A US bill turns health chats into privacy evidence for AI companies

Warren and Scanlon want to expand a US ban on selling health and location data so it explicitly covers information people give to chatbots such as ChatGPT or Claude. This is a US legislative proposal, not a law in force.

The chatbot becomes a source of sensitive traces, not just advice

The Verge reports that a revised Health and Location Data Protection Act is expected in the coming weeks and would ban the sale of health and location information to data brokers, including information users reveal to AI chatbots. The new bill text was not public during verification, so this piece relies carefully on The Verge reporting and earlier versions of the bill.

The previous Warren, Wyden, Sanders and Whitehouse version described the data broker market as a $200 billion industry that remains largely unregulated under US federal law. It also gave the FTC 180 days to issue implementing rules and proposed $1 billion in funding over ten years.

The important shift is that an AI chatbot is no longer just an answer box. Users type symptoms, pregnancy concerns, medication questions, mental health details and clinic locations into these systems. That data is valuable to advertising and broker markets, but extremely hard for a person to claw back.

AI privacy moves from the policy page into product architecture

The impact would not be purely legal. If medical conversations and location data fall into the same sensitive category as brokered data, AI companies will need cleaner separation between storage, training, analytics, partner sharing and advertising use.

That is a product problem. A medical question in a chatbot does not carry the same risk as a dinner recipe. The service needs better detection of sensitive content, shorter retention, access audits and consent controls that normal users can understand.

For non US readers, the scope matters. The proposal targets the US market and US data brokers. Still, it points to a broader direction: AI regulation will not be only about model behavior. It will also be about the data exhaust models collect around people.

A sales ban does not settle what happens inside the model company

The weak point is the line between selling data, internal use and sharing with processors. Earlier versions targeted data brokers and data transfers, not every form of model improvement or security analysis.

AI services also rely on aggregation, pseudonymization and logs. If the rules leave a large carveout for internal service improvement, a sensitive chat may stay out of a broker catalogue while still moving through a pipeline the user cannot see.

The broker definition and the right to leave will decide the bite

The crucial signal will be the actual bill text: who counts as a data broker, how chatbot health data is defined and whether indirect transfers through partners are covered. A strong headline can become either a real brake or a law with side doors.

The second signal is how OpenAI, Anthropic and other assistant providers respond. If they change retention for sensitive conversations before Congress acts, they have understood that the medical prompt has become a political liability.

Lilith's verdict

A medical prompt is not advertising confetti for the next data trader. It is a clinic card slipped into someone else’s reception, and the question is who gets to walk away with it.