HB 827: Menstrual Data Privacy and Protection Act; enact

Right now, apps that track periods, pharmacies, and healthcare providers can collect menstrual and reproductive health data without any specific Georgia law governing consent, security, or sale of that information. This bill would create the "Menstrual Data Privacy and Protection Act" as a new article in Georgia's trade practices law (O.C.G.A. Title 10, Chapter 1). The bill would require any entity collecting menstrual data, from period-tracking apps to pharmacies to hospitals, to get explicit, informed consent before collecting, using, or sharing it, and would flatly ban selling such data to third parties. Entities would have to use industry-standard security measures, report data breaches within 72 hours, and delete a person's data within 30 days of a request. Entities must also publish a public privacy policy and an annual transparency report. Violations could bring civil penalties sought by the Attorney General or a lawsuit by the affected individual.

• Requires entities that collect menstrual data, including apps, pharmacies, clinics, and hospitals, to obtain explicit consent before collecting, processing, or sharing it.
• Bans the sale of menstrual or reproductive health data to third parties under any circumstances.
• Requires industry-standard security measures such as encryption, regular security audits, and vulnerability assessments for entities holding menstrual data.
• Requires entities to notify affected individuals and the Attorney General within 72 hours of a data breach involving menstrual data.
• Gives individuals the right to request deletion of their menstrual data, which entities must complete within 30 days.
• Sets civil penalties of up to $50,000 per violation (or $500 per affected person) sought by the Attorney General, and lets individuals sue for actual damages, statutory damages up to $2,500 per violation, and attorney's fees.

Companies and individuals that collect menstrual data, including period-tracking apps and platforms, pharmacies and retailers selling menstrual products, healthcare providers, clinics, and hospitals. It also affects Georgians who use these products and services and whose reproductive health data is collected.

Menstrual and reproductive health data can reveal sensitive personal information, including possible pregnancy status. This bill would give Georgians more control over that data, letting them demand its deletion and blocking its sale, while requiring companies to secure it and quickly disclose breaches.

• New Code Section 10-1-960 defines key terms including 'entity,' 'explicit consent,' and 'menstrual data,' covering apps, pharmacies, retailers, and healthcare providers.
• Code Section 10-1-961 requires explicit consent before collecting, processing, or sharing menstrual data, limits use to the purposes consented to, and bans selling such data to third parties, with each instance a separate violation.
• Code Section 10-1-962 requires industry-standard security measures, 72-hour breach notification to individuals and the Attorney General, and data deletion within 30 days of a request.
• Code Section 10-1-963 requires entities to publish a public privacy policy and an annual report on data protection efforts and any breaches.
• Code Section 10-1-964 authorizes the Attorney General to seek injunctions, civil penalties up to $50,000 per violation or $500 per affected person, and lets individuals sue for actual damages, up to $2,500 in statutory damages per violation, and attorney's fees.
• Section 4 repeals any conflicting Georgia laws.

1. 2025-03-28House Second Readers (House)
2. 2025-03-27House First Readers (House)
3. 2025-03-25House Hopper (House)

• Mekyah McQueen (D, HD-61)Primary sponsor
• Shea Roberts (D, HD-52)
• Tanya F. Miller (D, HD-62)
• Stacey Evans (D, HD-57)
• Inga Willis (D, HD-55)
• Park Cannon (D, HD-58)

• menstrual data privacy
• reproductive health data
• consumer data protection
• data breach notification
• health apps