Health and Location Data Protection

Full Title:
Health and Location Data Protection Act of 2026

Summary#

This bill makes it illegal for data brokers to sell, share, license, or otherwise provide location data and health data about individuals. It also makes it illegal for anyone to sell those kinds of data to data brokers. The Federal Trade Commission (FTC) must write rules to carry out the law and must issue a final rule within 180 days of enactment. The ban starts on the earlier of the FTC final rule or 180 days after enactment.

The bill defines key terms. "Data broker" means an entity that sells or shares data about people that it did not collect directly from them, subject to listed exclusions. "Health data" includes searches for, attempts to obtain, or receipt of health information or services; physical or mental health conditions (including pregnancy and miscarriage); and related treatment or diagnosis. "Location data" means data that can show a person’s past or present physical location or the location of their device. The FTC must also define "data" to include information linked or reasonably linkable to individuals or to groups sharing a residence or IP address.

There are exceptions for HIPAA-compliant actions by covered entities or business associates, publication of newsworthy information of legitimate public concern, and disclosures made with a valid authorization (as defined in current HIPAA rules, adapted as needed).

Enforcement is by the FTC (treating violations as unfair or deceptive acts), State attorneys general, and private parties. Remedies include injunctions, deletion of relevant information, damages, restitution, disgorgement, civil penalties, and other equitable relief. The bill sets a civil penalty of up to 15 percent of the violating entity’s ultimate parent entity revenue for the prior 12 months. The statute of limitations is 6 years after a plaintiff learns of the facts giving rise to the violation. The bill also appropriates funds to the FTC for implementation.

What it means for you#

  • If a company is a data broker, it would no longer be allowed to sell or share your location data or health data.
  • Companies and people could not sell those types of data to data brokers.
  • Your health and location information could still be used or shared in ways allowed under HIPAA, if the actor is a HIPAA-covered entity or business associate and the action is HIPAA-compliant.
  • News organizations could still publish newsworthy information of legitimate public concern.
  • You can still authorize a disclosure. A valid authorization under current HIPAA rules, as adapted by the FTC, allows disclosure.
  • If your data is wrongly sold or shared in violation of the bill, the FTC, your State attorney general, or you (as a private plaintiff) could seek court orders, deletion of data, and monetary relief.

Expenses#

  • The bill appropriates $1,000,000,000 to the Federal Trade Commission for fiscal year 2027, available until September 30, 2035, for carrying out the Commission’s work under this Act.
  • The bill imposes a civil penalty for violations of up to 15 percent of the revenues earned by the violator's ultimate parent entity during the previous 12-month period.
  • No publicly available information on other costs, savings, or budget estimates is included in the bill text.

Proponents' View#

No publicly available information.

Opponents' View#

No publicly available information.