PADFA
In force United States (Federal) · In force Jun 23, 2024 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Makes it unlawful for a data broker to sell, license, transfer, disclose or otherwise make available personally identifiable sensitive data of U.S. individuals to a foreign adversary country (China, Iran, North Korea, Russia) or to an entity controlled by one. Covered data is broad, including health, financial, biometric, genetic, precise geolocation, private communications and data about minors.
- Who it applies to
- Data brokers: entities that, for valuable consideration, make available data of U.S. individuals they did not collect directly from those individuals. Excludes entities acting as service providers, entities whose product is not the data itself, and news reporting. 'Controlled by a foreign adversary' includes entities with 20%+ ownership by foreign adversary persons. No volume threshold.
- Penalties
- Violations are treated as violations of an FTC rule on unfair or deceptive practices: civil penalties up to $53,088 per violation (FTC Act 5(m)(1)(A) amount as adjusted January 2025, 90 FR 5580; adjusted annually for inflation).
- Enforced by
- Federal Trade Commission
- Official name
- Protecting Americans' Data from Foreign Adversaries Act of 2024
- Citation
- Pub. L. 118-50, div. I, sec. 2 (15 U.S.C. 9901)
- Topics
- privacy, data-residency
Verified 2026-09-22 congress.gov
Research notes
Overlaps with the DOJ bulk data rule (28 CFR Part 202); DOJ rule transactions subject to PADFA are carved out of certain DOJ provisions. No FTC implementing regulations are required.
Related
CIRCIAQuestions about PADFA
- What are the PADFA compliance deadlines?
- Jun 23, 2024: PADFA takes effect.
- When does PADFA take effect?
- PADFA took effect on Jun 23, 2024.
- Who does PADFA apply to?
- Data brokers: entities that, for valuable consideration, make available data of U.S. individuals they did not collect directly from those individuals. Excludes entities acting as service providers, entities whose product is not the data itself, and news reporting. 'Controlled by a foreign adversary' includes entities with 20%+ ownership by foreign adversary persons. No volume threshold.
- What are the penalties under PADFA?
- Violations are treated as violations of an FTC rule on unfair or deceptive practices: civil penalties up to $53,088 per violation (FTC Act 5(m)(1)(A) amount as adjusted January 2025, 90 FR 5580; adjusted annually for inflation).