Health and Location Data Protection Act of 2026

Protection of Sensitive Information: The bill prohibits data brokers from selling, licensing, or sharing an individual's location and health data, which prevents this private information from being traded (Section 2(a)).

Prevention of Data Collection: It is unlawful for any person to provide health or location data to a data broker, cutting off the supply of sensitive information to these entities (Section 2(b)).

Individual Legal Recourse: People whose interests are threatened or affected by violations can bring their own civil actions to stop violations, delete information, and obtain damages or attorney's fees (Section 3(c)).

Government Accountability: The Federal Trade Commission and state attorneys general are empowered to sue for injunctions, civil penalties, and compensation on behalf of aggrieved persons (Section 3(a) and 3(b)).

Strict Penalties for Companies: The act allows for civil penalties up to 15 percent of the ultimate parent entity's revenues, which serves as a strong deterrent against the sale of private data (Section 3(d)).

Limited Scope of Protections: The bill does not prohibit the sale of data by entities that do not meet the specific definition of a "data broker," such as those providing a product or service where sensitive data is not the primary product (Section 4(5)(B)).

Potential for Data Loss: While the bill allows for the "deletion of relevant information" during enforcement, it does not provide a mechanism for individuals to proactively manage or delete their data outside of a legal action (Section 3(a)(2)(ii) and 3(c)(2)).