S. 1512 — Protecting Military Servicemembers Data from Foreign Adversaries Act of 2025

This section establishes definitions for terms used in the Act, including (1) Commission, meaning the Federal Trade Commission; (2) controlled by a covered nation, meaning a foreign person domiciled, headquartered, principally doing business, or organized in a covered nation, an entity in which such a foreign person owns at least a 20% stake, or a person subject to the direction or control of either; (3) covered nation, having the meaning given in 10 U.S.C. 4872(f); (4) data broker, meaning a person who knowingly collects and sells, resells, licenses, trades, or otherwise provides personal information of individuals with whom the person has no direct relationship; and (5) military servicemember list, meaning a list of non-public personal information about current or former servicemembers (as defined in 50 U.S.C. 3911) created for the purpose of compiling such information.

This section prohibits data brokers from selling, licensing, trading, or otherwise providing military servicemember lists for consideration to covered nations or persons controlled by such nations. It further requires data brokers to contractually prohibit recipients from providing such lists to covered nations or controlled persons and makes unlawful conspiracies to violate these provisions or transactions designed to evade them.

This section establishes Federal Trade Commission (FTC) enforcement of section 3 violations (i.e., data broker practices)—treating them as unfair or deceptive acts or practices under section 18(a)(1)(B) of the FTC Act (15 U.S.C. 57a(a)(1)(B))—with the full powers, jurisdiction, penalties, privileges, and immunities of the FTC Act (15 U.S.C. 41 et seq.), notwithstanding the jurisdictional limitation in section 4 of the FTC Act excluding nonprofits (15 U.S.C. 44). (Thus, the FTC may enforce against nonprofit organizations not organized for their own profit or that of their members.) The section further authorizes the FTC to bring independent civil actions in federal district court for injunctions, compliance, and consumer damages or restitution; requires the FTC to promulgate implementing regulations under the Administrative Procedure Act within one year of enactment; and preserves all other FTC authorities. This section authorizes state attorneys general to bring parens patriae civil actions in federal district court on behalf of state residents for section 3 violations, seeking injunctions, compliance, and damages or restitution, subject to (1) 10-day notice to the FTC (or immediate notice if infeasible) with a copy of the complaint; (2) FTC rights to intervene, be heard, and appeal; (3) preservation of state investigatory powers; (4) preemption if the FTC has already instituted an action against the same defendant for the same violation; and (5) flexible venue and nationwide service of process rules.

This section directs the Comptroller General of the United States to submit to Congress, not later than one year after the date of enactment of this Act, a report containing (1) an analysis of (A) enforcement of this Act, (B) whether additional resources or enforcement authorities are necessary to protect U.S. national security from threats posed by data brokers selling sensitive personal information of U.S. persons, and (C) whether expanding the Act's protections to additional categories of individuals or types of personal information would advance U.S. national security; and (2) recommendations for legislation and administrative action as appropriate.