What Is
What Is PADFAA
The Protecting Americans' Data from Foreign Adversaries Act of 2024 (PADFAA), 15 U.S.C. 9901, was enacted April 24, 2024 (Pub. L. 118-50, div. I) and took effect 60 days later, on June 23, 2024. It bars a data broker from selling, licensing, transferring, disclosing, providing access to, or otherwise making available personally identifiable sensitive data of a U.S. resident to a foreign adversary country or to an entity controlled by one (15 U.S.C. 9901(a)).
The foreign adversary countries are China, Russia, Iran, and North Korea (10 U.S.C. 4872(d)(2)). An entity is controlled by a foreign adversary if it is domiciled, headquartered, has its principal place of business, or is organized under the laws of one of those countries; if a foreign person or combination of foreign persons meeting the preceding domicile, headquarters, principal-place-of-business, or organization test directly or indirectly owns at least a 20 percent stake in it; or if it is subject to the direction or control of such a person or entity.
Sensitive data is defined broadly. It includes government identifiers, financial account and card numbers, health, biometric, and genetic information, precise geolocation within 1,850 feet, private communications, log-in credentials, information about people under 17, and online activity tracked over time and across websites.
A 'data broker' is an entity that, for valuable consideration, makes available data of U.S. individuals it did not collect directly from those individuals to another entity that is not acting as a service provider. The definition excludes an entity to the extent it transmits data at an individual's request or direction; provides, maintains, or offers a product or service in which personally identifiable sensitive data or access to it is not the product or service; reports or publishes news or information of public interest; makes qualifying publicly available news or information available, excluding obscene visual depictions; or acts as a service provider. That exclusion is activity-specific: acting as a service provider for one transfer does not make the entity a non-broker for its other transfers.
Unlike the DOJ Data Security Program, PADFAA has no volume threshold: one record is enough. The Federal Trade Commission enforces it as a violation of a rule against unfair or deceptive practices, with civil penalties of up to $53,088 per violation (15 U.S.C. 9901(b); 16 C.F.R. 1.98).
Why it matters in Texas. A company registered as a data broker under Texas Business and Commerce Code chapter 510 should check every downstream buyer against PADFAA and the DOJ program. The Texas law governs registration, notice, and security; PADFAA governs who may receive the data.
Pinpoint: 15 U.S.C. 9901.