Lawmakers want to ban AI companies from selling your health data

Senator Elizabeth Warren and Representative Mary Gay Scanlon are preparing to introduce legislation that would prohibit AI companies from selling Americans' health and location data to data brokers, expanding a 2022 bill to cover information shared with chatbots like ChatGPT and Claude. The updated Health and Location Data Protection Act, also sponsored by Senators Ron Wyden and Bernie Sanders, would require the Federal Trade Commission to issue implementing rules within 180 days [1]. The measure earmarks $1 billion to the FTC over the next 10 years for enforcement and authorizes the agency, state attorneys general, and affected individuals to sue [1]. The original version, introduced in June 2022, barred data brokers from collecting and selling health and location data; the new draft extends the prohibition to any company selling such data to brokers and explicitly covers data entered into AI systems [1]. Senator Warren said in a statement, "It's more important than ever that we crack down on data brokers that are raking in giant profits from selling Americans' most sensitive information" [1]. She added that as more people enter private health data into AI, the information must not be "exploited by the highest bidder" [1]. The bill arrives as AI companies accelerate their push into health care. In January, Elon Musk urged users to upload medical records such as MRI scans to Grok, xAI's chatbot [1]. That same month, OpenAI launched ChatGPT Health, a sandboxed tab it described as more secure, and ChatGPT for Healthcare, aimed at medical providers [1]. Anthropic followed days later with Claude for Healthcare, a tool it called "HIPAA-ready" for individuals, providers, and hospitals [1]. Sara Gerke, a law professor at the University of Illinois Urbana-Champaign, told The Verge in January that data protection for such tools "largely depends on what companies promise in their privacy policies and terms of use" [1]. The United States lacks a comprehensive federal data privacy framework despite years of legislative attempts [1]. Generative AI tools, including the chatbots named in the bill, have seen rapid adoption since the AI boom of the 2020s, driven by advances in large language models based on the transformer architecture [2]. Companies across health care, finance, and other sectors have integrated these systems, even as concerns mount over data security and unauthorized access [2]. The proposed legislation represents one of the most direct congressional efforts to constrain how AI firms monetize sensitive user information.