H.R. 4402 — DASHBOARD Act of 2025

This section defines, for purposes of the Act, (1) "Commission" as the Securities and Exchange Commission; (2) "issuer" as that term is defined in section 3(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)); and (3) "commercial data operator," "user," and "user data" as those terms are defined, respectively, in section 13(s)(1) of that Act.

This section requires commercial data operators to (1) provide each user, at least every 90 days, with an assessment of the economic value placed on the user's data and clear, conspicuous disclosures of data types collected (by the operator or third parties) and non-service-related data uses; and (2) enable users to delete all or individual fields of their data (which the operator possesses or controls access to) via a single setting or clear mechanism (except for legal obligations, legal claims, or security/fraud purposes, with no more data retained than necessary). It ensures such disclosures remain available ongoing through normal service interfaces, treats violations as unfair or deceptive acts or practices under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)), and directs the Federal Trade Commission to promulgate implementing regulations within one year of enactment.

This section amends Section 13(a) of the Securities Exchange Act of 1934 to require issuers that are, or are consolidated subsidiaries of, commercial data operators—defined as consumer online services providers or data brokers generating material revenue from user data and having more than 100 million unique monthly U.S. visitors or users for a majority of the prior year—to disclose in annual and quarterly reports the material aggregate value of (1) user data held, (2) third-party contracts for user data collection via their online service, and (3) other Commission-determined items. (User data includes information identifying or linkable to an individual consumer using the operator's online service.) It further directs the SEC, in consultation with standards organizations, to develop valuation methodologies promoting comparability across similar operators while accounting for different uses, sectors, and models. This section also requires the SEC, not later than one year after enactment, to amend 17 CFR 229.306 to mandate quantitative and qualitative disclosures by such issuers on user data value, including (1) data protection measures, (2) financial and legal risks, (3) data sources, (4) revenue-generating operations relying on user data, (5) contracts valued over $10 million for collection/licensing/sharing, (6) user data-related revenue, (7) effects of value measurement changes on performance and cash flows, and (8) user data acquisitions over $100 million. This section further requires the SEC to submit a report to the Senate Banking Committee and House Financial Services Committee not later than three years after enactment assessing commercial data operators' disclosure practices, valuation methods, and presentation, with recommendations to improve comparability and utility; the SEC must propose regulations implementing those recommendations not later than 180 days after the report.