# Health and Location Data Protection Act of 2024

This bill would ban data brokers—companies that buy, sell, and trade personal information—from selling your health and location data. Right now, these companies operate in a largely unregulated space, collecting information about where you go and what health conditions you might have, then selling it to advertisers, insurers, employers, and other buyers. This bill would make that practice illegal.

The ban covers any health information that reveals or describes your medical conditions, treatments, disabilities, pregnancies, or even your searches for health services. It also covers location data that shows where you are or where you've been. The key thing is that this applies whether the data broker directly collected this information or simply inferred it from other data—for example, if they figure out you have diabetes based on your web searches and pharmacy visits, that counts too. The prohibition would take effect either 180 days after the law passes or whenever the Federal Trade Commission issues final rules, whichever comes first.

There are a few exceptions built in. If you explicitly give permission for your data to be shared, that's allowed. Health information shared by doctors, hospitals, and insurance companies following existing privacy rules (HIPAA) can still be shared as it is now. And news organizations can still publish newsworthy information about public figures or matters of legitimate public concern. The law also lets the FTC identify other types of data that reveal health or location information and add them to the ban.

To enforce this, the bill gives the Federal Trade Commission power to sue violators and seek penalties up to 15 percent of a company's annual revenue, plus damages and forced deletion of the data. State attorneys general can also sue on behalf of their residents, and individual people can bring their own lawsuits. The bill provides $1 billion in funding to the FTC through 2034 to carry out this work. Violations can be prosecuted up to six years after someone discovers the illegal activity took place.