New Privacy Rules Prohibit Data Brokers From Selling Your Health and Location History Starting in 2026

The Health and Location Data Protection Act of 2026 is a direct hit on the multibillion-dollar industry that trades your most personal digital footprints. The bill makes it flat-out illegal for data brokers—those behind-the-scenes companies that buy and sell your info—to trade, license, or share your location and health data. This isn't just about your GPS coordinates; it covers everything from your pregnancy status and mental health inquiries to the prompts you type into an AI health bot. If a broker didn't collect the data directly from you, they can no longer treat it like a commodity to be auctioned off to the highest bidder.

Putting a Padlock on Your Digital Paper Trail

Under this bill, the days of companies quietly profiting from your visit to a physical therapy clinic or a reproductive health center are numbered. For example, if you’re a construction worker managing a chronic back injury, apps you use to track your symptoms or the GPS data from your phone can no longer be bundled and sold to insurance companies or advertisers by a third-party broker. The law also cuts off the supply chain: it’s not just illegal for brokers to sell this stuff; it’s also illegal for other companies to provide it to them in the first place. The FTC has 180 days to finalize the technical definitions, but the core message is clear: your sensitive movements and medical curiosities are off-limits for trade.

The Fine Print and the Exceptions

Of course, there are some common-sense loopholes. Doctors and hospitals can still share your info for actual medical care under existing HIPAA rules, and news organizations can still publish information of public interest. You can also still choose to share your own data if you give "valid authorization." Think of it like a digital "opt-in" rather than the current system where your data is often gone before you even know it was collected. However, the bill leaves some room for the FTC to decide exactly what counts as "data" and "newsworthy," which means the specifics of what stays private might shift as the government writes the final rulebook.

Real Teeth and Big Checks

This bill doesn't just ask nicely; it brings a heavy hammer. If a data broker gets caught selling your location history, they could be hit with a civil penalty of up to 15% of their parent company’s entire annual revenue. To make sure someone is actually watching the store, the bill hands the FTC a $1 billion budget boost to handle enforcement through 2035. Most importantly for you, this isn't just a government-only fight. If you find out a broker has illegally traded your sensitive data, the bill gives you the right to sue them directly in federal court for damages and attorney fees. It’s a rare move that puts the power to enforce privacy directly into the hands of the people being tracked.