DASHBOARD Act of 2025

This bill requires the Securities and Exchange Commission (SEC) to issue regulations on disclosing certain commercial data, and imposes new obligations on commercial data operators regarding user data. It amends the Securities Exchange Act of 1934 to mandate that issuers who are commercial data operators disclose the aggregate value of user data they hold, and requires the Federal Trade Commission (FTC) to enforce rules for commercial data operators.

Sec. 2, Definitions: Defines key terms. "Commission" means the SEC. "Issuer" has the same meaning as in the Securities Exchange Act of 1934. "Commercial data operator," "user," and "user data" are defined under section 13(s)(1) of that Act.

Sec. 3, Commercial data operators: Requires commercial data operators to provide each user, at least every 90 days, an assessment of the economic value placed on that user's data, and to clearly identify the types of data collected and how data is used if not directly related to the service. Operators must also give users a single setting or clear mechanism to delete all their data, with exceptions for legal obligations, legal claims, or security incidents. Violations are treated as unfair or deceptive acts under the FTC Act, and the FTC enforces this section. The FTC must issue regulations within one year of enactment.

Sec. 4, SEC disclosures: Amends the Securities Exchange Act of 1934 to add a new subsection (s). It defines "commercial data operator" as an entity that generates material revenue from user data and has over 100 million monthly U.S. visitors or users. Issuers that are commercial data operators must disclose in annual or quarterly reports the aggregate value of user data held, contracts with third parties for data collection, and any other items the SEC deems necessary. The SEC, with standards-setting organizations, must develop valuation methods for user data, promoting comparability across similar operators. Within one year, the SEC must also amend regulations to require qualitative disclosures, including data protection measures, financial and legal risks, sources of user data, revenue-generating operations relying on user data, contracts over $10 million for data collection, revenue from user data, how changes in fair value affect performance, and acquisitions of user data over $100 million. Within three years, the SEC must report to Congress on disclosure practices, valuation methodologies, and delivery methods, and then propose regulations to implement recommendations.