Congress bans the sale of your health and location data—with teeth.

What it does

This bill prohibits data brokers from selling, trading, or sharing health data and location data about individuals, and prohibits anyone from selling such data to data brokers. It creates exceptions for HIPAA-compliant healthcare activities, newsworthy publications, and data shared with valid individual authorization. The FTC and state attorneys general gain enforcement authority with civil penalties up to 15% of a company's annual revenue, and individuals can sue directly. The bill funds the FTC with $1 billion through 2035 to implement and enforce these rules.

Why we flagged it

The bill's core function is to restrict the commercial trade in sensitive personal data (health and location) and empower enforcement against violators. It is a straightforward privacy-protection measure, not a tax provision, subsidy, or deregulation.

What the text implies

• The FTC's authority to define 'data' and identify additional sensitive categories (via rulemaking within 180 days) gives the agency significant discretion to expand the scope of protected information beyond health and location, potentially affecting other sensitive categories like financial or biometric data.
• The 15% revenue penalty applies to the 'ultimate parent entity,' meaning a small subsidiary of a large conglomerate could trigger penalties based on the parent's total revenue—potentially creating outsized liability and incentivizing corporate restructuring.
• Private right of action combined with 6-year statute of limitations and no cap on damages (actual, punitive, or otherwise) may generate significant class-action litigation, which could impose compliance costs on smaller data brokers and startups disproportionately.
• The preemption clause is narrow—it only preempts state laws that 'require disclosure prohibited by this Act'—leaving room for state laws to impose stricter restrictions, creating a patchwork of state-level privacy regimes that may complicate compliance for national data brokers.
• The bill does not explicitly address artificial intelligence systems' use of health and location data, despite defining 'AI system' and referencing AI in the health data definition; this gap may allow AI vendors to claim they are not 'data brokers' and thus exempt from the prohibition.

Who it affects

Ordinary people gain a direct privacy protection: data brokers can no longer legally trade their health and location information without consent. This reduces surveillance risk and unwanted targeting. The broad enforcement mechanisms (FTC, states, private lawsuits) and steep penalties (15% of revenue) create real deterrent force. The exceptions preserve legitimate healthcare and journalism, avoiding overreach.

Who stands to gain

• privacy-focused technology vendors
• cybersecurity and compliance software providers
• law firms specializing in privacy litigation

Named in the bill

Federal Trade Commission (FTC), data brokers, state attorneys general, HIPAA (Health Insurance Portability and Accountability Act), National Artificial Intelligence Initiative Act of 2020, US District Courts, US Court of Appeals for the District of Columbia Circuit

Where it stands

10 cosponsors: 10 Democrats.

• Jun 25, 2026 — Introduced · Congress.gov: “Introduced in House”
• Jun 25, 2026 — Referred to House Committee on Energy and Commerce · Congress.gov: “Referred to the House Committee on Energy and Commerce”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.