Congress is taking aim at what happens to the medical details you type into a chatbot. According to The Verge AI, Senator Elizabeth Warren (D-MA) and Representative Mary Gay Scanlon (D-PA) plan to introduce a new version of the Health and Location Data Protection Act in the coming weeks, rebuilt for the AI era. The bill would ban the sale of Americans’ health and location information to data brokers, and it specifically covers data people hand over to AI systems like ChatGPT and Claude.
This is a notable shift. The original bill, first introduced in June 2022, focused on stopping data brokers from collecting and selling health and location data. Four years later, the scope has widened. The new version would also bar other companies from selling that data to brokers in the first place, and it draws a clear line around anything you enter into an AI chatbot.
Why now
AI labs have been pushing hard into health and medicine, and that’s the backdrop here.
- In January, Elon Musk publicly urged people to upload medical records, including MRI scans, to Grok, xAI’s chatbot.
- That same month, OpenAI launched ChatGPT Health, a sandboxed tab it called more secure, and encouraged users to upload medical records and other sensitive information. It also rolled out ChatGPT for Healthcare for medical providers.
- Days later, Anthropic followed with Claude for Healthcare, a “HIPAA-ready” tool for individuals, providers, and hospitals.
So within weeks, the three biggest names in consumer AI all asked people to trust them with their most private records. What stands out is how little legal protection sits underneath that ask.
The gap this bill is trying to fill
Right now, your protection depends almost entirely on corporate promises. As The Verge AI reports, the safeguards for tools like OpenAI’s and Anthropic’s “largely depends on what companies promise in their privacy policies and terms of use,” according to Sara Gerke, a law professor at the University of Illinois Urbana-Champaign. When a breach or unauthorized access happens, users are largely at the AI companies’ mercy.
The deeper problem is structural. The US still has no overall federal framework for data privacy, despite years of failed attempts. That vacuum is exactly why a chatbot can invite you to share an MRI scan with no binding national rule about where that data can end up.
What the bill would actually do
The proposal, also sponsored by Senators Ron Wyden (D-OR) and Bernie Sanders (I-VT), comes with real enforcement teeth:
- Direct the Federal Trade Commission to write the rules within 180 days.
- Let the FTC, state attorneys general, and affected individuals sue to enforce it.
- Earmark $1 billion to the FTC over the next 10 years for enforcement.
It’s more important than ever that we crack down on data brokers that are raking in giant profits from selling Americans’ most sensitive information. Especially as more people enter their private health data into AI, we need to make sure that information isn’t exploited by the highest bidder.
Why it matters for the AI industry
For practitioners and product teams, this is a signal worth reading closely. If the bill moves, the legal floor for handling health data in AI products would stop being a matter of self-written terms of service and become an FTC-enforced rule with a 180-day clock. Companies building health features would need to prove their data isn’t flowing to brokers, not just promise it.
A few things to watch:
- Whether the bill gains co-sponsors beyond its current Democratic and independent backers, since passage in a divided Congress is far from certain.
- How AI labs respond, especially those that just launched health products and now face the prospect of federal rules.
- Whether this revives the broader push for a national privacy law, which has stalled for years.
Nothing changes the moment a bill is introduced. But the direction is clear: the data you share with a chatbot is moving from a gray zone into the center of the privacy debate. You can find the full details at the original report from The Verge AI.