Warren and Scanlon Reintroduce Health Data Sale Ban

Reporting by The Verge attributes to Senator Elizabeth Warren and Representative Mary Gay Scanlon a plan to introduce a revised version of the Health and Location Data Protection Act tailored for the AI era, saying the proposal would bar the sale of Americans' health and location information to data brokers, including information revealed to chatbots. A Warren Senate press release described earlier iterations of the legislation as banning brokers from selling Americans' location and health data. Per Congress.gov, an earlier Senate filing under the title S.5462 was introduced on December 10, 2024. GovTrack records that the 2024/118th-Congress version did not advance and died in that Congress. HIPAA Journal summarizes provisions from earlier filings that would prohibit data brokers from selling, licensing, trading, or otherwise making available specified sensitive categories, and would create a federal registry of data brokers with consumer opt-out rights.

Public reporting and prior bill text indicate the core enforcement lever is a prohibition on sale and transfer of covered categories plus a disclosure/registry requirement for brokers. Companies that historically sourced aggregated or inferred health/location signals from broker feeds or resale markets would face narrower lawful supply channels. For practitioners, that raises the importance of documented consent, first-party collection, and provenance metadata in training datasets; teams should assume broker-origin data will become higher-risk or unavailable in some product flows if similar language becomes law.

If comparable language passes, product teams using consumer chat logs, location telemetry, or third-party enrichment will need tighter data classification and purpose-binding controls. As legislation restricts a class of inputs, downstream model-validation work - label auditing, differential privacy, and adversarial testing for sensitive inference - tends to become more central to risk attestation and to supporting data-minimization claims.

Track the formal bill text when released and whether sponsors define "health data" and covered "location data" explicitly, since legal scope will hinge on those definitions. Also watch committee referrals, whether enforcement is civil (FTC/agency) or criminal, and any carve-outs for HIPAA-covered entities - HIPAA Journal notes earlier versions exempted HIPAA-compliant disclosures. Finally, monitor whether the legislation includes transition periods or safe-harbor provisions affecting model retraining schedules and vendor contracts.

This is the third attempt at similar legislation (prior versions in 2022 and 2024 both stalled), and it has not yet been formally reintroduced with new bill text as of this reporting. Data scientists and ML engineers working with consumer health signals should treat this as an early-warning signal to inventory brokered inputs and tag provenance now, rather than a near-term compliance deadline.