The closest documented September 2026 Trump privacy update is the FTC's September 9 rescission of 2021 health-app guidance, not a new comprehensive privacy law. The underlying 2024 Health Breach Notification Rule remains in place, while the administration is also expanding Login.gov and tightening controls on sensitive data. For consumers, the practical issue is implementation: how agencies verify identity, how companies handle health information, and whether new systems exclude or wrongly affect people.
Table of Contents
- What did the FTC change?
- Does health-data enforcement continue?
- What does the Login.gov policy mean for consumers?
- When will agencies implement the change?
- What other privacy and security policies matter?
- Frequently Asked Questions
What did the FTC change?
The Federal Trade Commission rescinded its 2021 policy statement on breaches involving health apps and connected devices. The FTC said the statement provided minimal benefit and had been superseded by the 2024 Health Breach Notification Rule. The FTC's September 9 statement says the rescission removes guidance, not the underlying rule. That distinction matters.
A policy statement generally does not create substantive rights or binding obligations, while a rule can impose enforceable requirements. The September action therefore changes the agency's guidance framework rather than creating a new consumer privacy entitlement. The FTC also said protecting sensitive health information remains a priority. Its action reflects a narrower approach to subregulatory guidance, consistent with the administration's stated deregulatory agenda.
Does health-data enforcement continue?
Yes. In July, the FTC and state partners sued Hims & Hers, alleging that the telehealth company shared sensitive information about consumers' medical conditions with Meta, Snap, and other advertising platforms despite privacy promises. The case remained pending as of the FTC's September 10 update. The FTC's case announcement identifies the allegations and says the court will decide the case.
The complaint also alleges deceptive billing and cancellation practices. Those claims are allegations, not final findings, so consumers should not treat the case as proof that every telehealth provider uses the same practices. The practical lesson is to review privacy notices, tracking disclosures, recurring charges, and cancellation procedures before submitting a health intake form. Health information can be exposed through advertising technology even when a company publicly promises privacy.
What does the Login.gov policy mean for consumers?
An august 31 Office of Management and Budget memorandum directs agencies to offer Login.gov—the federal government's shared sign-on platform—for individuals using covered public-facing services. Agencies generally must use Login.gov's identity-verification service unless it does not fit a service's users, risks, or operations. The OMB memorandum also permits alternatives when Login.gov cannot fully serve a population or would impose significant burden. Centralization may reduce repeated identity checks and multiple accounts.
It also concentrates more public-service access around one identity system, making error handling, privacy safeguards, accessibility, and alternative pathways important. The policy has clear limits. It excludes the Department of War, national-security systems, and intelligence-community elements. Agencies may retain alternatives for groups that Login.gov cannot fully serve, including people with limited official records or people living abroad.
📨 Get Free Accountability Coverage Alerts
Free · No spam · Unsubscribe anytime
When will agencies implement the change?
The memorandum sets staged deadlines rather than an immediate universal switch. Agencies must: Readers should watch agency notices for changes to account creation, identity checks, and available alternatives. A failed verification attempt should not automatically mean a person loses access if the agency provides another permitted route.
- Inventory authenticated public-facing websites within 60 days.
- Complete digital-identity risk assessments within 240 days.
- Deploy Login.gov to high-impact services within one year, or notify OMB if they cannot.
- Cover remaining in-scope websites within two years, or submit the required notice.
What other privacy and security policies matter?
The administration's privacy posture also includes security-focused controls. The Justice Department's Data Security Program, effective April 8, 2025, restricts specified transactions that could give countries of concern access to Americans' bulk genomic, geolocation, biometric, health, financial, and other sensitive data. The Justice Department's Data Security page describes those controls. A June 22 quantum-security order directs faster federal migration to post-quantum encryption, including a pilot by December 31, 2027, and transitions for certain high-value assets by 2030 or 2031.
That addresses future confidentiality against advanced cryptographic attacks, but it does not create a new consumer-privacy right. Another important watchpoint is the revamped SAVE citizenship-verification system. A federal judge barred its use after finding that aggregating sensitive personal data could wrongly purge eligible voters; the Justice Department said it would continue defending the Department of Homeland Security's use of SAVE. The Associated Press report describes the ruling and the continuing dispute.
Frequently Asked Questions
Did Trump sign a comprehensive federal privacy law in September 2026?
The documented September action was the FTC's rescission of a 2021 health-app policy statement. The supplied evidence does not identify a new comprehensive federal privacy law.
Did the FTC stop enforcing health-data privacy?
No. The Hims & Hers case shows continuing enforcement activity, although the allegations remain unresolved.
What should Login.gov users watch for?
Watch for new identity-verification requirements, failed verification procedures, and whether an agency provides an alternative when Login.gov cannot serve a population.
You Might Also Like
- Trump Technology September 2026 Update: What Changed, Why It Matters, and What to Watch Next
- Trump Surveillance September 2026 Update: What Changed, Why It Matters, and What to Watch Next
- Trump Retail September 2026 Update: What Changed, Why It Matters, and What to Watch Next