H.R. 7239 – Securing Social Security Numbers Act

AI-Generated Summary

Updated April 16, 2026 at 12:34 AM UTC

The Securing Social Security Numbers Act would stop businesses from asking customers for their Social Security numbers when they buy goods or services, unless a specific exception applies. It also forces companies that already have such numbers to delete them within 180 days. The law gives states and individuals the ability to sue for violations and sets civil penalties for non‑compliance. It would apply to any commercial entity that deals with consumers in the United States.

Key Provisions

Businesses may not require a consumer’s Social Security number for a purchase, except for credit reports, background checks, law‑enforcement purposes, legal requirements, or when needed to verify identity or prevent fraud.
Companies that already hold Social Security numbers must delete them within 180 days of the law’s effective date, unless an exception applies.
State attorneys general can sue on behalf of residents to stop illegal practices, enforce the law, and seek damages or other relief.
Individuals can bring civil actions in state court within five years of the violation or three years after discovery, whichever is earlier.
Violations can be penalized up to $5,000 per incident, or up to $50,000 for a pattern or practice of violations.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

2 earlier actions

HouseCommittee Latest Action

Referred to the Subcommittee on Social Security.

Social Security Subcommittee

December 17, 2018

View full timeline

HouseIntro Referral

Introduced in House

December 10, 2018

HouseIntro Referral

Referred to the Committee on Energy and Commerce, and in addition to the Committee on Ways and Means, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

Energy and Commerce Committee

December 10, 2018

HouseCommittee

Referred to the Subcommittee on Social Security.

Social Security Subcommittee

December 17, 2018

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in HouseIssued December 10, 2018

I

115th CONGRESS

2d Session

H. R. 7239

IN THE HOUSE OF REPRESENTATIVES

December 10, 2018

Ms. Lofgren introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committee on Ways and Means, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned

A BILL

To prohibit requests for the disclosure of a social security account number in commercial transactions, and for other purposes.

1.

Short title

This Act may be cited as the Securing Social Security Numbers Act.

2.

Prohibition on requesting disclosure of a social security account number for consumer transactions

(a)

In general

A commercial entity shall not request that an individual provide the individual’s social security account number when purchasing a commercial good or service or deny an individual the good or service for refusing to provide that number except—

(1)

for any purpose relating to—

(A)

obtaining a consumer report for any purpose permitted under the Fair Credit Reporting Act;

(B)

a background check of the individual conducted by a landlord, lessor, employer, or voluntary service agency;

(C)

law enforcement; or

(D)

a Federal, State, or local law requirement; or

(2)

if the social security account number is necessary to verify the identity of the consumer to effect, administer, or enforce the specific transaction requested or authorized by the consumer, or to prevent fraud.

(b)

Purging of collected social security account numbers

A commercial entity that has acquired social security account numbers prior to the enactment of this Act is prohibited from intentional continued possession of such social security account numbers and must purge all such social security account numbers from its records not later than 180 days after the effective date of this Act, unless the commercial entity would qualify for an exception under subsection (a).

(c)

Limitation on predispute arbitration agreements

No predispute arbitration agreement shall be valid or enforceable if it requires arbitration of a violation of this section.

(d)

State attorney general enforcement

In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that is prohibited under this section, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

(1)

enjoin that practice;

(2)

enforce compliance with such section;

(3)

obtain damages, restitution, or other compensation on behalf of residents of the State; or

(4)

obtain such other relief as the court may consider appropriate.

3.

Civil actions and civil penalties

(a)

Civil action in state courts

(1)

Statute of limitations

An action may be commenced under this subsection not later than the earlier of—

(A)

5 years after the date on which the alleged violation occurred; or

(B)

3 years after the date on which the alleged violation was or should have been reasonably discovered by the aggrieved individual.

(2)

Nonexclusive remedy

The remedy provided under this subsection shall be in addition to any other remedies available to the individual.

(b)

Civil penalties

(1)

In general

Any person who the Attorney General determines has violated any section of this Act or of any amendments made by this Act shall be subject, in addition to any other penalties that may be prescribed by law—

(A)

to a civil penalty of not more than $5,000 for each such violation; and

(B)

to a civil penalty of not more than $50,000, if the violations have occurred with such frequency as to constitute a pattern or practice of violations.

(2)

Determination of violations

Any intentional violation committed contemporaneously with respect to the social security account numbers of 2 or more individuals shall be treated as a separate violation with respect to each such individual.

4.

Effective date

The amendment made by this Act shall be in effect 1 year after the date of enactment of this Act.