The bill establishes a prohibition on data brokers from selling, licensing, or otherwise making available an individual's location data and health data , whether declared or inferred. It also makes it unlawful for any person to provide these sensitive data types to data brokers. Exceptions to these prohibitions include actions compliant with HIPAA, the publication of newsworthy information of legitimate public concern, and disclosures made with the individual's valid authorization. The Federal Trade Commission (FTC) is authorized to identify additional categories of prohibited data. The Federal Trade Commission (FTC) is designated as the primary enforcement body, treating violations as unfair or deceptive acts and practices. The FTC can seek injunctions, civil penalties, damages, and other equitable relief, including the deletion of relevant information. State attorneys general are also empowered to bring civil actions on behalf of their residents, and individuals have a private right of action to seek relief. Violations carry significant civil penalties, potentially up to 15 percent of the ultimate parent entity's revenues. The bill mandates the FTC to promulgate regulations, including defining "data," and appropriates $1 billion to the FTC for its enforcement efforts.