This bill prohibits data brokers from selling, sharing, or transferring health data and location data about individuals, whether the data is directly collected or inferred from other information. The law applies to any company that collects and resells personal data, though it includes narrow exceptions for certain healthcare activities that comply with federal privacy rules, newsworthy publications, and instances where individuals provide explicit authorization. The Federal Trade Commission must issue enforcement rules within 180 days of the law taking effect, with the prohibition itself becoming effective either when those rules are finalized or 180 days after enactment, whichever comes first. Enforcement authority is shared among the FTC, state attorneys general, and private individuals who can sue violators, with potential civil penalties reaching up to 15 percent of a company's parent entity revenue. The bill appropriates $1 billion to the FTC for fiscal year 2025, available through 2034, to support implementation and enforcement efforts.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.