119-hr4402

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 4402 Introduced in House

    (IH) ]

<DOC>

119th CONGRESS
 1st Session
 H. R. 4402

 To require the Securities and Exchange Commission to promulgate 
regulations relating to the disclosure of certain commercial data, and 
 for other purposes.

_______________________________________________________________________

 IN THE HOUSE OF REPRESENTATIVES

 July 15, 2025

 Mr. Foster introduced the following bill; which was referred to the 
 Committee on Energy and Commerce, and in addition to the Committee on 
 Financial Services, for a period to be subsequently determined by the 
 Speaker, in each case for consideration of such provisions as fall 
 within the jurisdiction of the committee concerned

_______________________________________________________________________

 A BILL

 To require the Securities and Exchange Commission to promulgate 
regulations relating to the disclosure of certain commercial data, and 
 for other purposes.

 Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

 This Act may be cited as the ``Designing Accounting Safeguards to 
Help Broaden Oversight And Regulations on Data Act of 2025'' or the 
``DASHBOARD Act of 2025''.

SEC. 2. DEFINITIONS.

 In this Act:

    (1) Commission.--The term ``Commission'' means the 
 Securities and Exchange Commission.

    (2) Issuer.--The term ``issuer'' has the meaning given the 
 term in 

section 3

    (a) of the Securities and Exchange Act of 1934 
 (15 U.S.C. 78c

    (a) ).

    (3) Other 

=== definitions. ===
-The terms ``commercial data 
 operator'', ``user'', and ``user data'' have the meaning given 
 those terms, respectively, under 

section 13

    (s)

    (1) of the 
 Securities Exchange Act of 1934.

SEC. 3. COMMERCIAL DATA OPERATORS.

    (a) Requirements.--

    (1) In general.--A commercial data operator shall--
        (A) on a routine basis, and not less frequently 
 than once every 90 days--
            (i) provide each user of the commercial 
 data operator with an assessment of the 
 economic value that the commercial data 
 operator places on the data of that user; and
            (ii) in a clear and conspicuous manner, in 
 accordance with paragraph

    (3) , identify to each 
 user of the commercial data operator--
            (I) the types of data collected 
 from users of the commercial data 
 operator, whether by the commercial 
 data operator or another person 
 pursuant to an agreement with the 
 commercial data operator; and
            (II) the ways that the data of a 
 user of the commercial data operator 
 are used if the use is not directly or 
 exclusively related to the online 
 service that the commercial data 
 operator provides to the user; and
        (B) except as provided in paragraph

    (2) , provide a 
 user of the commercial data operator with the ability 
 to delete all data, in the aggregate and for an 
 individual field, that the commercial data operator 
 possesses, or maintains control or access to with 
 respect to the user, through--
            (i) a single setting; or
            (ii) another clear and conspicuous 
 mechanism by which the user may make such a 
 deletion.

    (2) Deletion exceptions.--
        (A) In general.--A commercial data operator shall 
 comply with a user directive to delete, in whole or in 
 part, the data of the user except--
            (i) in cases where there is a legal 
 obligation of the commercial data operator to 
 maintain the data;
            (ii) for the establishment, exercise, or 
 defense of legal claims; or
            (iii) if the data is necessary to detect 
 security incidents, protect against malicious, 
 deceptive, fraudulent, or illegal activity, or 
 assist in the prosecution of those responsible 
 for such activity.
        (B) Retention.--A commercial data operator may not 
 retain any more user data than is necessary to carry 
 out an activity described in clauses
            (i) through
            (iii) of subparagraph
        (A) .

    (3) Availability.--A commercial data operator shall ensure 
 that all disclosures required under paragraph

    (1) are available 
 to a user of the commercial data operator--
        (A) on and after the date on which the commercial 
 data operator makes the identification; and
        (B) through any normal mechanism by which a user 
 may interact with the online service provided by the 
 commercial data operator.

    (4) Unfair and deceptive acts or practices.--
        (A) Unfair or deceptive acts or practices.--A 
 violation of this subsection shall be treated as a 
 violation of a rule defining an unfair or deceptive act 
 or practice prescribed under 

section 18

    (a)

    (1)
        (B) of the 
 Federal Trade Commission Act (15 U.S.C. 57a

    (a)

    (1)
        (B) ).
        (B) Powers of federal trade commission.--
            (i) In general.--The Federal Trade 
 Commission shall enforce this subsection in the 
 same manner, by the same means, and with the 
 same jurisdiction, powers, and duties as though 
 all applicable terms and provisions of the 
 Federal Trade Commission Act (15 U.S.C. 41 et 
 seq.) were incorporated into and made a part of 
 this subsection.
            (ii) Privileges and immunities.--Any person 
 who violates this subsection shall be subject 
 to the penalties and entitled to the privileges 
 and immunities provided in the Federal Trade 
 Commission Act (15 U.S.C. 41 et seq.).

    (b) Regulations.--Not later than 1 year after the date of enactment 
of this Act, the Federal Trade Commission shall promulgate regulations 
carrying out subsection

    (a) .

SEC. 4. SEC DISCLOSURES.

    (a) In General.--

Section 13 of the Securities Exchange Act of 1934 
(15 U.S.C. 78m) is amended by adding at the end the following:
 ``

    (s) Disclosure Relating To Aggregate Value of User Data Held by 
Commercial Data Operators.--
 ``

    (1) === Definitions. ===
-In this subsection:
 ``
        (A) Commercial data operator.--The term 
 `commercial data operator' means an entity acting in 
 its capacity as a consumer online services provider or 
 data broker that--
 ``
            (i) generates a material amount of 
 revenue directly from the use, collection, 
 processing, sale, or sharing of the user data; 
 and
 ``
            (ii) has more than 100,000,000 unique 
 monthly visitors or users in the United States 
 for a majority of months during the previous 1-
 year period.
 ``
        (B) User.--The term `user' means an individual 
 consumer who uses an online service designed for 
 consumer use by a commercial data operator.
 ``
            (C) User data.--The term `user data' means any 
 information that identifies, relates to, describes, is 
 capable of being associated with, or could reasonably 
 be linked with an individual user, whether directly 
 submitted to the commercial data operator by the user 
 or derived from the observed activity of the user by 
 the commercial data operator.
 ``

    (2) Disclosure.--Each issuer that is, or is a 
 consolidated subsidiary of, a commercial data operator and is 
 required to file an annual or quarterly report under subsection

    (a) shall disclose in that report the aggregate value, if 
 material, of--
 ``
        (A) user data that the commercial data operator 
 holds;
 ``
        (B) contracts with third parties for the 
 collection of user data through the online service 
 provided by the commercial data operator; and
 ``
            (C) any other item that the Commission 
 determines, by rule, is necessary or useful for the 
 protection of investors and in the public interest.
 ``

    (3) Valuation methodology.--
 ``
        (A) In general.--The Commission, in consultation 
 with appropriate standards setting organizations, shall 
 develop a method or methods for calculating the value 
 of user data required to be disclosed under paragraph

    (2) .
 ``
        (B) Considerations.--In developing the method 
 under subparagraph
        (A) , the Commission shall promote 
 comparability in calculating the value of data across 
 commercial data operators that utilize user data in a 
 similar manner while taking into account the potential 
 need to develop distinct methods for calculating the 
 value of data for different uses, sectors, and business 
 models.''.

    (b) Qualitative Disclosure.--Not later than 1 year after the date 
of enactment of this subsection, the Commission shall amend 

section 229.306 of title 17, Code of Federal Regulations, to require a 
commercial data operator that is an issuer subject to 

section 13 or 
15
            (d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m, 78o
            (d) ) to 
provide quantitative and qualitative disclosures about the value of 
user data held, including--

    (1) technical and legal measures in place to protect user 
 data held by the commercial data operator;

    (2) an assessment of financial and legal risks associated 
 with storing the type and quantity of user data held by the 
 commercial data operator;

    (3) each source of user data held by the commercial data 
 operator, whether by sale, a direct consumer relationship, an 
 indirect consumer relationship, or other means;

    (4) each discrete revenue generating operation of the 
 commercial data operator and any subsidiary or affiliate that 
 relies on user data;

    (5) the entry into any contract valued at more than 
 $10,000,000 with a third party for the collection, licensing, 
 or sharing by the third party pursuant to an agreement with the 
 commercial data operator;

    (6) the amount of revenue derived from obtaining, 
 collecting, processing, selling, using or sharing user data 
 during the reporting period;

    (7) how changes in the measurement of aggregate fair value 
 of user data affect the reported performance and cash flows of 
 the issuer; and

    (8) any acquisition of user data in the preceding reporting 
 period valued at more than $100,000,000.
            (c) Report.--

    (1) In general.--Not later than 3 years after the date of 
 enactment of this Act, the Commission shall submit to the 
 Committee on Banking, Housing, and Urban Affairs of the Senate 
 and the Committee on Financial Services of the House of 
 Representatives a report on--
        (A) the nature, timing, and extent of the 
 disclosure practices of commercial data operators;
        (B) an assessment of the valuation methodologies 
 and practices employed by commercial data operators in 
 developing and submitting disclosures to the public;
            (C) an evaluation of the methods of delivery and 
 presentation of the disclosures required by this Act, 
 and the amendments made by this Act; and
            (D) recommendations for the improvement of the 
 methods described in subparagraph
            (C) , including 
 developing standards to enhance comparability and 
 utility for investors.

    (2) Rulemaking.--Not later than 180 days after the date on 
 which the report required under paragraph

    (1) is submitted, the 
 Commission shall promulgate a proposed regulation implementing 
 the recommendations described in paragraph

    (1)
            (D) .
 <all>