HB6292, titled the “Don’t Sell Kids’ Data Act of 2025,” would prohibit data brokers from collecting, using, maintaining, or otherwise sharing the personal data of individuals the broker knows are children or teens. The bill defines children as under 13 and teens as ages 13 through 17, and it covers a broad range of data-handling activities, including selling, licensing, renting, trading, transferring, disclosing, or making the data available to others. It also creates a narrow exception allowing a broker to retain only the data necessary to comply with the law’s deletion and prohibition requirements.
The bill requires data brokers to delete covered minors’ personal data and to establish a public mechanism for teens, parents or legal guardians, or authorized agents to request deletion. Once a request is submitted, the broker must identify the relevant data, delete it within 10 days, and notify the requester when deletion is complete. The bill also requires clear public notice describing the deletion request process and the broker’s obligations.
HB6292 would be enforced by the Federal Trade Commission as an unfair or deceptive act or practice under the FTC Act, and it also authorizes state attorneys general to bring civil actions on behalf of residents. In addition, the bill creates a private right of action for individuals, allowing them to sue data brokers in federal court for violations involving their personal data. Available remedies include actual damages, a minimum of $1,000 per violation, injunctive and declaratory relief, attorney’s fees, and enhanced damages for willful or knowing violations; these rights cannot be waived by terms of service or predispute arbitration agreements.
The bill’s impact on state law is mainly procedural and enforcement-related: it preserves state investigative powers and allows state enforcement actions, while limiting duplicative state suits when a federal action is already pending. It also expressly preserves other state civil and criminal proceedings. The measure would take effect 180 days after enactment and would apply nationwide to covered data brokers, with exceptions for service providers, certain product or service providers, communications transmitted at the direction of the individual, and news or public-interest publishers.
The available legislative context suggests generally favorable momentum, as the bill was forwarded from subcommittee to full committee by voice vote and no recorded opposition or vote breakdown is provided. Because there are no committee transcripts or roll-call votes, there is little direct evidence of controversy in the record provided. Potential areas of contention inherent in the bill include the breadth of the data broker definition, the scope of the private right of action and statutory damages, and the compliance burden imposed on data brokers and related businesses.
The bill would create a new federal prohibition on data brokers’ collection, retention, and disclosure of personal data belonging to children and teens, and would require deletion procedures and public notice mechanisms. It would be enforced through the FTC, state attorneys general, and private lawsuits, with statutory damages and attorney’s fees available. The measure would not replace state privacy or consumer-protection laws, but it would add a federal floor and preserve state enforcement and other legal remedies, while limiting parallel state actions during a pending federal case.
The legislative record provided indicates a generally positive or at least noncontroversial committee posture. The bill advanced by voice vote from subcommittee to full committee, and no recorded opposition, amendments debated in transcript, or roll-call vote totals are included. Based on the text, the bill is framed as a child-privacy and consumer-protection measure, which typically attracts support, though the absence of detailed discussion means the level of enthusiasm or concern cannot be measured precisely.
No explicit points of contention appear in the provided transcripts or vote history. That said, the bill’s structure suggests likely debate points: whether the definition of “data broker” is broad enough to capture legitimate intermediaries, whether the private right of action and minimum damages could trigger litigation risk, and whether the 10-day deletion deadline and notice requirements are operationally burdensome. Another possible issue is the balance between federal enforcement and state authority, although the bill expressly preserves substantial state enforcement powers.