Congress bans the sale of your health and location data—with teeth.

What it does

This bill prohibits data brokers from selling, trading, or sharing health data and location data about individuals, and prohibits anyone from selling such data to data brokers. It creates exceptions for HIPAA-compliant healthcare activities, newsworthy publications, and data shared with valid individual authorization. The FTC and state attorneys general gain enforcement authority with civil penalties up to 15% of a company's annual revenue, and individuals can sue directly. The bill funds the FTC with $1 billion through 2035 to implement and enforce these rules.

Why we flagged it

The bill's core function is to restrict the commercial trade in sensitive personal data (health and location) and empower enforcement against violators. It is a straightforward privacy-protection measure, not a tax provision, subsidy, or deregulation.

What the text implies

• The FTC's authority to define 'data' and identify additional sensitive categories (via rulemaking within 180 days) gives the agency significant discretion to expand the scope of protected information beyond health and location, potentially affecting other sensitive categories like financial or biometric data.
• The 15% revenue penalty applies to the 'ultimate parent entity,' meaning a small subsidiary of a large conglomerate could trigger penalties based on the parent's total revenue—potentially creating outsized liability and incentivizing corporate restructuring.

The full analysis lists 5 implications of this text.

Who stands to gain

privacy-focused technology vendors; cybersecurity and compliance software providers; law firms specializing in privacy litigation