Health and Location Data Protection Act of 2026
- Bill Number
- H.R. 9482
- Origin Chamber
- House
- Congress
- 119th Congress, Session 2
- Policy Area
- Commerce
- Status
- Introduced
- Latest Action
- 2026-06-25: Referred to the House Committee on Energy and Commerce.
- Last Updated
- 2026-07-08T21:58:15Z
AI-Generated Summary
Health and Location Data Protection Act of 2026
Purpose This legislation aims to restrict the commercial sale and transfer of sensitive personal information by prohibiting data brokers from handling location data and health data of individuals.
Key Provisions
- Prohibitions: Data brokers are barred from selling, reselling, licensing, trading, transferring, sharing, or making available location data, health data, or related categories identified by the Federal Trade Commission (FTC). Any person is also prohibited from providing such data to data brokers.
- Exceptions: Actions compliant with HIPAA regulations for health information are permitted. Publication of newsworthy information of public concern is allowed. Disclosures with valid individual authorization are exempt.
- Rulemaking and Timing: The FTC must issue a final rule within 180 days of enactment. The main prohibitions take effect on the earlier of the final rule date or 180 days after enactment.
- Enforcement: The FTC treats violations as unfair or deceptive acts. States may sue as parens patriae, and individuals have a private right of action. Remedies include injunctions, deletion of data, civil penalties, damages, restitution, and attorney fees.
- Penalties: Civil penalties may reach 15% of the revenues of the violator’s ultimate parent entity over the prior 12 months.
- Jurisdiction and Limits: Exclusive jurisdiction lies with specific federal district courts (e.g., D.C. District Court for FTC actions) and appeals go to the D.C. Circuit. Actions must commence within 6 years of discovering the violation. The law preempts only state or local rules requiring prohibited disclosures.
- Funding: The FTC receives $1 billion for fiscal year 2027 through September 30, 2035.
Significant Changes to Existing Law The bill creates new federal restrictions on data brokers specifically targeting health and location data, expanding beyond prior FTC authority under the Federal Trade Commission Act. It introduces a private right of action, broad remedies including data deletion, and a high revenue-based penalty structure not previously applied in this context. Definitions for "data broker," "health data," and "location data" are newly codified, with the FTC directed to further define "data."
Potential Impacts
- Government Agencies: The FTC gains expanded enforcement duties, rulemaking authority, and substantial new funding; state attorneys general receive concurrent enforcement powers.
- Citizens: Individuals gain stronger protections against unauthorized commercialization of sensitive personal information, with options for private lawsuits.
- International Relations: The prohibitions may affect cross-border data transfers involving U.S. data brokers or recipients, though no explicit international provisions are included.
Main Stakeholders Affected
- Data brokers and entities that sell or transfer data to them.
- Healthcare providers, tech companies, and organizations handling location or health information.
- Consumers and individuals whose data is involved.
- The FTC and state attorneys general.
- Courts handling enforcement actions.
Notable Legal, Constitutional, or Political Implications The bill grants the FTC independent litigation authority and nonprofit enforcement reach. Exclusive federal jurisdiction and a long statute of limitations centralize oversight. Preemption is narrowly tailored. The inclusion of artificial intelligence references in definitions may extend reach to AI-driven data processing, while HIPAA and authorization exceptions preserve certain existing frameworks.
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Rep. Scanlon, Mary Gay [D-PA-5]
Cosponsors (5)
Rep. Velázquez, Nydia M. [D-NY-7], Rep. Espaillat, Adriano [D-NY-13], Rep. Jayapal, Pramila [D-WA-7], Rep. Tlaib, Rashida [D-MI-12], Rep. Beatty, Joyce [D-OH-3]
Recent Actions
- 2026-06-25: Referred to the House Committee on Energy and Commerce.
- 2026-06-25: Introduced in House
- 2026-06-25: Introduced in House
Bill Versions
- Health and Location Data Protection Act of 2026 — issued 2026-06-25 — PDF (15 pages)