Full bill text rendering is coming soon.
In the meantime, read the full text on Congress.gov ↗.
Regulatory or Legal Changes Top 4
Ban on data brokers selling health and location data
Prohibits data brokers from selling or sharing people's health and location data, and prohibits anyone from selling that data to data brokers. Creates new legal obligations for a major segment of the data industry. Directs the Federal Trade Commission (FTC) to write implementing rules within 180 days of enactment and grants authority to identify additional categories of covered data through future rulemaking, including defining the term 'data' itself.
- Population Scope High The prohibition directly binds every data broker operating in the U.S. and every entity that supplies them data — a commercially pervasive industry whose data practices affect a very large share of the American public.
- Budgetary Magnitude Low The prohibition and accompanying rulemaking mandate appropriate no funds and obligate no spending.
- Legal / Regulatory Depth High Creates new statutory prohibitions with binding legal effect across a major commercial sector, paired with a mandatory Federal Trade Commission (FTC) rulemaking authority to define the operative scope of those prohibitions.
- Degree of Discretion Granted High FTC receives broad delegated authority to define 'data' itself and to identify additional covered data categories through future rulemaking, giving the agency wide latitude to expand the prohibition's reach.
- Implementation & Enforcement Burden High Imposes an affirmative compliance obligation on an entire commercial sector and requires FTC to stand up a new regulatory regime — including rules and definitional standards — within 180 days.
- Temporal Commitment High The prohibition carries no expiry or reauthorization requirement and persists indefinitely until Congress acts to repeal or modify it.
No signal yet
Implementation & Enforcement Top 4
Multi-track enforcement: FTC, state AGs, private suits
Creates three enforcement paths — through the Federal Trade Commission (FTC), state attorneys general acting on behalf of residents, and private lawsuits by affected individuals — each with access to injunctions, damages, and other relief in federal court. Sets a ceiling on civil penalties for violations at 15% of the annual revenues of the violating entity's ultimate parent company, applicable on top of any other penalties authorized by law. Overrides state and local laws only where they would require disclosures that this Act prohibits, leaving all other state privacy and data protection laws in full force.
- Population Scope High Grants standing to any affected individual, all state attorneys general, and the Federal Trade Commission (FTC) — effectively making every U.S. resident a potential plaintiff and every state a potential enforcer against a nationwide industry.
- Budgetary Magnitude Medium The 15% of parent-entity revenue penalty ceiling creates substantial potential government recoveries, but the actual dollar impact is contingent on enforcement outcomes rather than a fixed appropriation.
- Legal / Regulatory Depth High Creates three new statutory causes of action — including a private right of action — and extends FTC jurisdiction to nonprofits, representing a fundamental expansion of enforceable legal rights and institutional authority.
- Degree of Discretion Granted Medium FTC retains prosecutorial discretion over which cases to bring and what relief to seek, while the revenue-based penalty formula and jurisdiction rules constrain the outer bounds of that discretion.
- Implementation & Enforcement Burden High Standing up three parallel enforcement tracks — each with its own procedural rules, venue requirements, and remedy options — creates recurring adjudicative infrastructure across FTC, state AG offices, and federal courts.
- Temporal Commitment High The enforcement framework carries no sunset or reauthorization requirement and persists indefinitely until Congress acts to modify or repeal it.
No signal yet
Funding / Appropriations Top 4
$1 billion FTC appropriation through FY2035
Appropriates $1 billion to the Federal Trade Commission (FTC) for fiscal year 2027, available through September 30, 2035, to carry out the agency's work under this Act — a one-time, multi-year funding boost outside the normal appropriations process.
- Population Scope Low Directly affects only the Federal Trade Commission (FTC) as an institution; any broader public benefit flows indirectly through the enforcement the funding enables.
- Budgetary Magnitude High Appropriates a one-time $1 billion to FTC — roughly an order of magnitude above the agency's typical annual budget — available through September 30, 2035.
- Legal / Regulatory Depth Low A standalone appropriation adds resources to carry out authorities created elsewhere in the Act; it does not itself change substantive or procedural law.
- Degree of Discretion Granted Medium Funds are restricted to FTC work under this Act but leave the agency discretion over how to allocate resources across rulemaking, enforcement, and operations within that constraint.
- Implementation & Enforcement Burden Low The appropriation funds enforcement capacity rather than imposing an enforcement obligation; it reduces rather than adds to implementation burden.
- Temporal Commitment Low Funds expire on September 30, 2035 — a hard end date within approximately nine years — self-terminating without any congressional action to extend them.
No signal yet
Carve-outs, Exemptions, Eligibility Top 4
Exceptions for HIPAA, news, and individual consent
Carves out from the data-sharing ban any actions allowed under federal health privacy rules, publication of newsworthy information in the public interest, and disclosures the individual has specifically authorized.
- Population Scope Medium Directly affects HIPAA-covered entities, news organizations, and individuals who authorize data sharing — a sizable but distinct subset of the overall regulated population, not the general public at large.
- Budgetary Magnitude Low The exceptions define the boundaries of a prohibition and impose no spending, appropriation, or financial obligation.
- Legal / Regulatory Depth Medium Carving out specific actors and circumstances from a statutory prohibition is a constraint on how existing law applies rather than a new substantive mandate — it narrows the prohibition's reach without creating independent duties or rights.
- Degree of Discretion Granted Low The exceptions track fixed external standards — existing HIPAA regulations and 45 CFR 164.508 — leaving no meaningful agency discretion to interpret or expand them.
- Implementation & Enforcement Burden Low Reduces rather than increases enforcement burden by narrowing the population subject to the prohibition's requirements.
- Temporal Commitment High The exceptions carry no expiry or reauthorization requirement and persist indefinitely alongside the underlying prohibition.
No signal yet
No possible riders have been surfaced for this bill.
Summary
This bill restricts how data brokers can use people's personal health and location information. It makes it illegal for data brokers to sell or share that data and also makes it illegal for anyone to sell that data to a data broker. Among other elements, the bill * bans data brokers from selling or sharing individuals' health and location data; * bans any person or company from selling health or location data to data brokers; * allows exceptions for actions permitted under federal health privacy law, journalism, and individual consent; * gives the Federal Trade Commission (FTC) authority and a funding boost to write rules and enforce the law; * creates three enforcement paths — through FTC, state attorneys general, and private lawsuits; * and sets civil penalties as high as 15% of a violating company's parent entity's annual revenue.
AI-generated summary, pending human review.
| Version | Event | Date | User support | Your vote | Roll calls |
|---|---|---|---|---|---|
| Original |
Initial publication
Jul 13, 2026
|
Jul 13, 2026 | No votes yet | — | — |
Log in or create an account to record your vote on this legislation. Results are visible to all visitors.
Regulatory or Legal Changes Top 4
Ban on data brokers selling health and location data
Prohibits data brokers from selling or sharing people's health and location data, and prohibits anyone from selling that data to data brokers. Creates new legal obligations for a major segment of the data industry. Directs the Federal Trade Commission (FTC) to write implementing rules within 180 days of enactment and grants authority to identify additional categories of covered data through future rulemaking, including defining the term 'data' itself.
- Population Scope High The prohibition directly binds every data broker operating in the U.S. and every entity that supplies them data — a commercially pervasive industry whose data practices affect a very large share of the American public.
- Budgetary Magnitude Low The prohibition and accompanying rulemaking mandate appropriate no funds and obligate no spending.
- Legal / Regulatory Depth High Creates new statutory prohibitions with binding legal effect across a major commercial sector, paired with a mandatory Federal Trade Commission (FTC) rulemaking authority to define the operative scope of those prohibitions.
- Degree of Discretion Granted High FTC receives broad delegated authority to define 'data' itself and to identify additional covered data categories through future rulemaking, giving the agency wide latitude to expand the prohibition's reach.
- Implementation & Enforcement Burden High Imposes an affirmative compliance obligation on an entire commercial sector and requires FTC to stand up a new regulatory regime — including rules and definitional standards — within 180 days.
- Temporal Commitment High The prohibition carries no expiry or reauthorization requirement and persists indefinitely until Congress acts to repeal or modify it.
No signal yet
Regulatory or Legal Changes
Ban on data brokers selling health and location data
Implementation & Enforcement Top 4
Multi-track enforcement: FTC, state AGs, private suits
Creates three enforcement paths — through the Federal Trade Commission (FTC), state attorneys general acting on behalf of residents, and private lawsuits by affected individuals — each with access to injunctions, damages, and other relief in federal court. Sets a ceiling on civil penalties for violations at 15% of the annual revenues of the violating entity's ultimate parent company, applicable on top of any other penalties authorized by law. Overrides state and local laws only where they would require disclosures that this Act prohibits, leaving all other state privacy and data protection laws in full force.
- Population Scope High Grants standing to any affected individual, all state attorneys general, and the Federal Trade Commission (FTC) — effectively making every U.S. resident a potential plaintiff and every state a potential enforcer against a nationwide industry.
- Budgetary Magnitude Medium The 15% of parent-entity revenue penalty ceiling creates substantial potential government recoveries, but the actual dollar impact is contingent on enforcement outcomes rather than a fixed appropriation.
- Legal / Regulatory Depth High Creates three new statutory causes of action — including a private right of action — and extends FTC jurisdiction to nonprofits, representing a fundamental expansion of enforceable legal rights and institutional authority.
- Degree of Discretion Granted Medium FTC retains prosecutorial discretion over which cases to bring and what relief to seek, while the revenue-based penalty formula and jurisdiction rules constrain the outer bounds of that discretion.
- Implementation & Enforcement Burden High Standing up three parallel enforcement tracks — each with its own procedural rules, venue requirements, and remedy options — creates recurring adjudicative infrastructure across FTC, state AG offices, and federal courts.
- Temporal Commitment High The enforcement framework carries no sunset or reauthorization requirement and persists indefinitely until Congress acts to modify or repeal it.
No signal yet
Implementation & Enforcement
Multi-track enforcement: FTC, state AGs, private suits
Funding / Appropriations Top 4
$1 billion FTC appropriation through FY2035
Appropriates $1 billion to the Federal Trade Commission (FTC) for fiscal year 2027, available through September 30, 2035, to carry out the agency's work under this Act — a one-time, multi-year funding boost outside the normal appropriations process.
- Population Scope Low Directly affects only the Federal Trade Commission (FTC) as an institution; any broader public benefit flows indirectly through the enforcement the funding enables.
- Budgetary Magnitude High Appropriates a one-time $1 billion to FTC — roughly an order of magnitude above the agency's typical annual budget — available through September 30, 2035.
- Legal / Regulatory Depth Low A standalone appropriation adds resources to carry out authorities created elsewhere in the Act; it does not itself change substantive or procedural law.
- Degree of Discretion Granted Medium Funds are restricted to FTC work under this Act but leave the agency discretion over how to allocate resources across rulemaking, enforcement, and operations within that constraint.
- Implementation & Enforcement Burden Low The appropriation funds enforcement capacity rather than imposing an enforcement obligation; it reduces rather than adds to implementation burden.
- Temporal Commitment Low Funds expire on September 30, 2035 — a hard end date within approximately nine years — self-terminating without any congressional action to extend them.
No signal yet
Funding / Appropriations
$1 billion FTC appropriation through FY2035
Carve-outs, Exemptions, Eligibility Top 4
Exceptions for HIPAA, news, and individual consent
Carves out from the data-sharing ban any actions allowed under federal health privacy rules, publication of newsworthy information in the public interest, and disclosures the individual has specifically authorized.
- Population Scope Medium Directly affects HIPAA-covered entities, news organizations, and individuals who authorize data sharing — a sizable but distinct subset of the overall regulated population, not the general public at large.
- Budgetary Magnitude Low The exceptions define the boundaries of a prohibition and impose no spending, appropriation, or financial obligation.
- Legal / Regulatory Depth Medium Carving out specific actors and circumstances from a statutory prohibition is a constraint on how existing law applies rather than a new substantive mandate — it narrows the prohibition's reach without creating independent duties or rights.
- Degree of Discretion Granted Low The exceptions track fixed external standards — existing HIPAA regulations and 45 CFR 164.508 — leaving no meaningful agency discretion to interpret or expand them.
- Implementation & Enforcement Burden Low Reduces rather than increases enforcement burden by narrowing the population subject to the prohibition's requirements.
- Temporal Commitment High The exceptions carry no expiry or reauthorization requirement and persist indefinitely alongside the underlying prohibition.
No signal yet
Carve-outs, Exemptions, Eligibility
Exceptions for HIPAA, news, and individual consent
Incomplete vote
You have not made a selection on all required items:
Choose Neutral if you prefer not to commit. Leaving without completing will remove all your votes for this bill from the totals.
Maximum recommendations reached
You have already recommended the maximum number of components allowed on this bill. To recommend [new component], choose one of your current recommendations to unselect: