Health and Location Data Protection Act of 2026
- Sponsor
- Rep. Scanlon, Mary Gay [D-PA-5]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Jun 25, 2026
Bottom line
The Health and Location Data Protection Act of 2026 aims to significantly restrict the commercial exchange of sensitive personal health and location data by data brokers, creating new federal prohibitions and enforcement avenues to enhance individual privacy.
What it actually does
This bill prohibits data brokers from selling, licensing, or otherwise making available an individual's location data, health data, or other related categories of data identified by the Federal Trade Commission (FTC). It also makes it unlawful for any person to sell such data to a data broker. The bill provides exceptions for HIPAA-compliant actions, newsworthy information, and disclosures with valid individual authorization, and establishes robust enforcement mechanisms for the FTC, State Attorneys General, and private individuals.
Proponents argue
Supporters argue that this bill is a critical step to protect individual privacy in an era where sensitive personal data is routinely collected and sold without explicit consent. They contend it will prevent the misuse and exploitation of highly personal health and location information, empowering individuals to control their data and providing strong legal recourse against violations.
Opponents contend
Opponents might argue that the bill's broad definitions of 'health data' and 'location data,' coupled with severe civil penalties and a private right of action, could stifle innovation in data-driven industries, create significant compliance burdens for businesses, and potentially lead to an excessive volume of litigation. They may also contend that existing privacy laws or industry self-regulation are sufficient.
The bill is concise and its core prohibitions are clearly stated, making it accessible for a quick review by an informed reader.
Section 2(a)
Prohibition on Data Brokers Selling Sensitive Data
This provision makes it unlawful for any data broker to sell, resell, license, trade, transfer, share, or otherwise provide or make available an individual's location data, health data, or other categories of data identified by the FTC that address or reveal such information. This applies to both declared and inferred data.
Supporters argue
Supporters argue this directly addresses the core problem of sensitive personal data being commodified and sold without individual knowledge or consent, thereby safeguarding fundamental privacy rights.
Critics contend
Critics may contend that this prohibition could disrupt legitimate data-driven services and economic activities, potentially limiting beneficial uses of data for research or personalized services.
Tradeoffs
This provision balances the imperative to protect individual privacy against the economic interests of industries that rely on the commercial exchange of data.
Section 2(b)
Prohibition on Selling Sensitive Data to Data Brokers
This provision makes it unlawful for any person to sell, resell, license, trade, transfer, share, or otherwise provide or make available an individual's location data, health data, or other related data to a data broker. This aims to prevent data brokers from acquiring sensitive data indirectly.
Section 2(c)
Exceptions for HIPAA-Compliant Actions and Newsworthy Information
The bill includes exceptions for actions related to health information that are permissible under HIPAA regulations, provided the data broker acts as a business associate or covered entity. It also exempts the publication of newsworthy information of legitimate public concern and disclosures where the individual provides valid authorization, with the FTC tasked to adapt the definition of 'valid authorization'.
Section 3
Federal, State, and Private Enforcement Mechanisms
This section designates violations of the Act as unfair or deceptive acts under the Federal Trade Commission Act, granting the FTC broad enforcement powers including injunctions, civil penalties, and damages, and extending its jurisdiction to non-profit organizations. It also grants State Attorneys General the authority to bring civil actions on behalf of their residents and establishes a private right of action for aggrieved individuals, allowing them to seek injunctions, damages, and data deletion. Civil penalties can be up to 15 percent of the ultimate parent entity's revenues.
Section 4
Key Definitions for Data, Data Broker, Health Data, and Location Data
This section defines critical terms for the Act. 'Data broker' is defined as an entity that sells data of individuals not collected directly from them, with specific exclusions. 'Health data' is broadly defined to include information revealing the search for, attempt to obtain, inquiry regarding, or receipt of health information, services, or supplies, including through AI system prompts, as well as past, present, or future health conditions. 'Location data' means data capable of determining an individual's physical location. The FTC is also mandated to define 'data' to include information linked or reasonably linkable to specific individuals or groups.
The prohibition on data sales takes effect on the earlier of the FTC's final rule or 180 days after enactment. The FTC is mandated to issue a final rule within 180 days and may issue further guidance.
Section 2(d) and 2(e)
Why it matters:This is standard legislative practice for setting implementation timelines and delegating rulemaking authority to an agency.
Case for: Proponents argue that this ensures a clear and relatively swift timeline for the Act's prohibitions to take effect, while also mandating the FTC to provide necessary regulatory guidance to facilitate compliance.
Case against: Critics might contend that a 180-day timeline for the FTC to issue a final rule on such complex definitions and prohibitions is overly aggressive, potentially leading to rushed or incomplete guidance that creates uncertainty for businesses.
Estimated impact: This determines the speed and clarity with which the core prohibitions of the bill will be implemented and enforced.
This clause expands the Federal Trade Commission's jurisdiction to enforce this Act against organizations not organized to carry on business for their own profit or that of their members, overriding the usual limitation in Section 4 of the Federal Trade Commission Act.
Section 3(a)(2)(D)
Why it matters:While technically an expansion of jurisdiction, it is phrased as a carve-out to existing FTC limitations, which can appear as a technical amendment rather than a significant policy shift.
Case for: Proponents argue this is essential to prevent non-profit entities from becoming loopholes for sensitive data exploitation, ensuring comprehensive protection regardless of an organization's tax status.
Case against: Opponents might view this as an overreach of FTC authority into sectors traditionally outside its purview, potentially imposing undue burdens on non-profit organizations that may not have the resources to comply with complex federal regulations.
Estimated impact: Broadens the scope of entities subject to FTC enforcement under this Act to include non-profit organizations.
This provision establishes exclusive jurisdiction for all actions brought under this Act: the U.S. District Court for the District of Columbia for FTC and private actions (with an alternative for private actions in districts where violations occurred or defendants reside/do business), and the district court for the judicial district of the state capital for State Attorney General actions. Appeals are exclusively heard by the D.C. Circuit.
Section 3(e)
Why it matters:It's a technical legal provision that centralizes litigation, a common legislative strategy, but it has significant practical implications for legal access and consistency.
Case for: Proponents argue that centralizing jurisdiction in specific courts will lead to more consistent legal interpretations, foster judicial expertise in data privacy law, and streamline the litigation process for complex federal cases.
Case against: Critics might contend that this centralization could create significant logistical and financial barriers for plaintiffs and defendants located far from these specific judicial districts, potentially hindering access to justice, especially for private actions.
Estimated impact: Shapes the legal landscape for all litigation under the Act, influencing accessibility and consistency of judicial outcomes.
The definition of 'health data' explicitly includes data that reveals 'the search for, attempt to obtain, inquiry regarding, or receipt of any health information, services, or supplies, including through prompts or other information entered into an artificial intelligence system.'
Section 4(6)(A)
Why it matters:It's a technical detail within a definition, but it represents a significant policy choice to extend privacy protections to interactions with AI systems, which could be politically contentious if highlighted.
Case for: Proponents argue this is essential for modern privacy protection, as individuals increasingly use AI systems for health-related inquiries, and this data can be highly revealing. Without this, a significant loophole for sensitive data collection via AI would exist.
Case against: Critics might argue this is overly broad and could capture a vast array of general inquiries to AI systems that are not truly 'health data' in a sensitive sense, creating significant compliance challenges for AI developers and operators and potentially stifling AI innovation.
Estimated impact: Significantly expands the scope of what constitutes 'health data' to include interactions with AI systems, impacting AI development and user privacy.