Don’t Sell Kids’ Data Act of 2025

This bill prohibits data brokers from collecting, using, or maintaining the personal data of children (under 13) and teens (13 to under 18), and requires deletion of such data, with enforcement by the Federal Trade Commission, states, and individuals.

Sec. 2, Prohibition on data brokers with respect to the personal data of certain minors: Data brokers are banned from collecting, using, maintaining, selling, or disclosing personal data of individuals they know are children or teens, except for minimal data needed to comply with the ban. They must delete any such data and set up a mechanism for teens, parents, or agents to request deletion, with a 10-day deadline to identify and delete the data and notify the requester. Violations are treated as unfair or deceptive acts under the FTC Act, enforced by the FTC. State attorneys general may sue on behalf of residents for injunctions, compliance, damages, or other relief, after notifying the FTC, but cannot sue while a federal action is pending. Individuals may sue data brokers for violations related to their own data, with minimum damages of $1,000 per violation, up to triple for willful violations, plus attorney fees, and rights cannot be waived by terms of service. The act takes effect 180 days after enactment. Definitions include: child (under 13), teen (13 to under 18), data broker (entity that sells personal data not collected directly from the individual, excluding service providers and certain others), knows (actual or implied knowledge), personal data (information linked or linkable to an individual or device, including derived data and unique identifiers), and service provider (entity processing data on behalf of the individual, parent, government, or another entity at their direction).