Sen. Elizabeth Warren and Rep. Mary Gay Scanlon plan to introduce an updated bill. It targets the sale of sensitive health and location information to data brokers. The measure specifically addresses data people share with AI chatbots.
The proposal arrives at a moment when major AI developers actively solicit personal medical details. Users face few federal safeguards once that information leaves their devices. The Health and Location Data Protection Act seeks to close a glaring loophole.
Four years ago Warren and colleagues first introduced the legislation. Back then it focused on stopping data brokers from collecting or selling Americans’ health and location details. The 2022 version, reported by Warren’s Senate office, carried a narrower scope.
This time the bill expands. It would prohibit not only brokers but also other companies from selling such data to them. And it explicitly covers information entered into AI systems. The Verge first detailed the changes in its June 29 report. (The Verge)
Timing matters. In January Elon Musk urged people to upload medical records, including MRI scans, to xAI’s Grok chatbot. The same month OpenAI launched ChatGPT Health. It encouraged users to share records and sensitive information inside a supposedly secure tab. Anthropic followed with its own HIPAA-ready Claude for Healthcare offerings.
Users who comply hand over intimate details. Symptoms. Diagnoses. Family history. Location patterns that reveal clinic visits. Yet protection rests largely on corporate privacy policies. Sara Gerke, a law professor at the University of Illinois Urbana-Champaign, noted in January that safeguards “largely depend on what companies promise in their privacy policies and terms of use.” The U.S. still lacks a comprehensive federal privacy law.
Warren didn’t mince words. “It’s more important than ever that we crack down on data brokers that are raking in giant profits from selling Americans’ most sensitive information,” she said. “Especially as more people enter their private health data into AI, we need to make sure that information isn’t exploited by the highest bidder.”
The bill carries additional teeth. It directs the Federal Trade Commission to issue rules within 180 days. Enforcement power goes to the FTC, state attorneys general, and private individuals who can sue. Lawmakers also propose $1 billion in funding for the FTC over 10 years. Sponsors include Sens. Ron Wyden and Bernie Sanders.
Industry has poured resources into health applications. Chatbots now diagnose, summarize records, and offer advice. Some products market themselves as HIPAA compliant for enterprise use. Consumer versions remain far less protected. Once data reaches a broker, it can circulate through advertising networks, insurance underwriters, or other buyers with little traceability.
State efforts have filled some gaps. Washington, California and others passed consumer health data laws in recent years. Those statutes often require consent before selling certain information or ban geofencing around clinics. Yet they don’t reach every AI developer operating nationwide. Fragmented rules create compliance headaches for companies and uneven protection for citizens.
Recent coverage highlights the momentum. 9to5Mac covered the proposal hours after The Verge, noting how Apple’s Siri integration with ChatGPT and Gemini operates under stricter on-device privacy rules. The outlet argued piecemeal bills lag behind technology and renewed calls for GDPR-style federal legislation. (9to5Mac)
Critics worry the bill could slow innovation. AI models improve when trained on diverse medical data. Proponents counter that anonymized or consented research data faces different rules. The prohibition targets commercial sale to brokers, not all research or product development.
Data brokers have built multibillion-dollar markets on precisely this information. Health inferences command premium prices. Location data tied to a cancer center visit reveals far more than coordinates. Combine both and profiles become intimate portraits ripe for exploitation.
Supporters see the legislation as overdue housekeeping. The original 2022 bill never passed. Renewed focus on AI chatbots may generate fresh urgency. Public awareness has grown. Stories of fitness trackers, period apps and mental health platforms leaking data have accumulated.
Implementation won’t prove simple. Defining “health data” broadly enough to capture chatbot conversations without ensnaring benign queries requires care. Location data tied to health facilities needs clear boundaries. The FTC must move quickly once the bill passes.
Still, the direction feels clear. Congress signals that health information shared with AI should not become just another commodity. Companies can build powerful tools. They cannot treat the resulting data as inventory for the highest bidder.
And the conversation continues. Other proposals circulate in statehouses. California, New York and Illinois have advanced their own AI and health privacy measures this year. Federal action would harmonize the patchwork. Until then, users weigh convenience against risk every time they type symptoms into a chatbot.
The bill’s success remains uncertain. Bipartisan support could help. Industry lobbying will intensify. But the core idea—that some data stays too personal to trade—gains traction. Americans may soon gain stronger recourse when their most private details appear on the open market.
WebProNews is an iEntry Publication