SECURE Data Act
- Sponsor
- Rep. Joyce, John [R-PA-13]
- Committees
- Judiciary Committee (primary)
- Last action
- Apr 21, 2026
Bottom line
The SECURE Data Act aims to create a uniform national standard for consumer data privacy, granting new rights to individuals and setting clear obligations for businesses, enforced by the FTC and State Attorneys General, while superseding existing and future state-level privacy laws.
What it actually does
This bill establishes a comprehensive national framework for consumer privacy rights and the protection of personal data. It grants consumers rights such as access, correction, deletion, and opt-out for targeted advertising and data sales, while imposing obligations on data controllers and processors regarding data minimization, security, and transparency. The bill also creates a registration system for data brokers and preempts state laws related to its provisions.
Proponents argue
Proponents argue this bill provides much-needed national uniformity for data privacy regulations, reducing the compliance burden on businesses currently navigating a patchwork of state laws. They contend it empowers consumers with clear, enforceable rights over their personal data, fosters innovation by providing regulatory certainty, and enhances data security across the economy.
Opponents contend
Opponents might argue that the bill's preemption of state laws could weaken consumer protections in states with stronger existing privacy statutes. Some may also contend that the compliance costs for businesses, particularly small and medium-sized enterprises, could be substantial, or that the enforcement mechanisms, including the 'right to cure' provision, are insufficient to deter violations effectively.
The bill is substantial, but its structure and clear language make it accessible for an informed reader to evaluate its core provisions and implications within a reasonable timeframe.
Section 2
Consumer Privacy Rights
This section grants consumers several core privacy rights, including the right to confirm if their data is being processed, access a copy of it, correct inaccuracies, delete their personal data, and obtain a portable copy. Crucially, it allows consumers to opt out of targeted advertising, the sale of personal data, and profiling that leads to significant legal or similar effects. It also requires explicit consent for processing sensitive data, with specific rules for children and teens.
Supporters argue
Supporters argue that these rights are fundamental to modern privacy expectations, giving individuals necessary control over their digital footprint. They believe clear, standardized rights will build consumer trust in online services.
Critics contend
Critics may argue that implementing these rights, particularly data deletion and portability, could be technically challenging and costly for businesses, potentially hindering innovation or leading to data fragmentation. Some may also raise concerns about the practicalities of verifying consent for teens.
Tradeoffs
The provision balances consumer empowerment with the operational feasibility and cost for businesses. It also navigates the tension between protecting sensitive data and allowing for legitimate business uses, particularly concerning age-gated consent.
Section 3
Controller Obligations
This section outlines duties for data controllers, including data minimization (limiting collection to what is necessary), restricting secondary uses of data without consent, and prohibiting processing data in violation of federal anti-discrimination laws. It also mandates non-discrimination against consumers for exercising their privacy rights and requires clear, accessible privacy notices detailing data practices, sharing, and cross-border transfers.
Section 4
Data Security Requirements
This section mandates that data controllers establish, implement, and maintain reasonable administrative, technical, and physical data security practices. These practices must be appropriate to the volume, sensitivity, and nature of the personal data being processed. The bill also provides a rebuttable presumption of compliance if a controller adheres to an approved code of conduct or a recognized risk management framework.
Section 5
Data Broker Regulation
This section specifically targets data brokers, requiring them to post a conspicuous public notice identifying themselves as data brokers and explaining how consumers can exercise their privacy rights. It also mandates annual registration with the Federal Trade Commission (FTC), providing details such as categories of data sold and security incidents. The FTC is then required to establish and maintain a searchable, central registry of these data brokers.
Section 8
Codes of Conduct and Certifications
This section establishes a system for approving industry-developed codes of conduct that meet or exceed the bill's requirements. Controllers or processors can submit applications to the Secretary of Commerce for approval, which includes a public comment period. Adherence to an approved code of conduct, or certain cross-border privacy rule certifications, grants a rebuttable presumption of compliance with the Act. The Secretary can also develop codes for small businesses.
Section 12
Enforcement Mechanisms
This section grants enforcement authority to the Federal Trade Commission (FTC), treating violations as unfair or deceptive acts or practices under the FTC Act. State Attorneys General are also authorized to bring civil actions on behalf of their residents. A key element is a 'right to cure' provision, requiring a 45-day notice period for alleged violations, during which a controller or processor can remedy the issue without facing an enforcement action.
Section 13
Applicability and Exemptions
This section defines which entities are covered by the Act, generally applying to persons subject to the FTC Act or common carriers that meet specific thresholds related to annual gross revenue and the number of consumers whose data they process. It also lists numerous exemptions, including federal, state, and local governmental entities, financial institutions (subject to GLBA), covered entities/business associates (subject to HIPAA), nonprofit organizations, institutions of higher education, and various types of health and employment-related data.
Section 15
Federal Preemption of State Laws
This section explicitly states that no state or political subdivision may prescribe, maintain, or enforce any law, rule, regulation, requirement, standard, or other provision having the force and effect of law, if such provision relates to the provisions of this Act.
Allows a controller to charge a reasonable fee or decline a consumer's privacy request if the consumer submits more than two requests per year for a specific right, or if the request is deemed 'technically infeasible or manifestly unfounded'.
Section 2(d)(3)(B)
Why it matters:This is a common legislative practice to include operational details and exceptions within procedural sections. It could also be seen as a way to manage potential abuse of consumer rights requests, but critics might argue it creates a barrier to exercising rights.
Case for: Supporters argue this prevents frivolous or excessively burdensome requests, protecting businesses from unreasonable administrative costs and potential harassment, ensuring resources are focused on legitimate requests.
Case against: Critics contend that this provision could create a financial barrier for consumers, especially if 'reasonable fee' is broadly interpreted, or if 'technically infeasible or manifestly unfounded' is used to arbitrarily deny requests, thereby undermining the spirit of consumer rights.
Estimated impact: Potentially limits the practical exercise of consumer rights for frequent requesters or those whose requests are deemed complex by controllers, affecting an unknown number of consumers and businesses.
Exempts controllers from complying with consumer rights requests (under Section 2) for pseudonymous data if the controller is not reasonably capable of associating the request with the personal data, does not use the data to recognize or respond to the specific consumer, and does not sell or voluntarily disclose the data (except to a processor).
Section 7(e)
Why it matters:This is standard legislative practice to define the boundaries of applicability for specific data types. It reflects a policy choice to balance privacy protections with the utility of data that is difficult to link to an individual.
Case for: Proponents argue this exemption is practical and necessary, as re-identifying pseudonymous data solely to fulfill a consumer request would be unduly burdensome and could undermine the purpose of pseudonymization. It allows for beneficial uses of data while maintaining a high degree of privacy.
Case against: Critics might argue that this exemption could create a loophole, allowing controllers to avoid fulfilling consumer rights by claiming data is pseudonymous and difficult to link, even if the risk of re-identification remains. They may contend it shifts the burden of proof onto the consumer.
Estimated impact: Potentially limits the scope of consumer privacy rights for a significant portion of data that businesses process in a pseudonymous form, affecting an unknown number of consumers and data processing activities.
Defines the applicability thresholds for businesses: either (A) collects and processes personal data of more than 200,000 consumers annually AND has an annual gross revenue of $25,000,000 or more, OR (B) collects and processes personal data of 100,000 or more consumers annually AND derives 25 percent or more of annual gross revenue from the sale of such personal data.
Section 13(a)(2)
Why it matters:This is standard legislative practice for defining the scope of a law, ensuring it targets entities of a certain size or business model. The specific numbers are critical policy choices.
Case for: Proponents argue these thresholds ensure the Act focuses on larger entities with significant data processing capabilities and revenue, minimizing the compliance burden on smaller businesses that may lack the resources to implement complex privacy frameworks.
Case against: Critics may contend that these thresholds are too high, allowing many medium-sized businesses that still process substantial amounts of consumer data to escape regulation. They might argue that even businesses below these thresholds can pose significant privacy risks.
Estimated impact: Determines which businesses are subject to the Act, effectively exempting a large number of smaller businesses from its direct requirements, affecting millions of consumers whose data is processed by these smaller entities.
Repeals Section 2710 of title 18, United States Code, which is the Driver's Privacy Protection Act (DPPA).
Section 14(c)
Why it matters:While technically a 'relationship' provision, repealing an entire Act is a substantive change. Its placement might be seen as a way to streamline the bill's language, but it could also be overlooked by readers focused on the new framework.
Case for: Proponents might argue that the new comprehensive federal privacy framework (SECURE Data Act) makes the sector-specific DPPA redundant or that the DPPA's provisions are now adequately covered or improved upon by the broader bill, simplifying the legal landscape.
Case against: Critics would argue that repealing the DPPA removes specific, established protections for highly sensitive driver's license information, potentially weakening privacy for this particular type of data if the new general framework does not offer equivalent or stronger safeguards. This could lead to increased commercial exploitation of driver data.
Estimated impact: Eliminates a specific federal privacy law protecting driver's license information, potentially altering how state DMVs and other entities handle and disclose such data, affecting millions of licensed drivers.