Congress bans the sale of your health and location data—with teeth.

What it does

This bill prohibits data brokers from buying, selling, or sharing health data and location data about individuals, with narrow exceptions for HIPAA-compliant medical uses, newsworthy information, and authorized disclosures. It empowers the Federal Trade Commission, state attorneys general, and private citizens to sue violators, with penalties up to 15% of a company's annual revenue, and provides $1 billion in funding to the FTC to enforce the rules.

Why we flagged it

The bill's core function is to restrict commercial data flows and create enforcement tools to protect individuals from unwanted surveillance capitalism. It is fundamentally a privacy-rights measure, not a market-manipulation or narrow-interest carve-out.

What the text implies

• The FTC's 180-day rulemaking deadline may create ambiguity about what counts as 'health data' or 'location data' during the interim period, potentially allowing continued sales until final rules are published.
• The 'valid authorization' exception references HIPAA regulations (45 CFR 164.508) but applies to non-HIPAA entities; the FTC's adaptation of this standard could create loopholes if interpreted permissively.
• Private right of action with 6-year statute of limitations may generate significant litigation against data brokers, potentially raising compliance costs that could be passed to consumers through higher service fees.
• The preemption clause is narrowly tailored to prohibit only state laws that 'require disclosure' of the banned data, leaving room for state laws that impose additional restrictions—creating a patchwork of state-level rules.
• The $1 billion appropriation through 2035 is substantial but may be insufficient if enforcement requires sustained litigation against well-resourced data brokers and tech platforms.

Who it affects

Ordinary people gain meaningful privacy protections against the commercial exploitation of their most sensitive personal information—health conditions and physical location—which are currently bought and sold without consent. The broad enforcement mechanisms (FTC, states, private lawsuits) and substantial penalties create real deterrence, though the exceptions for HIPAA entities and authorized disclosures preserve legitimate medical and consensual uses.

Who stands to gain

• privacy-focused technology vendors
• cybersecurity and compliance consulting firms
• law firms specializing in consumer protection litigation

Named in the bill

Federal Trade Commission (FTC), data brokers, health information entities, HIPAA covered entities, state attorneys general, National Artificial Intelligence Initiative Act of 2020, Health Insurance Portability and Accountability Act (HIPAA)

Where it stands

4 cosponsors: 3 Democrats, 1 Independents.

• Jul 13, 2026 — Introduced · Congress.gov: “Introduced in Senate”
• Jul 13, 2026 — Referred to Senate Committee on Commerce, Science, and Transportation · Congress.gov: “Read twice and referred to the Committee on Commerce, Science, and Transportation”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.