Health and Location Data Protection Act of 2026
- Sponsor
- Sen. Warren, Elizabeth [D-MA]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Jul 13, 2026
Bottom line
This bill aims to restrict the commercial trade of sensitive personal health and location data by data brokers, empowering individuals and regulators to enforce these prohibitions.
What it actually does
This bill prohibits data brokers from selling, licensing, or otherwise making available an individual's location data or health data, whether declared or inferred. It also makes it unlawful for any person to sell such sensitive data to a data broker. The bill establishes comprehensive enforcement mechanisms, including actions by the Federal Trade Commission (FTC), state attorneys general, and a private right of action for individuals, with significant civil penalties.
Proponents argue
Supporters argue this bill is crucial for protecting individual privacy, especially concerning highly sensitive health and location information, which can be exploited for discrimination, harassment, or other harmful purposes. They contend it closes loopholes in existing privacy laws and gives individuals greater control over their personal data by directly targeting the data broker industry.
Opponents contend
Opponents might argue that the bill's broad definitions of 'data' and 'data broker' could stifle legitimate data-driven innovation, research, and services that rely on aggregated or anonymized data. They may also raise concerns about the potential for over-enforcement or the creation of a complex regulatory environment that disproportionately impacts smaller businesses.
The bill is relatively short and clearly structured, making it accessible for a reader to understand its core prohibitions and enforcement mechanisms within a reasonable timeframe.
Section 2(a)
Prohibition on Data Brokers Selling Sensitive Data
This section makes it illegal for data brokers to sell, resell, license, trade, transfer, share, or otherwise make available an individual's location data or health data, whether explicitly declared or inferred. The FTC is authorized to identify additional categories of data that address or reveal location or health information.
Supporters argue
Supporters argue this is the core protection, directly addressing the privacy risks associated with the commercialization of sensitive personal information, preventing its misuse for discrimination or other harmful purposes.
Critics contend
Critics might argue this could disrupt legitimate data uses, such as public health research or location-based services, if the definitions are too broad or exceptions are insufficient.
Tradeoffs
This provision balances individual privacy against the economic activities of data brokers and potential uses of data for other purposes, aiming to restrict the trade of highly sensitive information.
Section 2(b)
Prohibition on Selling Sensitive Data to Data Brokers
This section makes it unlawful for any person (not just data brokers) to sell, resell, license, trade, transfer, share, or otherwise provide an individual's location data or health data to a data broker. This acts as a complementary measure to prevent the initial acquisition of such data by brokers.
Section 2(c)(1)
Exception for HIPAA-Compliant Actions
This section clarifies that the Act does not prohibit actions taken with respect to an individual's health information by a data broker acting in its capacity as a business associate or covered entity, provided those actions are permissible under HIPAA privacy regulations. This ensures that existing healthcare data sharing for treatment, payment, and healthcare operations remains unaffected.
Section 2(c)(3)
Exception for Valid Individual Authorization
This provision allows for the disclosure of an individual's data if the individual provides 'valid authorization.' The term 'valid authorization' is defined by reference to HIPAA regulations (45 CFR 164.508), with adaptations by the FTC to apply to both location and health data, ensuring a high standard for consent.
Section 2(d) and 2(e)
FTC Rulemaking and Effective Date
The prohibitions under the Act take effect either when the FTC issues its final rule or 180 days after enactment, whichever is earlier. The FTC is mandated to issue initial regulations within 180 days to carry out the Act and may issue further guidance, including defining additional data types, to ensure comprehensive implementation.
Section 3
Comprehensive Enforcement Mechanisms
This section establishes multiple enforcement avenues: the FTC can treat violations as unfair or deceptive acts, states can bring civil actions as parens patriae, and individuals can bring private civil actions. Remedies include injunctions, civil penalties (up to 15% of the ultimate parent entity's revenue), damages, restitution, and deletion of relevant information.
Section 4(6)-(7)
Definitions of Sensitive Data (Health and Location)
'Health data' is broadly defined to include information revealing the search for, attempt to obtain, or receipt of health services/supplies, any past/present/future health condition (including pregnancy and miscarriage), or treatment/diagnosis. 'Location data' means data capable of determining the past or present physical location of an individual or an individual's device.
Section 4(5)
Definition of Data Broker and Exclusions
A 'data broker' is defined as an entity that, for valuable consideration, sells, licenses, or otherwise makes available data of individuals that the entity did not collect directly from such individuals to another entity. Exclusions include entities transmitting data at an individual's request, providing products/services where sensitive data isn't the primary offering, or reporting/publishing news of public interest.
Mandates the FTC to adopt rules defining 'data' within 180 days, requiring it to include information that is linked, or reasonably linkable, to specific individuals or specific groups of individuals who share the same place of residence or internet protocol address.
Section 4(4)
Why it matters:While delegating technical definitions to expert agencies is standard legislative practice, the broad scope of 'data' (including groups by IP address) is highly significant and could be easily overlooked by a casual reader.
Case for: Supporters argue this flexibility allows the FTC to adapt the definition to evolving data practices and technologies, ensuring the law remains effective against new forms of data aggregation and identification.
Case against: Critics might contend that delegating such a fundamental definition to an agency creates regulatory uncertainty and could lead to an overly broad interpretation that impacts legitimate data uses or creates unforeseen compliance burdens.
Estimated impact: This definition will ultimately determine the full scope of data protected by the Act, potentially impacting a vast array of digital information and the entities that handle it.
Establishes a civil penalty not to exceed 15 percent of the revenues earned by the person's ultimate parent entity during the preceding 12-month period for a violation of the Act.
Section 3(d)
Why it matters:While referencing existing regulatory definitions is standard, the scale of the penalty (based on the revenue of a potentially much larger parent company) is highly significant and could be easily overlooked, masking the true financial risk of non-compliance.
Case for: Proponents argue this ensures penalties are substantial enough to deter large corporations, making violations economically unfeasible and preventing companies from treating fines as merely a cost of doing business.
Case against: Opponents might argue that basing penalties on the revenue of the 'ultimate parent entity' can lead to disproportionately high fines for smaller subsidiaries or for violations that are not severe, potentially stifling innovation or leading to bankruptcies.
Estimated impact: This provision could result in multi-billion dollar penalties for large corporate groups, significantly increasing the financial risk of non-compliance and potentially reshaping corporate liability structures.