Protecting Americans' Data from Foreign Adversaries Act of 2024 (PADFAA)

Makes it unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to any foreign adversary country or to any entity that is controlled by a foreign adversary.

A violation is treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act, and the Federal Trade Commission enforces the section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as that Act. The section takes effect on the date that is 60 days after April 24, 2024.

A data broker is an entity that, for valuable consideration, sells, licenses, rents, trades, transfers, releases, discloses, provides access to, or otherwise makes available data of United States individuals that the entity did not collect directly from such individuals to another entity that is not acting as a service provider.

The term does not include an entity to the extent it transmits data of a United States individual at the request or direction of that individual, provides a product or service with respect to which personally identifiable sensitive data, or access to such data, is not the product or service, reports or publishes news or information that concerns events or other matters of public interest, makes available news or information that is available to the general public other than an obscene visual depiction, or acts as a service provider.

A service provider collects, processes, or transfers data on behalf of, and at the direction of, an individual or entity that is not a foreign adversary country or controlled by a foreign adversary, or a Federal, State, Tribal, territorial, or local government entity, and receives data from or on behalf of such a person.

An individual or entity is controlled by a foreign adversary if it is a foreign person that is domiciled in, is headquartered in, has its principal place of business in, or is organized under the laws of a foreign adversary country, if such foreign persons directly or indirectly own at least a 20 percent stake in it, or if it is subject to the direction or control of such a foreign person or entity.

The Act defines a foreign adversary country as a country specified in section 4872(d)(2) of title 10, United States Code. Section 4872 of title 10 names the Democratic People's Republic of North Korea, the People's Republic of China, the Russian Federation and the Islamic Republic of Iran as covered nations.

Personally identifiable sensitive data is sensitive data that identifies or is linked or reasonably linkable, alone or in combination with other data, to an individual or to a device that identifies or is linked or reasonably linkable to an individual.

Sensitive data includes a government-issued identifier such as a Social Security number, passport number, or driver's license number, information that describes or reveals the past, present, or future physical health, mental health, disability, diagnosis, or healthcare condition or treatment of an individual, a financial account number, debit card number, or credit card number or information that describes or reveals the income level or bank account balances of an individual, biometric information, genetic information, precise geolocation information, an individual's private communications such as voicemails, emails, texts, direct messages, mail, voice communications, and video communications, or information identifying the parties to such communications or pertaining to their transmission, account or device log-in credentials or security or access codes, information identifying the sexual behavior of an individual, calendar information, address book information, phone or text logs, photos, audio recordings, or videos maintained for private use by an individual regardless of whether stored on the individual's device or accessible from it, a photograph, film, video recording, or similar medium that shows the naked or undergarment-clad private area of an individual, information revealing the video content requested or selected by an individual, information about an individual under the age of 17, an individual's race, color, ethnicity, or religion, information identifying an individual's online activities over time and across websites or online services, information that reveals the status of an individual as a member of the Armed Forces, and any other data that a data broker makes available to a foreign adversary country or an entity controlled by a foreign adversary for the purpose of identifying those types of data.

Precise geolocation information is information derived from a device or technology of an individual that reveals the past or present physical location of an individual or of a device that identifies or is linked or reasonably linkable to one or more individuals, with sufficient precision to identify street level location information or the location of an individual or device within a range of 1,850 feet or less. A United States individual is a natural person residing in the United States.