Protecting Americans' Data from Foreign Adversaries Act of 2024
PADFA
Data brokers
PADFA makes it unlawful for data brokers to sell, license, transfer, or otherwise make available personally identifiable sensitive data of U.S. individuals to a foreign adversary country (currently China, Iran, North Korea, Russia) or an entity controlled by one. It took effect 60 days after enactment on April 24, 2024.
- Where
- Federal
- Citation
- 15 U.S.C. 9901 (Pub. L. 118-50, div. I)
- Status
- In force
- In force since
- 2024-06-23
- Enforced by
- Federal Trade Commission
- People can sue
- No
- Penalties
- Violations are treated as FTC rule violations: civil penalties up to $53,088 per violation (16 CFR 1.98, inflation-adjusted amount in force since Jan. 17, 2025).
- Applies to
- Data brokers: entities that for valuable consideration make available data of U.S. individuals that they did not collect directly from those individuals
Practices it requires
- Do not sell, license, rent, trade, transfer, disclose, or provide access to personally identifiable sensitive data of a U.S. individual to a foreign adversary country or an entity controlled by a foreign adversary.15 U.S.C. 9901(a)
Other duties
- 'Controlled by a foreign adversary' includes entities domiciled or organized in an adversary country and entities in which such persons own at least a 20 percent stake.15 U.S.C. 9901(c)(2)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: The list of foreign adversary countries is by cross-reference to 10 U.S.C. 4872(d)(2) and was not fetched
Research reference, not legal advice.