This legislation, known as the Health and Location Data Protection Act of 2026, establishes a comprehensive prohibition on the sale and transfer of sensitive personal information. Specifically, it makes it unlawful for data brokers to sell, resell, license, trade, or otherwise make available an individual's location data or health data , whether declared or inferred. The bill also prohibits any person from providing these categories of data to data brokers, with the Federal Trade Commission (FTC) empowered to identify additional protected data categories. The Act includes several exceptions, such as actions compliant with HIPAA for health information, the publication of newsworthy information of legitimate public concern, and disclosures made with an individual's valid authorization. The FTC is mandated to issue a final rule within 180 days of enactment to carry out these provisions and define the term "data." Enforcement of the Act falls under the purview of the FTC, state attorneys general, and includes a private right of action for affected individuals, with potential civil penalties up to 15 percent of the ultimate parent entity's revenues.