Warren and Scanlon Reintroduce Health Data Sale Ban

Stricter limits on commercial health and location datasets would directly affect teams that train or fine-tune consumer-facing models using third-party data. Reduced availability of brokered geolocation and inferred health signals raises provenance and auditability questions for feature pipelines, and increases legal risk for products that surface sensitive inferences to end users.

Reporting by The Verge attributes to Senator Elizabeth Warren and Representative Mary Gay Scanlon a plan to introduce a revised version of the Health and Location Data Protection Act tailored for the AI era, and says the proposal would bar the sale of Americans' health and location information to data brokers, including information revealed to chatbots. A Warren Senate press release described the legislation as banning brokers from selling Americans' location and health data. Per Congress.gov, an earlier Senate filing using the title S.5462 was introduced on December 10, 2024. GovTrack records that the 2024/118th-Congress version did not advance and "died in a previous Congress." HIPAA Journal summarizes provisions from earlier filings that would prohibit data brokers from selling, licensing, trading, or otherwise making available specified sensitive categories and would create a federal registry of data brokers with consumer opt-out rights.

Public reporting and prior bill text indicate the core enforcement lever is the prohibition on sale and transfer of covered categories and a disclosure/registry requirement for brokers. Companies that historically sourced aggregated or inferred health/location signals from broker feeds or resale markets would face narrower lawful supply channels. For practitioners, that increases the importance of documented consent, first-party collection, and provenance metadata in training datasets; teams should assume broker-origin data will become higher-risk or unavailable in some product flows.

If similar language reaches law, product teams using consumer chat logs, location telemetry, or third-party enrichment will need tighter data classification and purpose-binding controls. Industry-pattern observations show that when legislation restricts a class of inputs, downstream model validation work - label auditing, differential privacy, and adversarial testing for sensitive inference - becomes more central to risk attestation and to meeting reasonable data-minimization claims.

Observers should track the formal bill text when released and whether sponsors include explicit definitions for "health data" and covered "location data," because legal scope will hinge on those definitions. Also watch committee referrals and whether enforcement is civil (FTC/agency) or criminal, and any carve-outs for HIPAA-covered entities; HIPAA Journal notes earlier versions exempted HIPAA-compliant disclosures. Finally, monitor whether the legislation includes transition periods or safe-harbor provisions that affect model retraining schedules and contractual terms with data vendors.

Data scientists and ML engineers working with consumer health signals should inventory brokered inputs, tag provenance, and collaborate with legal and data governance to define acceptable sources under tighter regulatory regimes. Maintaining auditable pipelines and explicit consent records will reduce operational friction if brokered feeds become restricted.