HB827: HB827 Menstrual Data Privacy and Protection Act; enact

Menstrual tracking apps, pharmacies, retailers, and health care providers currently face no specific Georgia law governing how they collect or share menstrual and reproductive health data. This bill would add a new article to Georgia's trade practices code (O.C.G.A. Title 10) creating rules specifically for 'menstrual data,' defined broadly to include information from tracking apps, devices, pharmacies, and retail purchases of menstrual products. Entities would need explicit, informed consent before collecting, using, or sharing this data, could never sell it to third parties, and would have to use it only for the purposes an individual agreed to. Entities must use industry-standard security measures, report data breaches within 72 hours, honor deletion requests within 30 days, and publish a public privacy policy and annual data protection report. The Attorney General could seek injunctions and civil penalties, and individuals could sue for damages and attorney's fees.

• Requires any entity collecting menstrual data, including apps, pharmacies, retailers, clinics, and hospitals, to get explicit consent before collecting, using, or sharing it.
• Bans selling menstrual data or reproductive health data to third parties under any circumstances.
• Requires entities to use industry-standard security measures like encryption and regular security audits to protect menstrual data.
• Requires entities to notify affected individuals and the Attorney General within 72 hours of a data breach involving menstrual data.
• Gives individuals the right to demand deletion of their menstrual data, which entities must complete within 30 days.
• Allows the Attorney General to seek civil penalties up to $50,000 per violation or $500 per affected person, and lets individuals sue for actual or statutory damages up to $2,500 per violation.

Companies and individuals that collect menstrual data, including menstrual tracking apps and devices, pharmacies and retail stores selling menstrual products, healthcare providers, clinics, and hospitals. It also affects any Georgia resident whose menstrual or reproductive health data is collected by these entities.

People using period-tracking apps or buying menstrual products would gain new legal control over that data, including the right to demand its deletion and to sue if it's misused or sold. Companies handling this information would face new consent, security, and reporting obligations with real financial penalties for violations.

• Section 3 creates new Code sections 10-1-960 through 10-1-964 defining 'entity,' 'explicit consent,' and 'menstrual data' broadly to cover apps, pharmacies, retailers, and providers.
• O.C.G.A. § 10-1-961 requires explicit consent for collecting, processing, or sharing menstrual data, bars use for unrelated purposes like marketing without added consent, and bans selling the data outright.
• O.C.G.A. § 10-1-962 requires industry-standard security measures, 72-hour breach notification to individuals and the Attorney General, and deletion of data within 30 days of a request.
• O.C.G.A. § 10-1-963 requires entities to publish a public privacy policy and an annual report on data protection efforts and breaches.
• O.C.G.A. § 10-1-964 lets the Attorney General seek injunctions, civil penalties up to $50,000 per violation or $500 per affected individual, and lets individuals sue for actual or statutory damages up to $2,500 per violation plus attorney's fees.
• Section 4 repeals any conflicting laws.

1. 2025-03-28House Second Readers (House)
2. 2025-03-27House First Readers (House)
3. 2025-03-25House Hopper (House)

• Mekyah McQueen (D, HD-061)Primary sponsor
• Shea Roberts (D, HD-052)
• Tanya Miller (D, HD-062)
• Stacey Evans (D, HD-057)
• Inga Willis (D, HD-055)
• Park Cannon (D, HD-058)

• data privacy
• menstrual health data
• reproductive health privacy
• consumer protection
• data breach notification