Health and Location Data Protection Act of 2026

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 9482 Introduced in House (IH)]

<DOC>

119th CONGRESS
  2d Session
                                H. R. 9482

    To prohibit data brokers from selling and transferring certain
                            sensitive data.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                             June 25, 2026

 Ms. Scanlon (for herself, Ms. Velazquez, Mr. Espaillat, Ms. Jayapal,
and Ms. Tlaib) introduced the following bill; which was referred to the
                    Committee on Energy and Commerce

_______________________________________________________________________

                                 A BILL

    To prohibit data brokers from selling and transferring certain
                            sensitive data.

    Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Health and Location Data Protection
Act of 2026''.

SEC. 2. UNFAIR AND DECEPTIVE ACTS AND PRACTICES RELATING TO HEALTH AND
              LOCATION DATA.

    (a) Prohibition on Sale by Data Brokers.--It shall be unlawful for
a data broker to sell, resell, license, trade, transfer, share, or
otherwise provide or make available any of the following forms of data,
whether declared or inferred, of an individual:
            (1) Location data.
            (2) Health data.
            (3) Other categories of data identified by the Commission
        that address or reveal a category of data described in
        paragraphs (1) and (2).
    (b) Prohibition on Sale to Data Brokers.--It shall be unlawful for
any person to sell, resell, license, trade, transfer, share, or
otherwise provide or make available to a data broker any of the
following forms of data, whether declared or inferred, of an
individual:
            (1) Location data.
            (2) Health data.
            (3) Other categories of data identified by the Commission
        that address or reveal a category of data described in
        paragraphs (1) and (2).
    (c) Exceptions.--
            (1) Actions that are hipaa-compliant.--
                    (A) In general.--Nothing in this Act shall be
                construed to prohibit any action taken with respect to
                the health information of an individual by a data
                broker acting in its capacity as a business associate
                or covered entity, that is permissible under the
                Federal regulations concerning standards for privacy of
                individually identifiable health information
                promulgated under section 264(c) of the Health
                Insurance Portability and Accountability Act of 1996
                (42 U.S.C. 1320d-2 note).
                    (B) Application of terms.--In paragraph (1), the
                terms ``business associate'', ``covered entity'', and
                ``health information'' shall have the meaning given
                those terms in the Federal regulations specified in
                such paragraph.
            (2) Publication of newsworthy information of legitimate
        public concern.--Nothing in this Act shall be construed to
        prohibit the publication of newsworthy information of
        legitimate public concern.
            (3) Disclosure pursuant to valid authorization.--Nothing in
        this Act shall be construed to prohibit a disclosure of the
        data of an individual for which the individual provides valid
        authorization. For purposes of this paragraph, the term ``valid
        authorization'' has the meaning given such term in section
        164.508 of title 45, Code of Federal Regulations (or a
        successor regulation), subject to such adaptations as the
        Commission shall deem necessary to apply such term to the
        disclosure of both location data and health data.
    (d) Effective Date.--The prohibition under subsection (a) shall
take effect on the earlier of--
            (1) the date the Commission issues the final rule under
        subsection (e); or
            (2) 180 days after the date of enactment of this Act.
    (e) Rulemaking.--
            (1) Final rule.--Pursuant to section 553 of title 5, United
        States Code, the Commission shall promulgate regulations to
        carry out the provisions of this Act. The Commission shall
        issue a final rule by not later than 180 days after the date of
        enactment of this Act.
            (2) Additional guidance.--Pursuant to section 553 of title
        5, United States Code, the Commission may promulgate further
        regulations to carry out the provisions of this Act, including
        further guidance regarding the types of data described in
        subsection (a).

SEC. 3. ENFORCEMENT.

    (a) Enforcement by the Federal Trade Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of
        section 2 shall be treated as a violation of a rule defining an
        unfair or a deceptive act or practice under section 18(a)(1)(B)
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of commission.--
                    (A) In general.--Except as provided in
                subparagraphs (D) and (E), the Commission shall enforce
                section 2 in the same manner, by the same means, and
                with the same jurisdiction, powers, and duties as
                though all applicable terms and provisions of the
                Federal Trade Commission Act (15 U.S.C. 41 et seq.)
                were incorporated into and made a part of this Act.
                    (B) Privileges and immunities.--Any person who
                violates section 2 shall be subject to the penalties
                and entitled to the privileges and immunities provided
                in the Federal Trade Commission Act (15 U.S.C. 41 et
                seq.).
                    (C) Authority preserved.--Nothing in this Act shall
                be construed to limit the authority of the Federal
                Trade Commission under any other provision of law.
                    (D) Nonprofit organizations.--Notwithstanding
                section 4 of the Federal Trade Commission Act (15
                U.S.C. 44) or any jurisdictional limitation of the
                Commission, the Commission shall also enforce this Act,
                in the same manner provided in subparagraphs (A) and
                (B), with respect to organizations not organized to
                carry on business for their own profit or that of their
                members.
                    (E) Independent litigation authority.--In any case
                in which the Commission has reason to believe that a
                person is violating or has violated section 2, the
                Commission may bring a civil action in an appropriate
                district court of the United States to--
                            (i) enjoin any further such violation by
                        such person;
                            (ii) enforce compliance with this Act,
                        including through deletion of the relevant
                        information;
                            (iii) obtain a permanent, temporary, or
                        preliminary injunction;
                            (iv) obtain civil penalties;
                            (v) obtain damages (whether actual,
                        punitive, or otherwise), restitution,
                        disgorgement of unjust enrichment, or other
                        compensation on behalf of aggrieved persons; or
                            (vi) obtain any other appropriate equitable
                        relief.
    (b) Enforcement by States.--
            (1) In general.--In any case in which the attorney general
        of a State has reason to believe that an interest of the
        residents of the State has been or is threatened or adversely
        affected by the engagement of any person subject to section 2
        in a practice that violates such section, the attorney general
        of the State may, as parens patriae, bring a civil action on
        behalf of the residents of the State in an appropriate district
        court of the United States to--
                    (A) enjoin any further such violation by such
                person;
                    (B) enforce compliance with this Act, including
                through deletion of the relevant information;
                    (C) obtain a permanent, temporary, or preliminary
                injunction;
                    (D) obtain civil penalties;
                    (E) obtain damages (whether actual, punitive, or
                otherwise), restitution, disgorgement of unjust
                enrichment, or other compensation on behalf of
                aggrieved persons; or
                    (F) obtain any other appropriate equitable relief.
            (2) Notice.--Before filing an action under paragraph (1),
        the attorney general, official, or agency of the State involved
        shall provide to the Commission a written notice of such action
        and a copy of the complaint for such action. If the attorney
        general, official, or agency determines that it is not feasible
        to provide the notice described in this paragraph before the
        filing of the action, the attorney general, official, or agency
        shall provide written notice of the action and a copy of the
        complaint to the Commission immediately upon the filing of the
        action.
            (3) Limitation on state action while federal action is
        pending.--If the Commission has instituted a civil action for a
        violation of section 2, no State attorney general, or official
        or agency of a State, may bring an action under this paragraph
        during the pendency of that action against any defendant named
        in the complaint of the Commission for any violation of section
        2 alleged in the complaint.
            (4) Relationship with state-law claims.--If the attorney
        general of a State has authority to bring an action under State
        law directed at acts or practices that also violate section 2,
        the attorney general may assert the State-law claim and a claim
        under section 2 in the same civil action.
            (5) Investigatory powers.--Nothing in this subsection may
        be construed to prevent the attorney general of a State from
        exercising the powers conferred on the attorney general by the
        laws of the State to conduct investigations, to administer
        oaths or affirmations, or to compel the attendance of witnesses
        or the production of documentary or other evidence.
    (c) Private Enforcement.--Any person whose interest has been or is
threatened or adversely affected by the engagement of any person
subject to section 2 in a practice that violates such section may bring
a civil action in an appropriate district court of the United States
to--
            (1) enjoin any further such violation by such person;
            (2) enforce compliance with this Act, including through
        deletion of the relevant information;
            (3) obtain a permanent, temporary, or preliminary
        injunction;
            (4) obtain damages (whether actual, punitive, or
        otherwise), restitution, or other compensation;
            (5) obtain reasonable attorney's fees, including litigation
        expenses, and costs; or
            (6) obtain any other appropriate equitable relief.
    (d) Civil Penalties.--In addition to any other penalties as may be
prescribed by law, a violation of this Act shall carry a civil penalty
not to exceed 15 percent of the revenues earned by the person's
ultimate parent entity during the preceding 12-month period.
    (e) Exclusive Jurisdiction.--
            (1) District courts.--For any action brought under this
        Act, the following district courts shall have exclusive
        jurisdiction:
                    (A) For actions brought by the Commission, the
                United States District Court for the District of
                Columbia.
                    (B) For actions brought by a State attorney
                general, the district court of the United States for
                the judicial district in which the capital of the State
                is located.
                    (C) For private actions brought by persons--
                            (i) the United States District Court for
                        the District of Columbia; or
                            (ii) the district court of the United
                        States for the judicial district in which the
                        violation took place or in which any defendant
                        resides or does business.
            (2) Court of appeals.--The United States Court of Appeals
        for the District of Columbia Circuit shall have exclusive
        jurisdiction of appeals from all decisions under paragraph (1).
    (f) Statute of Limitations.--A proceeding for a violation of this
Act may be commenced not later than 6 years after the date upon which
the plaintiff obtains actual knowledge of the facts giving rise to such
violation.
    (g) Preemption.--The provisions of this Act preempt only the
provisions of State or local law that require disclosure prohibited by
this Act.

SEC. 4. DEFINITIONS.

    In this Act:
            (1) Artificial intelligence.--The term ``artificial
        intelligence'' has the meaning given such term in section 5002
        of the National Artificial Intelligence Initiative Act of 2020
        (15 U.S.C. 9401).
            (2) Artificial intelligence system.--The term ``artificial
        intelligence system'' means any data system, software,
        hardware, application, tool, or utility that operates in whole
        or in part using artificial intelligence.
            (3) Commission.--The term ``Commission'' means the Federal
        Trade Commission.
            (4) Data.--
                    (A) In general.--Not later than 180 days after the
                date of enactment of this Act, the Commission shall
                adopt rules in accordance with section 553 of title 5,
                United States Code, to define the term ``data'' for the
                purpose of implementing and enforcing this Act.
                    (B) Requirement.--The term ``data'' shall include
                information that is linked, or reasonably linkable,
                to--
                            (i) specific individuals; or
                            (ii) specific groups of individuals who
                        share the same place of residence or internet
                        protocol address.
            (5) Data broker.--
                    (A) In general.--The term ``data broker'' means an
                entity that, for valuable consideration, sells,
                licenses, rents, trades, transfers, releases,
                discloses, provides access to, or otherwise makes
                available data of individuals that the entity did not
                collect directly from such individuals to another
                entity.
                    (B) Exclusion.--The term ``data broker'' does not
                include an entity to the extent such entity--
                            (i) is transmitting data of an individual,
                        including communications of such an individual,
                        at the request or direction of such individual;
                            (ii) is providing, maintaining, or offering
                        a product or service with respect to which
                        personally identifiable sensitive data, or
                        access to such data, is not the product or
                        service;
                            (iii) is reporting or publishing news or
                        information that concerns local, national, or
                        international events or other matters of public
                        interest; or
                            (iv) is reporting, publishing, or otherwise
                        making available news or information that is
                        available to the general public;
                                    (I) including information from--
                                            (aa) a book, magazine,
                                        telephone book, or online
                                        directory;
                                            (bb) a motion picture;
                                            (cc) a television,
                                        internet, or radio program;
                                            (dd) the news media; or
                                            (ee) an internet site that
                                        is available to the general
                                        public on an unrestricted
                                        basis; and
                                    (II) not including an obscene
                                visual depiction (as such term is used
                                in section 1460 of title 18, United
                                States Code).
            (6) Health data.--The term ``health data'' means data that
        reveal or describe--
                    (A) the search for, attempt to obtain, inquiry
                regarding, or receipt of any health information,
                services, or supplies, including through prompts or
                other information entered into an artificial
                intelligence system;
                    (B) any past, present, or future disability,
                physical health condition, mental health condition, or
                health condition of an individual, including, but not
                limited to, pregnancy and miscarriage; or
                    (C) any treatment or diagnosis of a disability or
                condition described in subparagraph (B).
            (7) Location data.--The term ``location data'' means data
        capable of determining the past or present physical location of
        an individual or an individual's device.
            (8) State.--The term ``State'' means each of the several
        States, the District of Columbia, each commonwealth, territory,
        or possession of the United States, and each federally
        recognized Indian Tribe.
            (9) Ultimate parent entity.--The term ``ultimate parent
        entity'' has the meaning given the term in section 801.1 of
        title 16, Code of Federal Regulations (or any successor
        regulation).

SEC. 5. FUNDING.

    In addition to amounts otherwise available, there is appropriated
to the Commission for fiscal year 2027, out of any money in the
Treasury not otherwise appropriated, $1,000,000,000, to remain
available until September 30, 2035, for carrying out the work of the
Commission.
                                 <all>