The legislation would require the Federal Trade Commission to issue implementing rules within 180 days of enactment and would allocate $1 billion to the agency over 10 years for enforcement. The FTC, state attorneys general and affected individuals would all be able to pursue enforcement actions under the proposal.
The original version of the Health and Location Data Protection Act was introduced in June 2022 and focused on limiting data brokers’ collection and sale of health and location information. According to Congress.gov, a Senate version, S.5462, was introduced on December 10, 2024, and GovTrack records that it did not advance during the previous Congress.
The updated bill reflects how AI chatbots have become a new source of sensitive consumer data. Users increasingly upload medical records, imaging scans, lab results and health-related questions into AI systems, creating detailed records that extend beyond what many traditional health applications collect.
The proposal comes as AI companies continue expanding healthcare-focused products. Earlier this year, Elon Musk encouraged users to upload medical records to xAI’s Grok. OpenAI introduced ChatGPT Health, a dedicated area within ChatGPT designed for medical record uploads, alongside ChatGPT for Healthcare for providers. Anthropic also released Claude for Healthcare, which it positioned as a HIPAA-ready offering for individuals, healthcare organizations and hospitals.
Supporters of the legislation argue that existing protections for chatbot users are largely governed by company privacy policies rather than comprehensive federal law. The bill seeks to establish legal restrictions on how health and location data can be sold after it has been collected.
The proposal is co-sponsored by Senators Ron Wyden (D-OR) and Bernie Sanders (I-VT). Warren has framed the legislation around limiting the data broker market that purchases and resells sensitive consumer information.
If enacted, the legislation could require companies handling consumer health and location information to strengthen data governance practices and review how those datasets are shared with third parties. Organizations developing AI products that process sensitive user information could also face additional compliance obligations as the FTC develops implementing regulations.
The proposal still faces the legislative process before becoming law. No vote has been scheduled, and Congress has repeatedly failed to pass comprehensive federal privacy legislation in recent years. Industry observers will be watching the final bill language, including how it defines covered health and location data, the scope of any exemptions, and the enforcement framework established for companies that collect or process sensitive consumer information.
This analysis is based on reporting from Let's Data Science.
Image courtesy of Stephen Lam / Reuters file.
This article was generated with AI assistance and reviewed for accuracy and quality.
