HR-9482-119
Referred to the House Committee on Energy and Commerce.
Sponsored by Mary Scanlon (D-PA)
What it does
This bill would prohibit data brokers from selling, licensing, trading, or otherwise transferring the health data or location data of individuals. It would also prohibit any person from selling or transferring such data to a data broker. The Federal Trade Commission (FTC) would be empowered to enforce the law, issue implementing regulations within 180 days, and expand the list of covered data categories. Individuals, state attorneys general, and the FTC could all bring civil lawsuits, with penalties up to 15% of a violating company's parent entity's annual revenues. The bill appropriates $1 billion to the FTC for enforcement through 2035.
Who benefits
All U.S. residents whose health and location data is currently bought and sold without their knowledge — potentially hundreds of millions of people. Individuals seeking reproductive health services, mental health treatment, or other sensitive care whose physical movements and health searches could otherwise be tracked and sold. Victims of stalking or domestic violence whose location data could be used to find them. Patients with stigmatized conditions (HIV, addiction, mental illness) whose health data could be used in employment or insurance decisions. State attorneys general who gain new enforcement tools. Privacy-focused technology companies that do not rely on data brokerage as a revenue model.
Who is hurt
Data brokers and the broader data marketplace industry, which generates an estimated $200+ billion annually in the U.S. Advertisers and marketers who rely on purchased location and health data for targeted campaigns. Insurance companies and employers that use third-party data to assess risk or screen applicants. Academic and commercial researchers who use aggregated health and location data. Journalists and public interest investigators who rely on commercially available data. App developers and platforms that monetize user data by selling to brokers. Smaller data-dependent businesses that cannot afford to build first-party data collection infrastructure.
Supporters argue
Supporters argue that data brokers operate in a largely unregulated market that allows the sale of Americans' most sensitive personal information — including reproductive health searches and real-time location — without their knowledge or meaningful consent. They contend that this data has been used to identify individuals seeking abortions, track domestic violence survivors, and enable discriminatory profiling, citing documented cases of law enforcement purchasing location data to circumvent warrant requirements. They argue the bill's HIPAA-aligned exceptions and individual authorization carve-outs preserve legitimate uses while closing the most harmful loopholes.
Opponents argue
Opponents argue that a categorical ban on health and location data transfers is overbroad and would disrupt legitimate commercial, research, and public health uses that depend on aggregated data — such as disease surveillance, traffic safety analysis, and fraud detection. They contend that the bill's delegation of broad definitional authority to the FTC, including the power to expand covered data categories, raises concerns under the major questions doctrine established in West Virginia v. EPA (2022), since the FTC would effectively set the scope of a sweeping national data prohibition. They further argue that the 15%-of-parent-revenue penalty structure could impose existential liability on large companies for technical violations.
Constitutional context
Congress's authority to regulate data brokers rests on the Commerce Clause (Art. I, §8, cl. 3), as data brokerage is a commercial activity with clear interstate dimensions, well within the aggregation principle of Wickard v. Filburn (1942). However, the bill's delegation to the FTC to define "data" and expand covered categories may face scrutiny under the major questions doctrine (West Virginia v. EPA, 2022) and post-Loper Bright independent judicial review (2024), since courts will independently assess whether Congress has clearly authorized the FTC to set the outer boundaries of a broad national data prohibition.
Checks and balances
The FTC gains significant new rulemaking and enforcement authority, including independent litigation power and the ability to expand covered data categories; checks include congressional oversight, judicial review of FTC rules under the major questions doctrine and post-Loper Bright independent statutory interpretation, and concurrent enforcement authority shared with state attorneys general and private plaintiffs.
Historical precedent
No directly analogous federal law exists; several states (California, Virginia, Texas) have enacted data privacy laws, but no prior federal statute has categorically banned the sale of health and location data by data brokers specifically.