PRIA Logo™
119-s-4946119th CongressWALLET

Health and Location Data Protection Act of 2026

Sponsored By: Senator Warren, Elizabeth [D-MA]

Introduced

Summary

Prohibits data brokers from selling individuals' health and location data. The bill would block both sales by data brokers and sales to them, set HIPAA and news reporting exceptions, and create wide enforcement tools and funding to implement the rule.

Show full summary
  • Families and individuals: stronger privacy for health and location information and new private legal rights to seek injunctions, damages, restitution, and attorneys' fees.
  • Data brokers and other businesses: barred from selling covered location and health data, subject to civil penalties capped at 15% of the violator's ultimate parent company's prior 12-month revenue, with specific exclusions for HIPAA-covered uses and public news sources.
  • Enforcement and government: the Federal Trade Commission would enforce the rule with powers like injunctions, penalties, and data-deletion orders, state attorneys general could sue on behalf of residents, and private parties could bring federal actions. The bill would also authorize $1.0 billion for the FTC in fiscal year 2027 to carry out enforcement and rulemaking.

*Would authorize $1.0 billion in funding for the Federal Trade Commission in FY2027, increasing federal spending.*

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

4 provisions identified: 3 benefits, 0 costs, 1 mixed.

Ban on selling health and location data

This bill would make it unlawful for data brokers to sell or share people's location or health information. Health data would include searches, treatment details, AI prompts, and pregnancy or miscarriage information. The ban would cover data that is declared or inferred and would let the FTC add other covered types. The bill would still allow sharing with a valid authorization, HIPAA-permitted uses, and news reporting.

FTC rulemaking and $1 billion funding

The FTC would have to write rules defining the term "data" and finish a final rule within 180 days after enactment. The definition would include information linked or reasonably linkable to a person or to groups who share a residence or IP address. The bill would also appropriate $1 billion to the FTC for fiscal year 2027, available until September 30, 2035, to carry out this work.

New enforcement powers and private lawsuits

This bill would let the FTC treat violations as unfair or deceptive acts and use its full enforcement powers, including seeking deletion, injunctions, fines, refunds, and disgorgement. It would also let people sue in federal court and let State attorneys general bring parens patriae actions for residents. Civil penalties could not exceed 15 percent of the violator's ultimate parent company's prior 12-month revenue. You would generally have six years from when you learn the facts to file a suit.

Limited preemption of state privacy laws

This bill would only block state or local laws that require disclosures the Act forbids. Other state and local privacy and disclosure laws would remain in effect.

Sponsors & CoSponsors

Sponsor

Warren, Elizabeth [D-MA]

MA • D

Cosponsors

  • Sen. Sanders, Bernard [I-VT]

    VT • I

    Sponsored 7/13/2026

  • Sen. Whitehouse, Sheldon [D-RI]

    RI • D

    Sponsored 7/13/2026

  • Sen. Wyden, Ron [D-OR]

    OR • D

    Sponsored 7/13/2026

  • Sen. Merkley, Jeff [D-OR]

    OR • D

    Sponsored 7/29/2026

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation