This bill, the Health and Location Data Protection Act of 2026, makes it illegal for data brokers to sell, license, trade, transfer, share, or otherwise provide certain sensitive information about people. The prohibited information includes location data and health data, whether the information is directly given or inferred. It is also unlawful for anyone to sell or provide that same information to a data broker.
The bill creates exceptions. It does not apply to actions that are allowed under HIPAA when a data broker is acting as a covered entity or business associate. It does not stop publication of newsworthy information of legitimate public concern. It also allows disclosures for which an individual gives a valid authorization (with the meaning taken from current HIPAA rules, adapted as needed).
The Federal Trade Commission (FTC) must write rules to carry out the Act and must issue a final rule within 180 days of enactment. The prohibition takes effect on the earlier of the date the FTC issues its final rule or 180 days after enactment.
The bill defines key terms, including "data," "data broker," "health data," and "location data." "Data" must include information linked or reasonably linkable to specific people or groups sharing a residence or IP address. A "data broker" is an entity that, for money or other consideration, makes available data about individuals that it did not collect directly, with several listed exclusions. "Health data" covers searches for or receipt of health services, physical or mental conditions, pregnancy and miscarriage, and related treatments. "Location data" covers data capable of determining a person’s or device’s past or present physical location.
No publicly available information.
No publicly available information.