S. 4946 — Health and Location Data Protection Act of 2026

This section prohibits data brokers from selling, licensing, transferring, or otherwise making available an individual's location data or health data. It also bars any person from providing such data to a data broker. Exceptions apply for HIPAA-compliant actions by covered entities or business associates, publication of newsworthy information of legitimate public concern, and disclosures made with valid individual authorization. The prohibitions take effect on the earlier of the date the Federal Trade Commission issues a final rule or 180 days after enactment.

This section authorizes the Federal Trade Commission to enforce section 2 as an unfair or deceptive act or practice under the Federal Trade Commission Act, including against nonprofit organizations, and grants the Commission independent authority to seek injunctions, civil penalties, damages, restitution, and other relief in the United States District Court for the District of Columbia. It permits state attorneys general to bring parens patriae actions on behalf of residents after notice to the Commission, subject to limits during pending federal actions, and allows affected individuals to sue for damages, attorney fees, and equitable relief. Violations carry civil penalties up to 15 percent of the revenues of the person's ultimate parent entity during the preceding 12-month period.

This section defines terms for the Act, including artificial intelligence (by reference to 15 U.S.C. 9401), artificial intelligence systems, data brokers, health data, location data, and ultimate parent entities. It directs the Federal Trade Commission to adopt rules within 180 days defining “data” to include information linked or reasonably linkable to individuals or groups sharing a residence or IP address, with specified exclusions for data brokers.

This section provides $1,000,000,000 to the Commission for fiscal year 2027, to remain available until September 30, 2035, for carrying out the Commission's work.