Congress bans the sale of your health and location data—with teeth.
S. 4946 — Health and Location Data Protection Act of 2026 · Filed by Elizabeth Warren (D-MA) · 4 cosponsors · Introduced Jul 13, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill prohibits data brokers from buying, selling, or sharing health data and location data about individuals, with narrow exceptions for HIPAA-compliant medical uses, newsworthy information, and authorized disclosures. It empowers the Federal Trade Commission, state attorneys general, and private citizens to sue violators, with penalties up to 15% of a company's annual revenue, and provides $1 billion in funding to the FTC to enforce the rules.
Why we flagged it
The bill's core function is to restrict commercial data flows and create enforcement tools to protect individuals from unwanted surveillance capitalism. It is fundamentally a privacy-rights measure, not a market-manipulation or narrow-interest carve-out.
What the text implies
- The FTC's 180-day rulemaking deadline may create ambiguity about what counts as 'health data' or 'location data' during the interim period, potentially allowing continued sales until final rules are published.
- The 'valid authorization' exception references HIPAA regulations (45 CFR 164.508) but applies to non-HIPAA entities; the FTC's adaptation of this standard could create loopholes if interpreted permissively.
The full analysis lists 5 implications of this text.
Who stands to gain
privacy-focused technology vendors; cybersecurity and compliance consulting firms; law firms specializing in consumer protection litigation