The Blue Shield Privacy Act of 2025 amends section 119(b) of title 18, United States Code, by inserting six new items into the statutory definition of "restricted personal information": license plate number, biometric information, workplace address, school address, and global positioning system (GPS) coordinates (added alongside home fax number). The change is textual and targeted — it modifies what counts as "restricted personal information" under existing federal law rather than creating a standalone offense.
Because other federal provisions reference the term "restricted personal information," this drafting choice imports those existing penalties and prohibitions onto the newly listed data elements. That means entities that collect, share, or sell the added categories will now face the same criminal exposure and evidentiary treatment applicable to information already classified as restricted, with practical implications for data handlers, researchers, law enforcement, and civil liberties advocates.
At a Glance
What It Does
The bill edits one sentence in 18 U.S.C. §119(b), expanding the statutory list of data elements that qualify as "restricted personal information" by adding license plate numbers, biometric information, workplace address, school address, and GPS coordinates. It does not create a separate statute; instead, it places those items inside the existing definition used elsewhere in title 18.
Who It Affects
Organizations that collect, aggregate, sell, or host personal data — including data brokers, tech platforms, private investigators, vehicle-tracking services, and entities handling biometric or location datasets — are directly affected. Individuals whose plate numbers, biometric identifiers, or precise location data are recorded gain the protections that attach to the "restricted" label.
Why It Matters
Bringing biometric and precise location data under a federal "restricted" label is legally consequential: it extends criminal exposure and evidentiary rules to categories increasingly central to surveillance, targeted advertising, and law enforcement. Compliance officers, privacy counsel, and risk teams must reassess data inventories, contracts, and disclosure practices to avoid triggering criminal provisions tied to the definition.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill is narrowly focused: it changes the wording in a single subsection of title 18 that defines "restricted personal information." That definition is a linchpin in several federal criminal provisions; by amending it, the bill makes certain types of data subject to the same legal treatment as other information already labeled "restricted." The textual edit replaces a short phrase and inserts a longer list of specific items, thereby folding the newly listed data into the existing statutory framework.
Practically, the effect is indirect but real. The statute does not, on its face, add new penalties or civil requirements; instead it expands the universe of information that existing criminal provisions can reach.
So a conviction or prosecution that previously required the disclosure or sale of a different type of restricted data could, after enactment, be pursued for conduct involving license plate numbers, biometric identifiers, workplace and school addresses, or GPS coordinates. That broadening changes compliance posture for many organizations that handle such data: recordkeeping, access controls, contractual terms with vendors, and data-minimization practices all become relevant to criminal-law risk assessment.The bill leaves several important definitional and scope questions open.
It inserts the phrase "biometric information" without a statutory definition, and it treats workplace and school addresses alongside home contact details even though those addresses may be publicly listed or routinely shared in different contexts. GPS coordinates are included as a discrete category, which signals congressional concern about fine-grained location tracking, but the statute does not specify precision thresholds (for example, whether cell-tower level or meter-level coordinates are covered).
Those gaps will determine how broadly prosecutors and courts apply the new text.For compliance teams the immediate work is operational: update data inventories to flag the newly covered elements, revisit vendor contracts to limit unauthorized transfers, and train staff who handle plate, biometric, or location data. For researchers, journalists, and public-interest technologists the amendment raises questions about exemptions or law-enforcement access for legitimate uses; the bill provides none, so carve-outs would have to come from other statutes, policy guidance, or case law.
The Five Things You Need to Know
The bill amends 18 U.S.C. §119(b) by striking the phrase "or home fax number of," and inserting: "home fax number, license plate number, biometric information, workplace address, school address, or global positioning system coordinates of,".
The change is definitional only: it expands what counts as "restricted personal information" rather than creating a new standalone criminal offense or new civil obligations.
The statute adds "biometric information" but does not define that term or set technical parameters (e.g.
fingerprints, facial templates, gait data), leaving courts and agencies to interpret scope.
Including "global positioning system coordinates" brings precise geolocation data explicitly within the restricted category, but the bill does not specify a precision threshold or contextual carve-outs for publicly available location data.
Because other provisions in title 18 reference the term "restricted personal information," the amendment makes the newly listed data elements subject to existing federal criminal penalties and evidentiary regimes tied to that term.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
This one-line section names the Act the "Blue Shield Privacy Act of 2025." It's purely formal but signals the bill's policy focus on privacy and data protection.
Textual amendment to 18 U.S.C. §119(b)
This is the operative change: it strikes the narrow existing phrase and inserts a longer list of data elements into the statutory definition of "restricted personal information." Because §119(b) is a definitional subsection, the amendment cascades: any provision elsewhere in title 18 that references "restricted personal information" will now include license plate numbers, biometric identifiers, workplace and school addresses, and GPS coordinates. The provision does not add procedural rules, definitions, exceptions, or enforcement mechanisms — it solely broadens scope through definition.
Extension of existing criminal exposure to newly listed data
Although not a separate numbered section in the bill text, the practical legal effect is that federal statutes and offenses which rely on the phrase "restricted personal information" can be applied to the newly enumerated categories. That linkage means prosecutors could charge conduct involving sale, transfer, or use of these data elements under those preexisting offenses; defense and compliance strategies will need to account for that cross-reference.
This bill is one of many.
Codify tracks hundreds of bills on Privacy across all five countries.
Explore Privacy in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Individuals targeted by real-time tracking or biometric surveillance — adding GPS coordinates and biometric data to the "restricted" list makes misuse of those data more plausibly subject to federal criminal enforcement, increasing protections against stalking or covert tracking.
- Privacy and civil-liberties organizations — the statutory expansion creates a stronger federal baseline for advocating enforcement against illicit sales and transfers of sensitive identifiers and location data.
- Law enforcement agencies with lawful access — by clarifying that sensitive location and biometric data are included under a criminal-protection umbrella, the bill strengthens prosecutorial tools to pursue actors who trade or misuse such data in illicit contexts.
Who Bears the Cost
- Data brokers and commercial aggregators that collect and sell license plate, location, or biometric datasets — they will face greater criminal-law risk and likely need to tighten contracts, access controls, and due-diligence processes.
- Technology platforms and third-party vendors that handle geolocation or biometric features — these organizations must reassess data-retention policies, consent practices, and vendor agreements to avoid exposure under the expanded definition.
- Research institutions, journalists, and public-interest technologists — projects that rely on license-plate scraping, crowd-sourced GPS data, or biometric datasets could encounter legal uncertainty and compliance costs absent clear exemptions or guidance.
Key Issues
The Core Tension
The central dilemma is balancing stronger protection for sensitive locational and biometric identifiers against the risk of overbreadth: the statute extends criminal-law reach to items that can be both highly sensitive and, in other contexts, publicly observable or legitimately used, and it does so without definitional limits or targeted exceptions to preserve lawful research, journalism, and public-safety uses.
The bill's single-sentence insertion raises several implementation and interpretive issues that the statute itself does not resolve. Most notably, key terms such as "biometric information" and "global positioning system coordinates" are left undefined.
That invites litigation and administrative interpretation about scope: does "biometric" include behavioral biometrics, hashed templates, or derived identifiers? Do GPS coordinates require a certain decimal precision to count as "restricted"?
Those questions determine whether routine operational data are swept into the criminal net.
Another trade-off is publicness versus sensitivity. License plate numbers and workplace addresses can be publicly observable or listed in public records; treating them as "restricted" risks criminalizing commonplace data-sharing or placing an additional compliance burden on entities that rely on publicly sourced information.
Conversely, failing to cover those items leaves a gap that enables easy reidentification and physical surveillance. The bill solves for privacy by expanding coverage but does not provide proportionality guardrails — no exemptions for research, journalism, or law-enforcement uses, and no safe-harbor mechanics for benign data processing.
Finally, enforcement capacity and prosecutorial discretion will shape real-world impact. A definitional change does not automatically produce prosecutions; resource priorities, plea practices, and interpretive guidance from the Department of Justice will determine how aggressively the new text is applied.
Compliance teams face uncertainty in the interim and may over-correct, chilling data uses that are socially valuable while failing to deter more covert or malicious actors who already operate outside legal constraints.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.