SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Protecting Americans’ 
Data from Foreign Adversaries Act of 2024’’. 
SEC. 2. PROHIBITION ON TRANSFER OF PERSONALLY IDEN-
TIFIABLE 
SENSITIVE 
DATA 
OF 
UNITED 
STATES INDIVIDUALS TO FOREIGN ADVER-
SARIES. 
(a) PROHIBITION.—It shall be unlawful for a data 
broker to sell, license, rent, trade, transfer, release, dis-
close, provide access to, or otherwise make available per-
sonally identifiable sensitive data of a United States indi-
vidual to— 
(1) any foreign adversary country; or 
(2) any entity that is controlled by a foreign ad-
versary. 
(b) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this section shall be treated 
as a violation of a rule defining an unfair or a de-
ceptive act or practice under section 18(a)(1)(B) of 
the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)). 
(2) POWERS OF COMMISSION.— 
(A) IN GENERAL.—The Commission shall 
enforce this section in the same manner, by the
same means, and with the same jurisdiction, 
powers, and duties as though all applicable 
terms and provisions of the Federal Trade 
Commission Act (15 U.S.C. 41 et seq.) were in-
corporated into and made a part of this section. 
(B) PRIVILEGES
AND
IMMUNITIES.—Any 
person who violates this section shall be subject 
to the penalties and entitled to the privileges 
and immunities provided in the Federal Trade 
Commission Act. 
(3) AUTHORITY PRESERVED.—Nothing in this 
section may be construed to limit the authority of 
the Commission under any other provision of law. 
(c) DEFINITIONS.—In this section: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) CONTROLLED BY A FOREIGN ADVERSARY.— 
The term ‘‘controlled by a foreign adversary’’ means, 
with respect to an individual or entity, that such in-
dividual or entity is— 
(A) a foreign person that is domiciled in, 
is headquartered in, has its principal place of 
business in, or is organized under the laws of 
a foreign adversary country;
(B) an entity with respect to which a for-
eign person or combination of foreign persons 
described in subparagraph (A) directly or indi-
rectly own at least a 20 percent stake; or 
(C) a person subject to the direction or 
control of a foreign person or entity described 
in subparagraph (A) or (B). 
(3) DATA BROKER.— 
(A) 
IN
GENERAL.—The 
term 
‘‘data 
broker’’ means an entity that, for valuable con-
sideration, sells, licenses, rents, trades, trans-
fers, releases, discloses, provides access to, or 
otherwise makes available data of United States 
individuals that the entity did not collect di-
rectly from such individuals to another entity 
that is not acting as a service provider. 
(B) EXCLUSION.—The term ‘‘data broker’’ 
does not include an entity to the extent such 
entity— 
(i) is transmitting data of a United 
States individual, including communica-
tions of such an individual, at the request 
or direction of such individual; 
(ii) is providing, maintaining, or offer-
ing a product or service with respect to
which personally identifiable sensitive data, 
or access to such data, is not the product 
or service; 
(iii) is reporting or publishing news or 
information that concerns local, national, 
or international events or other matters of 
public interest; 
(iv) is reporting, publishing, or other-
wise making available news or information 
that is available to the general public— 
(I) including information from— 
(aa) a book, magazine, tele-
phone book, or online directory; 
(bb) a motion picture; 
(cc) a television, internet, or 
radio program; 
(dd) the news media; or 
(ee) an internet site that is 
available to the general public on 
an unrestricted basis; and 
(II) not including an obscene vis-
ual depiction (as such term is used in 
section 1460 of title 18, United States 
Code); or 
(v) is acting as a service provider.
(4) FOREIGN ADVERSARY COUNTRY.—The term 
‘‘foreign adversary country’’ means a country speci-
fied in section 4872(d)(2) of title 10, United States 
Code. 
(5) PERSONALLY
IDENTIFIABLE
SENSITIVE 
DATA.—The term ‘‘personally identifiable sensitive 
data’’ means any sensitive data that identifies or is 
linked or reasonably linkable, alone or in combina-
tion with other data, to an individual or a device 
that identifies or is linked or reasonably linkable to 
an individual. 
(6) PRECISE
GEOLOCATION
INFORMATION.— 
The term ‘‘precise geolocation information’’ means 
information that— 
(A) is derived from a device or technology 
of an individual; and 
(B) reveals the past or present physical lo-
cation of an individual or device that identifies 
or is linked or reasonably linkable to 1 or more 
individuals, with sufficient precision to identify 
street level location information of an individual 
or device or the location of an individual or de-
vice within a range of 1,850 feet or less. 
(7) SENSITIVE
DATA.—The term ‘‘sensitive 
data’’ includes the following:
(A) A government-issued identifier, such as 
a Social Security number, passport number, or 
driver’s license number. 
(B) Any information that describes or re-
veals the past, present, or future physical 
health, mental health, disability, diagnosis, or 
healthcare condition or treatment of an indi-
vidual. 
(C) A financial account number, debit card 
number, credit card number, or information 
that describes or reveals the income level or 
bank account balances of an individual. 
(D) Biometric information. 
(E) Genetic information. 
(F) Precise geolocation information. 
(G) An individual’s private communica-
tions such as voicemails, emails, texts, direct 
messages, mail, voice communications, and 
video communications, or information identi-
fying the parties to such communications or 
pertaining to the transmission of such commu-
nications, including telephone numbers called, 
telephone numbers from which calls were 
placed, the time calls were made, call duration,
and location information of the parties to the 
call. 
(H) Account or device log-in credentials, or 
security or access codes for an account or de-
vice. 
(I) Information identifying the sexual be-
havior of an individual. 
(J) Calendar information, address book in-
formation, phone or text logs, photos, audio re-
cordings, or videos, maintained for private use 
by an individual, regardless of whether such in-
formation is stored on the individual’s device or 
is accessible from that device and is backed up 
in a separate location. 
(K) A photograph, film, video recording, or 
other similar medium that shows the naked or 
undergarment-clad private area of an indi-
vidual. 
(L) Information revealing the video con-
tent requested or selected by an individual. 
(M) Information about an individual under 
the age of 17. 
(N) An individual’s race, color, ethnicity, 
or religion.
(O) Information identifying an individual’s 
online activities over time and across websites 
or online services. 
(P) Information that reveals the status of 
an individual as a member of the Armed 
Forces. 
(Q) Any other data that a data broker 
sells, licenses, rents, trades, transfers, releases, 
discloses, provides access to, or otherwise makes 
available to a foreign adversary country, or en-
tity that is controlled by a foreign adversary, 
for the purpose of identifying the types of data 
listed in subparagraphs (A) through (P). 
(8) SERVICE
PROVIDER.—The term ‘‘service 
provider’’ means an entity that— 
(A) collects, processes, or transfers data on 
behalf of, and at the direction of— 
(i) an individual or entity that is not 
a foreign adversary country or controlled 
by a foreign adversary; or 
(ii) a Federal, State, Tribal, terri-
torial, or local government entity; and 
(B) receives data from or on behalf of an 
individual or entity described in subparagraph
(A)(i) or a Federal, State, Tribal, territorial, or 
local government entity. 
(9) UNITED
STATES
INDIVIDUAL.—The term 
‘‘United States individual’’ means a natural person 
residing in the United States. 
(d) EFFECTIVE DATE.—This section shall take effect 
on the date that is 60 days after the date of the enactment 
of this Act. 
Passed the House of Representatives March 20, 
2024. 
Attest: 
Clerk.
118TH CONGRESS 
2D SESSION 
H. R. 7520 
AN ACT 
To prohibit data brokers from transferring person-
ally identifiable sensitive data of United States 
individuals to foreign adversaries, and for other 
purposes.