forms of data, whether declared or inferred, of an indi-
vidual: 
(1) Location data. 
(2) Health data. 
(3) Other categories of data identified by the 
Commission that address or reveal a category of 
data described in paragraphs (1) and (2). 
(b) EXCEPTIONS.— 
(1) ACTIONS THAT ARE HIPAA-COMPLIANT.— 
(A) IN
GENERAL.—Nothing in this Act 
shall be construed to prohibit any action taken 
with respect to the health information of an in-
dividual by a data broker acting in its capacity 
as a business associate or covered entity, that 
is permissible under the Federal regulations 
concerning standards for privacy of individually 
identifiable health information promulgated 
under section 264(c) of the Health Insurance 
Portability and Accountability Act of 1996 (42 
U.S.C. 1320d–2 note). 
(B) APPLICATION
OF
TERMS.—In para-
graph (1), the terms ‘‘business associate’’, ‘‘cov-
ered entity’’, and ‘‘health information’’ shall 
have the meaning given those terms in the Fed-
eral regulations specified in such paragraph. 
VerDate Sep 11 2014 
02:14 Jan 28, 2025
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H10540.IH
H10540
ssavage on LAPJG3WLY3PROD with BILLS
(2) PUBLICATION OF NEWSWORTHY INFORMA-
TION OF LEGITIMATE PUBLIC CONCERN.—Nothing 
in this Act shall be construed to prohibit the publi-
cation of newsworthy information of legitimate pub-
lic concern. 
(3) DISCLOSURE PURSUANT TO VALID AUTHOR-
IZATION.—Nothing in this Act shall be construed to 
prohibit a disclosure of the data of an individual for 
which the individual provides valid authorization. 
For purposes of this paragraph, the term ‘‘valid au-
thorization’’ has the meaning given such term in sec-
tion 164.508 of title 45, Code of Federal Regula-
tions (or a successor regulation), subject to such ad-
aptations as the Commission shall deem necessary to 
apply such term to the disclosure of both location 
data and health data. 
(c) EFFECTIVE DATE.—The prohibition under sub-
section (a) shall take effect on the earlier of— 
(1) the date the Commission issues the final 
rule under subsection (d); or 
(2) 180 days after the date of enactment of this 
Act. 
(d) RULEMAKING.— 
(1) FINAL RULE.—Pursuant to section 553 of 
title 5, United States Code, the Commission shall 
VerDate Sep 11 2014 
02:14 Jan 28, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H10540.IH
H10540
ssavage on LAPJG3WLY3PROD with BILLS
promulgate regulations to carry out the provisions of 
this Act. The Commission shall issue a final rule by 
not later than 180 days after the date of enactment 
of this Act. 
(2) ADDITIONAL GUIDANCE.—Pursuant to sec-
tion 553 of title 5, United States Code, the Commis-
sion may promulgate further regulations to carry out 
the provisions of this Act, including further guidance 
regarding the types of data described in subsection 
(a). 
SEC. 3. ENFORCEMENT. 
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 2 shall be treated as 
a violation of a rule defining an unfair or a deceptive 
act or practice under section 18(a)(1)(B) of the Fed-
eral 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)). 
(2) POWERS OF COMMISSION.— 
(A) IN GENERAL.—Except as provided in 
subparagraphs (D) and (E), the Commission 
shall enforce section 2 in the same manner, by 
the same means, and with the same jurisdic-
tion, powers, and duties as though all applicable 
VerDate Sep 11 2014 
02:14 Jan 28, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H10540.IH
H10540
ssavage on LAPJG3WLY3PROD with BILLS
terms and provisions of the Federal Trade 
Commission Act (15 U.S.C. 41 et seq.) were in-
corporated into and made a part of this Act. 
(B) PRIVILEGES
AND
IMMUNITIES.—Any 
person who violates section 2 shall be subject to 
the penalties and entitled to the privileges and 
immunities provided in the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.). 
(C) AUTHORITY PRESERVED.—Nothing in 
this Act shall be construed to limit the author-
ity of the Federal Trade Commission under any 
other provision of law. 
(D) NONPROFIT
ORGANIZATIONS.—Not-
withstanding section 4 of the Federal Trade 
Commission Act (15 U.S.C. 44) or any jurisdic-
tional limitation of the Commission, the Com-
mission shall also enforce this Act, in the same 
manner provided in subparagraphs (A) and (B), 
with respect to organizations not organized to 
carry on business for their own profit or that 
of their members. 
(E) INDEPENDENT
LITIGATION
AUTHOR-
ITY.—In any case in which the Commission has 
reason to believe that a data broker is violating 
or has violated section 2, the Commission may 
VerDate Sep 11 2014 
02:14 Jan 28, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H10540.IH
H10540
ssavage on LAPJG3WLY3PROD with BILLS
bring a civil action in an appropriate district 
court of the United States to— 
(i) enjoin any further such violation 
by such person; 
(ii) enforce compliance with this Act, 
including through deletion of the relevant 
information; 
(iii) obtain a permanent, temporary, 
or preliminary injunction; 
(iv) obtain civil penalties; 
(v) obtain damages (whether actual, 
punitive, 
or 
otherwise), 
restitution, 
disgorgement of unjust enrichment, or 
other compensation on behalf of aggrieved 
persons; or 
(vi) obtain any other appropriate equi-
table relief. 
(b) ENFORCEMENT BY STATES.— 
(1) IN GENERAL.—In any case in which the at-
torney general of a State has reason to believe that 
an interest of the residents of the State has been or 
is threatened or adversely affected by the engage-
ment of any data broker subject to section 2 in a 
practice that violates such section, the attorney gen-
eral of the State may, as parens patriae, bring a 
VerDate Sep 11 2014 
02:14 Jan 28, 2025
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H10540.IH
H10540
ssavage on LAPJG3WLY3PROD with BILLS