← Back to bills

S. 4946 · 119th Congress

Health and Location Data Protection Act of 2026

Sen. Warren, Elizabeth [D-MA] (D-MA) · Introduced · 4 cosponsors

CommitteeCommerce
Progress
25%
1
Introduced
A bill is formally introduced by a lawmaker; it is assigned an ID and sent to committee.
2
Committee
A smaller group of lawmakers reviews, debates, and edits the bill before it can advance.
3
Reported
After committee work, the committee releases a report and the bill can go to the full chamber for a vote.
4
Senate Vote
The bill has passed the full Senate.
5
House Vote
The bill has passed the full House of Representatives.
6
Passed Congress
Both the House and Senate have passed the bill; it moves to the President for final approval.
7
Sent to President
The bill has been sent to the President, who may sign it, veto it, or let a ten-day clock decide.
8
Became Law
The bill is now law — by the President's signature, by the ten-day rule when the President declines to sign, or by a two-thirds veto override.

Latest action

Read twice and referred to the Committee on Commerce, Science, and Transportation.

· from Congress.gov, as of August 8, 2026

Committees

Commerce, Science, and Transportation Committee

What this stage means

A smaller group of lawmakers reviews, debates, and edits the bill before it can advance.

Why this matters

Committees do the detailed work — they decide if a bill should move forward and shape its content. Most bills die here.

What can happen next

If approved, the committee reports the bill to the full chamber for debate and a vote.

Study this bill

AP Gov

The constitutional question

The Constitution's civil-liberties guarantees run against the government — the state-action doctrine — so when private data brokers sell location traces revealing visits to clinics, churches, or addiction meetings, no amendment applies; and under the third-party doctrine, even police can often buy what they could not subpoena. Senator Warren's bill (introduced July 13, 2026, three cosponsors, in Commerce) would ban brokers from selling health and location data outright, making Congress, not the courts, the source of the protection.

The strongest case for

After Dobbs, the abstraction became concrete: location data sold openly on the commercial market can reconstruct who visited a reproductive-health clinic, when, and from where — and the FTC's enforcement actions against location brokers document exactly this trade. Carpenter v. United States made police get a warrant for cell-site history, but nothing stops an agency, employer, stalker, or foreign intelligence service from simply purchasing the same trail; a warrant requirement the market can route around is not a protection. Health and location data are uniquely non-consensual — no one meaningfully agrees to a hidden SDK in a weather app — and uniquely dangerous, which is why a flat ban on sale, not another consent checkbox, is the honest remedy.

The strongest case against

A flat ban on 'health and location' data sales sweeps in the anonymized and aggregated flows behind traffic apps, epidemiology, disaster response, and the ad-supported model that keeps most of the internet free — definitions this broad regulate infrastructure, not villains. The genuinely abusive practices are already reachable: the FTC has brought and won cases against location brokers under existing unfairness authority, and states from Washington to Texas have enacted targeted health-data laws, the federalism laboratory working as designed. A three-cosponsor bill introduced in a midterm July is a message, not a statute — and comprehensive privacy legislation (ADPPA) with real bipartisan work behind it stalled precisely because sweeping preemption and private-right questions this bill ignores are hard.

Foundational documents in play

  • U.S. Constitution

    The Fourth Amendment restrains government searches — but data brokers are private actors, so the liberty at stake here has no constitutional text protecting it, only statute.

Required cases in play

  • Roe v. Wade (1973)

    Roe's privacy line — and its overruling — is why location data near clinics became the sharpest privacy fight in America; the CED still requires Roe, and this bill is its data-age sequel.

This has happened before

Warren introduced the same-named bill in June 2022, days before Dobbs; it died in committee. The comprehensive alternative, the American Data Privacy and Protection Act, cleared House committee 53–2 that summer — the closest Congress has ever come to a general privacy law — then collapsed over state-preemption and enforcement fights. American privacy law advances only in sectors (HIPAA, COPPA, FCRA); this bill bets that health-plus-location is the next sector with a coalition, and its cosponsor count says the bet hasn't paid yet.

Practice FRQ

Concept Application. "A Senate bill would prohibit data brokers from selling individuals' health and location data. Supporters argue constitutional privacy protections do not reach private companies; opponents argue existing agency enforcement and state laws suffice." (A) Describe the state-action doctrine and its consequence for civil liberties claims against private companies. (B) Explain how the overruling of Roe v. Wade changed the stakes of commercial location data. (C) Explain one advantage and one disadvantage of addressing this by federal statute rather than state law.

Sources: www.congress.gov · www.warren.senate.gov

Action history

Every recorded action from Congress.gov — 2 total.

  1. Senate

    Introduced in Senate

  2. Senate

    Read twice and referred to the Committee on Commerce, Science, and Transportation.