Sponsors (9)
The bill substantially strengthens consumer privacy for location and sensitive health data and arms the FTC with funding and enforcement tools to stop data broker abuses, but it also imposes significant compliance costs, legal risks, and enforcement-related due-process concerns for businesses and could limit some beneficial data uses.
Individuals (including immigrants, low-income people, and people with disabilities) gain stronger privacy protections because the bill bans data brokers from selling location and sensitive health-related data, reducing exposure to stalking, discrimination, and other targeted harms.
People with sensitive health concerns (including pregnant women and those with chronic conditions) get clearer and explicit protections because searches and information about conditions, pregnancy, and miscarriage are treated as health data and HIPAA-authorized uses are preserved.
Consumers and harmed individuals gain stronger enforcement and private remedies because the FTC, state attorneys general, and private plaintiffs can seek injunctions, deletion orders, damages, and civil penalties.
Data brokers, analytics firms, and companies that buy or sell location/health-adjacent data will lose revenue and face potentially substantial compliance costs, with small businesses and nonprofits disproportionately affected.
Companies face large financial risk from fines (up to 15% of parent company revenues) and an extended 6-year statute of limitations, increasing exposure to costly enforcement and litigation.
Broad or ambiguous definitions (e.g., of 'data', 'artificial intelligence system', linking by IP or residence, and group-level data) could sweep in benign or aggregated datasets and AI systems, increasing compliance complexity and costs that may be passed to consumers.
Based on analysis of 5 sections of legislative text.
Bans data brokers from selling or receiving individuals’ location and health data, creates FTC rulemaking and enforcement authority, private lawsuits, and funds the FTC $1B for enforcement.
Official title: To prohibit data brokers from selling and transferring certain sensitive data.
Introduced June 25, 2026 by Mary Gay Scanlon · Last progress June 25, 2026
Prohibits data brokers from selling, licensing, transferring, or otherwise providing any individual's location data, health data, or other FTC‑identified categories that reveal location or health, and makes it unlawful for anyone to provide those categories to a data broker. Sets definitions for covered data and data brokers, creates enforcement tools (FTC civil actions, state parens patriae suits, and a private right of action), authorizes large civil penalties tied to corporate revenues, and appropriates $1 billion to the Federal Trade Commission for implementation and enforcement. Requires the FTC to issue final regulations within 180 days (the prohibition takes effect at the earlier of the final rule or 180 days), establishes remedies including deletion and damages, assigns exclusive venue in D.C. Circuit, and preserves certain HIPAA and news/public‑interest exceptions while narrowly limiting preemption of state law only where state law would force disclosure prohibited by this Act.