Health and Location Data Protection Act of 2026

The Health and Location Data Protection Act of 2026 prohibits data brokers from buying, selling, or sharing specific types of personal information, including an individual's health data and location history. This ban applies to any entity that resells data it did not collect directly from the person, though it allows exceptions for actions compliant with existing HIPAA rules, newsworthy reporting, and disclosures where the individual has given valid consent. The Federal Trade Commission is tasked with defining exactly what counts as "data" and issuing final rules within 180 days of the law's enactment. Violations of these restrictions can lead to enforcement actions by the FTC, state attorneys general, or private individuals, potentially resulting in civil penalties of up to 15 percent of the violator's annual revenue. The legislation also includes a funding provision that appropriates $1 billion to the FTC for fiscal year 2027 to support its work under this act.