive act or practice under section 18(a)(1)(B) of 

22 the Federal Trade Commission Act (15 U.S.C. 

23 57a(a)(1)(B)). 

24 (2) POWERS OF COMMISSION.— 

25 (A) IN GENERAL.—The Commission shall 

26 enforce this section in the same manner, by the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

HR 7520 RFS

1 same means, and with the same jurisdiction, 

2 powers, and duties as though all applicable 

3 terms and provisions of the Federal Trade 

4 Commission Act (15 U.S.C. 41 et seq.) were in5 corporated into and made a part of this section. 

6 (B) PRIVILEGES AND IMMUNITIES.—Any 

7 person who violates this section shall be subject 

8 to the penalties and entitled to the privileges 

9 and immunities provided in the Federal Trade 

10 Commission Act. 

11 (3) AUTHORITY PRESERVED.—Nothing in this 

12 section may be construed to limit the authority of 

13 the Commission under any other provision of law. 

14 (c) DEFINITIONS.—In this section: 

15 (1) COMMISSION.—The term ‘‘Commission’’ 

16 means the Federal Trade Commission. 

17 (2) CONTROLLED BY A FOREIGN ADVERSARY.— 

18 The term ‘‘controlled by a foreign adversary’’ means, 

19 with respect to an individual or entity, that such in20 dividual or entity is— 

21 (A) a foreign person that is domiciled in, 

22 is headquartered in, has its principal place of 

23 business in, or is organized under the laws of 

24 a foreign adversary country; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

HR 7520 RFS

1 (B) an entity with respect to which a for2 eign person or combination of foreign persons 

3 described in subparagraph (A) directly or indi4 rectly own at least a 20 percent stake; or 

5 (C) a person subject to the direction or 

6 control of a foreign person or entity described 

7 in subparagraph (A) or (B). 

8 (3) DATA BROKER.— 

9 (A) IN GENERAL.—The term ‘‘data 

10 broker’’ means an entity that, for valuable con11 sideration, sells, licenses, rents, trades, trans12 fers, releases, discloses, provides access to, or 

13 otherwise makes available data of United States 

14 individuals that the entity did not collect di15 rectly from such individuals to another entity 

16 that is not acting as a service provider. 

17 (B) EXCLUSION.—The term ‘‘data broker’’ 

18 does not include an entity to the extent such 

19 entity— 

20 (i) is transmitting data of a United 

21 States individual, including communica22 tions of such an individual, at the request 

23 or direction of such individual; 

24 (ii) is providing, maintaining, or offer25 ing a product or service with respect to 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

HR 7520 RFS

1 which personally identifiable sensitive data, 

2 or access to such data, is not the product 

3 or service; 

4 (iii) is reporting or publishing news or 

5 information that concerns local, national, 

6 or international events or other matters of 

7 public interest; 

8 (iv) is reporting, publishing, or other9 wise making available news or information 

10 that is available to the general public— 

11 (I) including information from— 

12 (aa) a book, magazine, tele13 phone book, or online directory; 

14 (bb) a motion picture; 

15 (cc) a television, internet, or 

16 radio program; 

17 (dd) the news media; or 

18 (ee) an internet site that is 

19 available to the general public on 

20 an unrestricted basis; and 

21 (II) not including an obscene vis22 ual depiction (as such term is used in 

23 section 1460 of title 18, United States 

24 Code); or 

25 (v) is acting as a service provider. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

HR 7520 RFS

1 (4) FOREIGN ADVERSARY COUNTRY.—The term 

2 ‘‘foreign adversary country’’ means a country speci3 fied in section 4872(d)(2) of title 10, United States 

4 Code. 

5 (5) PERSONALLY IDENTIFIABLE SENSITIVE

6 DATA.—The term ‘‘personally identifiable sensitive 

7 data’’ means any sensitive data that identifies or is 

8 linked or reasonably linkable, alone or in combina9 tion with other data, to an individual or a device 

10 that identifies or is linked or reasonably linkable to 

11 an individual. 

12 (6) PRECISE GEOLOCATION INFORMATION.— 

13 The term ‘‘precise geolocation information’’ means 

14 information that— 

15 (A) is derived from a device or technology 

16 of an individual; and 

17 (B) reveals the past or present physical lo18 cation of an individual or device that identifies 

19 or is linked or reasonably linkable to 1 or more 

20 individuals, with sufficient precision to identify 

21 street level location information of an individual 

22 or device or the location of an individual or de23 vice within a range of 1,850 feet or less. 

24 (7) SENSITIVE DATA.—The term ‘‘sensitive 

25 data’’ includes the following: 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

HR 7520 RFS

1 (A) A government-issued identifier, such as 

2 a Social Security number, passport number, or 

3 driver’s license number. 

4 (B) Any information that describes or re5 veals the past, present, or future physical 

6 health, mental health, disability, diagnosis, or 

7 healthcare condition or treatment of an indi8 vidual. 

9 (C) A financial account number, debit card 

10 number, credit card number, or information 

11 that describes or reveals the income level or 

12 bank account balances of an individual. 

13 (D) Biometric information. 

14 (E) Genetic information. 

15 (F) Precise geolocation information. 

16 (G) An individual’s private communica17 tions such as voicemails, emails, texts, direct 

18 messages, mail, voice communications, and 

19 video communications, or information identi20 fying the parties to such communications or 

21 pertaining to the transmission of such commu22 nications, including telephone numbers called, 

23 telephone numbers from which calls were 

24 placed, the time calls were made, call duration, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

HR 7520 RFS

1 and location information of the parties to the 

2 call. 

3 (H) Account or device log-in credentials, or 

4 security or access codes for an account or de5 vice. 

6 (I) Information identifying the sexual be7 havior of an individual. 

8 (J) Calendar information, address book in9 formation, phone or text logs, photos, audio re10 cordings, or videos, maintained for private use 

11 by an individual, regardless of whether such in12 formation is stored on the individual’s device or 

13 is accessible from that device and is backed up 

14 in a separate location. 

15 (K) A photograph, film, video recording, or 

16 other similar medium that shows the naked or 

17 undergarment-clad private area of an indi18 vidual. 

19 (L) Information revealing the video con20 tent requested or selected by an individual. 

21 (M) Information about an individual under 

22 the age of 17. 

23 (N) An individual’s race, color, ethnicity, 

24 or religion. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

HR 7520 RFS

1 (O) Information identifying an individual’s 

2 online activities over time and across websites 

3 or online services. 

4 (P) Information that reveals the status of 

5 an individual as a member of the Armed 

6 Forces. 

7 (Q) Any other data that a data broker 

8 sells, licenses, rents, trades, transfers, releases, 

9 discloses, provides access to, or otherwise makes 

10 available to a foreign adversary country, or en11 tity that is controlled by a foreign adversary, 

12 for the purpose of identifying the types of data 

13 listed in subparagraphs (A) through (P). 

14 (8) SERVICE PROVIDER.—The term ‘‘service 

15 provider’’ means an entity that— 

16 (A) collects, processes, or transfers data on 

17 behalf of, and at the direction of— 

18 (i) an individual or entity that is not 

19 a foreign adversary country or controlled 

20 by a foreign adversary; or 

21 (ii) a Federal, State, Tribal, terri22 torial, or local government entity; and 

23 (B) receives data from or on behalf of an 

24 individual or entity described in subparagraph 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

HR 7520 RFS

1 (A)(i) or a Federal, State, Tribal, territorial, or 

2 local government entity. 

3 (9) UNITED STATES INDIVIDUAL.—The term 

4 ‘‘United States individual’’ means a natural person 

5 residing in the United States. 

6 (d) EFFECTIVE DATE.—This section shall take effect 

7 on the date that is 60 days after the date of the enactment 

8 of this Act. 

Passed the House of Representatives March 20, 

2024. 

Attest: KEVIN F. MCCUMBER, 

Clerk. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB