Lawmakers want to ban AI companies from selling your health data

A new proposal would ban the sale of Americans’ health and location information to data brokers — including information people reveal to an AI chatbot like ChatGPT or Claude.

Lawmakers want to ban AI companies from selling your health data

A revamped data privacy bill would limit selling information to data brokers, including from chatbot services.

In the coming weeks, Senator Elizabeth Warren (D-MA) and Representative Mary Gay Scanlon (D-PA) are planning to debut a new version of the Health and Location Data Protection Act that’s better suited to the AI era. The former version of the bill, first introduced in June 2022, prohibited data brokers from collecting and selling health and location data. Four years later, it’s expanded to ban other companies from selling such data to brokers, and to specifically cover data entered into AI systems.

AI labs have set their sights on building health and medical products. In January, Elon Musk publicly called for people to upload their medical records, like MRI scans, to Grok, xAI’s chatbot. That same month, OpenAI introduced ChatGPT Health, a sandboxed tab within ChatGPT that it deemed more secure, and encouraged users to upload their medical records and other sensitive information. It also introduced ChatGPT for Healthcare, aimed at medical providers. A few days after that, Anthropic quickly followed up with Claude for Healthcare, a “HIPAA-ready” tool for individuals, health providers, and hospitals.

But when battling data breaches or unauthorized access to data, users are largely at the AI companies’ mercy. The data protection for tools like OpenAI’s and Anthropic’s “largely depends on what companies promise in their privacy policies and terms of use,” Sara Gerke, a law professor at the University of Illinois Urbana-Champaign, told The Verge in January. The US lacks an overall federal framework for data privacy, despite years of attempts.

This bill — which is also sponsored by Senators Ron Wyden (D-OR) and Bernie Sanders (I-VT) — would require the Federal Trade Commission to enact the rules within 180 days and will allow the FTC, state attorneys general, and affected individuals to sue to enforce it. It would also earmark $1 billion to the FTC over the next 10 years for enforcement.

“It’s more important than ever that we crack down on data brokers that are raking in giant profits from selling Americans’ most sensitive information,” said Senator Warren in a statement. “Especially as more people enter their private health data into AI, we need to make sure that information isn’t exploited by the highest bidder.”