Warren, Scanlon Revive 2022 Privacy Bill to Ban AI Health Data Sales
Updated
Updated · The Verge · Jun 29
Warren, Scanlon Revive 2022 Privacy Bill to Ban AI Health Data Sales
2 articles · Updated · The Verge · Jun 29
Summary
A revamped Health and Location Data Protection Act due in coming weeks would bar companies — including AI chatbot providers — from selling Americans’ health and location data to brokers.
The update expands a June 2022 bill that targeted data brokers alone, explicitly covering information users type into systems such as ChatGPT, Claude and Grok.
The proposal comes as AI firms push deeper into healthcare: OpenAI and Anthropic launched healthcare tools this year, and Elon Musk urged users in January to upload medical records to Grok.
The bill would give the FTC 180 days to write rules, allow enforcement by the FTC, state attorneys general and affected individuals, and provide $1 billion to the agency over 10 years.
The push highlights a broader gap in U.S. federal privacy law, with lawmakers arguing sensitive health data needs stronger safeguards as more people share it with AI services.
Amid a push for AI innovation, can a new bill truly stop companies from profiting off your most private health data?
This new law could block future sales of your health data, but what about the information that has already been sold?
If selling health data is banned, how can we stop AI from simply inferring it from your other non-medical information?
The Warren-Scanlon Act: A Federal Push to Protect Health Data from AI-Driven Commercial Exploitation
Overview
In June 2026, Congress launched a major legislative push with the Warren-Scanlon Health and Location Data Protection Act, aiming to address growing privacy concerns as artificial intelligence becomes more integrated into healthcare. The bill expands its focus to specifically target AI-driven data risks, with a key goal to ban AI companies from selling Americans' health data. This move responds to new challenges created by AI’s ability to collect, process, and monetize sensitive health information, positioning the Act as a direct effort to safeguard personal health data from commercial exploitation in an evolving digital landscape.