H.R. 9482: Health and Location Data Protection Act of 2026

This bill would make it unlawful for data brokers to sell, share, license, trade, transfer, or otherwise provide certain sensitive information about individuals. The main categories covered are:

• Location data — information that can show where a person or their device has been.
• Health data — information that reveals or describes a person’s health conditions, disabilities, pregnancy, miscarriage, treatment, diagnosis, or searches for health services or supplies.
• Other related data — any additional categories the Federal Trade Commission (FTC) identifies that reveal or relate to location or health data.

The bill also bans other people and companies from selling or transferring that same type of data to data brokers.

Who counts as a data broker

In general, a data broker is an entity that, for payment, makes available data about individuals that it did not collect directly from those individuals. The bill excludes some entities and activities, including:

• transmitting data at a person’s request;
• offering a product or service where sensitive data is not the product itself;
• news reporting and publication of matters of public interest;
• making available information that is already publicly available.

Exceptions

The bill would not block certain disclosures in limited situations, including:

• HIPAA-compliant health information uses by covered entities or business associates;
• newsworthy information of legitimate public concern;
• disclosures made with valid authorization from the individual, as defined by existing federal health privacy rules and adapted for location and health data.

FTC rules and enforcement

The FTC would be required to write rules to implement the law, including defining “data” for purposes of the bill. The FTC could also issue further guidance about what kinds of data are covered.

Violations would be treated as unfair or deceptive acts or practices under federal law. The FTC could seek court orders to stop violations, require compliance, delete relevant information, and obtain civil penalties, damages, restitution, disgorgement, or other relief. State attorneys general and private individuals who are affected could also bring lawsuits, subject to the bill’s rules on venue and notice.

Penalties and court process

A violation could carry a civil penalty of up to 15% of the revenues earned by the person’s ultimate parent entity in the previous 12 months. The bill also sets specific federal courts for cases under the law and gives the D.C. Circuit exclusive jurisdiction over appeals.

Timing and federal funding

The main prohibition would take effect on the earlier of:

• the date the FTC finalizes its rule, or
• 180 days after enactment.

The bill would also provide $1 billion to the FTC for fiscal year 2027, available through September 30, 2035, to carry out the work.

Preemption

The bill would override only state or local laws that require disclosures this bill forbids. It would not broadly replace other state privacy laws.

Relevant Companies

None found.