15 U.S.C. § 9901
Prohibition on transferring sensitive U.S. data to foreign adversaries (PADFAA)
In plain English
It is unlawful for a data broker to sell or otherwise transfer personally identifiable sensitive data of a U.S. individual to a foreign-adversary country or an entity controlled by one. The FTC enforces it as if it were an unfair or deceptive practice rule.
Relevant provisions
- § 9901(a) — prohibition on a data broker making personally identifiable sensitive data available to a foreign adversary country or controlled entity
- § 9901(b) — FTC enforcement; a violation is treated as an unfair or deceptive act or practice
- § 9901(c)(6) — 'precise geolocation information' defined (street level, or within 1,850 feet or less)
- § 9901(c)(7) — 'sensitive data' categories (government identifiers, health, financial, biometric, genetic, precise geolocation, private communications, and more)
Applicability and limits
This targets data-broker transfers to specified foreign adversaries. It is NOT a consumer-initiated deletion right and does not give an individual a mechanism to demand deletion from a broker.
The definition of “precise geolocation information” (street level, or a range of 1,850 feet or less) is the kind of specific provision that must be cited rather than paraphrased loosely.
Official source
- 15 U.S.C. § 9901 ↗Primary authorityhttps://uscode.house.gov/us/usc/t15/s9901/
Verification: Full section text read directly from the official Office of the Law Revision Counsel source on 2026-11-10 (current through Public Law 119-138, Nov 3 2026).
Related authorities
- Right to delete personal information (CCPA) — Cal. Civ. Code § 1798.105