In the coming weeks, Senator Elizabeth Warren (D-MA) and Representative Mary Gay Scanlon (D-PA) are planning to debut a new version of the Health and Location Data Protection Act that’s better suited to the AI era. The former version of the bill, first introduced in June 2022, prohibited data brokers from collecting and selling health and location data. Four years later, it’s expanded to ban other companies from selling such data to brokers, and to specifically cover data entered into AI systems.

AI labs have set their sights on building health and medical products. In January, Elon Musk publicly called for people to upload their medical records, like MRI scans, to Grok, xAI’s chatbot. That same month, OpenAI introduced ChatGPT Health, a sandboxed tab within ChatGPT that it deemed more secure, and encouraged users to upload their medical records and other sensitive information. It also introduced ChatGPT for Healthcare, aimed at medical providers. A few days after that, Anthropic quickly followed up with Claude for Healthcare, a “HIPAA-ready” tool for individuals, health providers, and hospitals.

But when battling data breaches or unauthorized access to data, users are largely at the AI companies’ mercy. The data protection for tools like OpenAI’s and Anthropic’s “largely depends on what companies promise in their privacy policies and terms of use,” Sara Gerke, a law professor at the University of Illinois Urbana-Champaign, told The Verge in January. The US lacks an overall federal framework for data privacy, despite years of attempts.

This bill — which is also sponsored by Senators Ron Wyden (D-OR) and Bernie Sanders (I-VT) — would require the Federal Trade Commission to enact the rules within 180 days and will allow the FTC, state attorneys general, and affected individuals to sue to enforce it. It would also earmark $1 billion to the FTC over the next 10 years for enforcement.