The US Federal Trade Commission voted unanimously to rescind a Biden-administration policy statement, issued in 2021 under then-chair Lina Khan, that extended federal data-breach notification rules to health and fitness apps, connected devices and other "vendors of personal health records" handling individually identifiable health information outside HIPAA's reach. The commission said the statement "provided minimal benefit," had been "superseded by rulemaking," and aligned with a White House directive to avoid "unnecessary use of subregulatory guidance." The unanimous vote follows the dismissal of Democratic commissioners, leaving the FTC composed entirely of Republican appointees, and narrows the breach-notification safety net for a fast-growing class of consumer health-data apps.

Source

• CyberScoop — FTC rescinds policy requiring health apps to notify customers after a breach (2026-09-09)
• FTC — Statement: "FTC Withdraws Obsolete Policy Statement" (2026-09)