--- title: HB 827. Menstrual Data Privacy and Protection Act; enact collection: bills id: 2025-2026/hb827 cite_as: HB 827, 2025-2026 Regular Session (Ga.) canonical_url: https://georgiacommons.org/bills/2025-2026/hb827 md_url: https://georgiacommons.org/bills/2025-2026/hb827.md text_url: https://georgiacommons.org/bills/2025-2026/hb827/text source_url: https://www.legis.ga.gov/legislation/71617 date: 2025-03-28 status: introduced corpus_version: bills-2026-08-28 license: Public record of the Georgia General Assembly, via LegiScan; see about.md publisher: Georgia Commons, an independent project of Georgia Civic Data. Not the State of Georgia. Not legal advice. up: https://georgiacommons.org/bills/2025-2026.md previous: https://georgiacommons.org/bills/2025-2026/hb826.md next: https://georgiacommons.org/bills/2025-2026/hb828.md index: https://georgiacommons.org/bills/index.md omitted: votes and history omitted_chars: 129 omitted_url: https://georgiacommons.org/bills/2025-2026/hb827.md?full=1 bill_number: HB 827 session: 2025-2026 Regular Session session_slug: 2025-2026 chamber: House bill_type: bill status_date: 2025-03-25 last_action: House Second Readers sponsors: - Mekyah McQueen - Shea Roberts - Tanya Miller - Stacey Evans - Inga Willis - Park Cannon text_version: Introduced has_text: true legiscan_url: https://legiscan.com/GA/bill/HB827/2025 upstream_id: 2014700 summaries_model: claude-sonnet-5 topic_tags: - data privacy - menstrual health data - reproductive health privacy - consumer protection - data breach notification --- # HB 827. Menstrual Data Privacy and Protection Act; enact ## Text 25 LC 59 0137 House Bill 827 By: Representatives McQueen of the 61st, Roberts of the 52nd, Miller of the 62nd, Evans of the 57th, Willis of the 55th, and others A BILL TO BE ENTITLED AN ACT To amend Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling1 and other trade practices, so as to enact the "Menstrual Data Privacy and Protection Act"; to2 provide for definitions; to require explicit consent; to provide for security, notification of data3 breaches, and deletion of data; to provide for violations; to provide for reporting; to provide4 for relief; to provide for related matters; to provide for legi slative purpose; to repeal5 conflicting laws; and for other purposes.6 BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:7 SECTION 1.8 This Act shall be known and may be cited as the "Menstrual Data Privacy and Protection9 Act."10 SECTION 2.11 The purpose of this Act is to safeguard the privacy and securit y of menstrual and12 reproductive health data collected by applications, devices, pharmacies, healthcare providers,13 and other entities. This legislation ensures that individuals retain control over their sensitive14 H. B. 827 - 1 - 25 LC 59 0137 personal information and protects against misuse, unauthorized sharing, and data breaches15 involving such information.16 SECTION 3.17 Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other18 trade practices, is amended by enacting a new article to read as follows:19 "ARTICLE 3720 10-1-960.21 As used in this article, the term:22 (1) 'Entity' means any organization, business, or individual c ollecting menstrual data,23 including, but not limited to, digital applications and platfor ms, pharmacies and retail24 establishments, healthcare providers, clinics, and hospitals.25 (2) 'Explicit consent' means a clear and affirmative agreement provided by an individual26 after being fully informed of the specific purpose for menstrual data collection and usage.27 (3) 'Menstrual data' means any information related to an indiv idual's menstrual cycle,28 reproductive health, or related bodily functions collected by an entity, including, but not29 limited to, menstrual tracking applications and devices, pharma cies and healthcare30 providers, and online or in-person retail purchases of menstrual products.31 10-1-961.32 (a) An entity shall obtain explicit consent from an individual before collecting, processing,33 or sharing menstrual data belonging to such individual.34 (b) Menstrual data may only be used by an entity for specific purposes provided in an35 explicit consent agreement. No entity shall use such menstrual data for unrelated purposes,36 H. B. 827 - 2 - 25 LC 59 0137 including marketing or targeted advertising, without obtaining explicit consent to such37 effect.38 (c) No entity shall sell menstrual data or reproductive health data to third parties under any39 circumstances.40 (d) Each instance of an entity collecting, processing, or sharing the menstrual data of an41 individual without obtaining such individual's explicit consent , using an individual's42 menstrual data for purposes not provided in an explicit consent agreement with such43 individual, or selling menstrual data belonging to an individual shall constitute a separate44 violation.45 10-1-962.46 (a) An entity shall implement industry standard security measu res, including, but not47 limited to, data encryption during storage and transmission, re gular security audits, and48 vulnerability assessments.49 (b) An entity shall notify affected individuals and the Attorney General within 72 hours50 of any data breach involving menstrual data.51 (c) Every individual shall have the right to request that any entity in possession of52 menstrual data belonging to such individual delete such menstru al data at any time. An53 entity shall comply with menstrual data deletion requests withi n 30 days and notify the54 requesting individual when the data at issue has been deleted. Deleted menstrual data shall55 not be retained in any form by the entity or its partners.56 (d) Each instance of an entity failing to implement the securi ty measures provided in57 subsection (a) of this Code section, to notify an individual af fected by a data breach58 involving such individual's menstrual data as provided in subse ction (b) of this Code59 section, or to delete menstrual data following the procedures provided in subsection (c) of60 this Code section shall constitute a separate violation.61 H. B. 827 - 3 - 25 LC 59 0137 10-1-963.62 (a) Each entity shall publish on a website accessible to the public a privacy policy detailing63 the types of menstrual data it collects, the purposes for which such data is used, and any64 third parties with whom such data may be shared.65 (b) Each entity shall publish on a website accessible to the p ublic an annual report66 summarizing data protection measures it has implemented, any data breaches or incidents67 it has reported during the year, and any efforts it has made to comply with the provisions68 of this article.69 10-1-964.70 (a) Whenever it may appear to the Attorney General that an ent ity has violated the71 provisions of this article, the Attorney General may seek, and any superior court of72 competent jurisdiction may grant, any or all of the following relief:73 (1) A temporary restraining order or temporary or permanent injunction;74 (2) A civil penalty of up to $50,000.00 per violation or $500.00 per affected individual,75 whichever is greater;76 (3) A declaratory judgment; or77 (4) Other relief as the court deems just and equitable, includ ing, but not limited to,78 reasonable attorney's fees and costs.79 (b) Any individual whose menstrual data is collected, processe d, shared, or sold in80 violation of the provisions of this article may bring a civil action against the violating entity81 in any court having jurisdiction over such entity seeking any or all of the following relief:82 (1) Actual damages;83 (2) Statutory damages of up to $2,500 per violation; or84 (3) Reasonable attorney's fees and costs."85 H. B. 827 - 4 - 25 LC 59 0137 SECTION 4.86 All laws and parts of laws in conflict with this Act are repealed.87 H. B. 827 - 5 - ## Summaries written by Georgia Commons The following was written by claude-sonnet-5 from the text above and is not part of the bill. Quote the text, not the summary. House Bill 827 would create the 'Menstrual Data Privacy and Protection Act,' requiring apps, retailers, pharmacies, and health providers in Georgia to get explicit consent before collecting or sharing menstrual data and banning its sale. ### Plain-language summary Menstrual tracking apps, pharmacies, retailers, and health care providers currently face no specific Georgia law governing how they collect or share menstrual and reproductive health data. This bill would add a new article to Georgia's trade practices code (O.C.G.A. Title 10) creating rules specifically for 'menstrual data,' defined broadly to include information from tracking apps, devices, pharmacies, and retail purchases of menstrual products. Entities would need explicit, informed consent before collecting, using, or sharing this data, could never sell it to third parties, and would have to use it only for the purposes an individual agreed to. Entities must use industry-standard security measures, report data breaches within 72 hours, honor deletion requests within 30 days, and publish a public privacy policy and annual data protection report. The Attorney General could seek injunctions and civil penalties, and individuals could sue for damages and attorney's fees. ### What it does - Requires any entity collecting menstrual data, including apps, pharmacies, retailers, clinics, and hospitals, to get explicit consent before collecting, using, or sharing it. - Bans selling menstrual data or reproductive health data to third parties under any circumstances. - Requires entities to use industry-standard security measures like encryption and regular security audits to protect menstrual data. - Requires entities to notify affected individuals and the Attorney General within 72 hours of a data breach involving menstrual data. - Gives individuals the right to demand deletion of their menstrual data, which entities must complete within 30 days. - Allows the Attorney General to seek civil penalties up to $50,000 per violation or $500 per affected person, and lets individuals sue for actual or statutory damages up to $2,500 per violation. ### Who it affects Companies and individuals that collect menstrual data, including menstrual tracking apps and devices, pharmacies and retail stores selling menstrual products, healthcare providers, clinics, and hospitals. It also affects any Georgia resident whose menstrual or reproductive health data is collected by these entities. ### Why it matters People using period-tracking apps or buying menstrual products would gain new legal control over that data, including the right to demand its deletion and to sue if it's misused or sold. Companies handling this information would face new consent, security, and reporting obligations with real financial penalties for violations. ### Key provisions - Section 3 creates new Code sections 10-1-960 through 10-1-964 defining 'entity,' 'explicit consent,' and 'menstrual data' broadly to cover apps, pharmacies, retailers, and providers. - O.C.G.A. § 10-1-961 requires explicit consent for collecting, processing, or sharing menstrual data, bars use for unrelated purposes like marketing without added consent, and bans selling the data outright. - O.C.G.A. § 10-1-962 requires industry-standard security measures, 72-hour breach notification to individuals and the Attorney General, and deletion of data within 30 days of a request. - O.C.G.A. § 10-1-963 requires entities to publish a public privacy policy and an annual report on data protection efforts and breaches. - O.C.G.A. § 10-1-964 lets the Attorney General seek injunctions, civil penalties up to $50,000 per violation or $500 per affected individual, and lets individuals sue for actual or statutory damages up to $2,500 per violation plus attorney's fees. - Section 4 repeals any conflicting laws. ## Status - Status: Introduced (2025-03-25) - Last action: House Second Readers (2025-03-28) - Sponsors: Mekyah McQueen, Shea Roberts, Tanya Miller, Stacey Evans, Inga Willis, Park Cannon - Official page: https://www.legis.ga.gov/legislation/71617 > The history, votes, and amendments (129 characters) are at https://georgiacommons.org/bills/2025-2026/hb827.md?full=1