Congress to Block AI Companies Selling Your Health Data

A significant legislative update is underway to bolster data privacy, specifically targeting the sale of sensitive personal information to data brokers, including data shared through AI chatbot services.

The proposed legislation aims to prohibit the sale of Americans' health and location data to data brokers. This ban would explicitly cover information that individuals disclose to artificial intelligence chatbots, such as ChatGPT or Claude.

In the coming weeks, Senator Elizabeth Warren (D-MA) and Representative Mary Gay Scanlon (D-PA) are set to unveil a revised iteration of the Health and Location Data Protection Act. This updated bill is specifically designed to address the challenges and complexities of the artificial intelligence era. The original version, introduced in June 2022, primarily focused on preventing data brokers from collecting and selling health and location data. Four years later, the scope has expanded considerably to forbid other companies from selling such data to brokers and to specifically encompass information entered into AI systems.

The urgency for such legislation is underscored by the increasing focus of AI laboratories on developing health and medical products. For instance, in January, Elon Musk publicly encouraged users to upload their medical records, including MRI scans, to Grok, xAI’s chatbot. In the same month, OpenAI launched ChatGPT Health, a "sandboxed" tab within ChatGPT touted as more secure, prompting users to upload medical records and other sensitive information. OpenAI also introduced ChatGPT for Healthcare, tailored for medical providers. Shortly thereafter, Anthropic followed suit with Claude for Healthcare, marketing it as a "HIPAA-ready" tool for individuals, healthcare providers, and hospitals.

However, in the event of data breaches or unauthorized access, individuals largely depend on the policies of these AI companies for protection. Sara Gerke, a law professor at the University of Illinois Urbana-Champaign, noted in January to The Verge that data protection for tools from companies like OpenAI and Anthropic "largely depends on what companies promise in their privacy policies and terms of use." This situation is exacerbated by the persistent absence of a comprehensive federal data privacy framework in the U.S., despite numerous past efforts.

This bill, which also garners sponsorship from Senators Ron Wyden (D-OR) and Bernie Sanders (I-VT), mandates that the Federal Trade Commission (FTC) implement the new rules within 180 days. It further empowers the FTC, state attorneys general, and affected individuals to initiate lawsuits to enforce its provisions. To support these enforcement efforts, the bill allocates $1 billion to the FTC over the next decade.

Senator Warren emphasized the critical need for this legislation in a statement, asserting, "It’s more important than ever that we crack down on data brokers that are raking in giant profits from selling Americans’ most sensitive information. Especially as more people enter their private health data into AI, we need to make sure that information isn’t exploited by the highest bidder."