SECURE Data Act: Privacy Advocates Warn of Weak Protections and Preemption of State Laws

Privacy advocates are sounding the alarm over a newly released federal privacy bill, warning it would roll back existing state protections and leave consumers with fewer rights than they already have. The SECURE Data Act, unveiled late last month by House Republicans without bipartisan support, is being criticized as a significant step backward for privacy rights in the United States.

“This bill is not a serious consumer privacy measure,” said Sarah Thompson, policy analyst at the Electronic Frontier Foundation (EFF). “It would gut stronger state laws and fail to give people the tools they need to protect their data.” The legislation’s most troubling provisions include broad preemption of state privacy laws and the absence of a private right of action, which would allow individuals to sue companies for mishandling their personal data.

Background

Federal privacy legislation has been a long-sought goal in Congress, with numerous proposals over recent years. Meanwhile, 21 states have enacted their own consumer privacy laws, many of which include robust protections like the right to sue and automatic opt-out mechanisms. The SECURE Data Act would override these state laws, replacing them with a weaker federal standard that experts say fails to address the most harmful data practices.

“The bill is weaker than prior bipartisan proposals and weaker than the state laws it would wipe out,” Thompson added. “It’s a classic race to the bottom, where federal law lowers the bar for everyone.” The bill’s release came just weeks after a series of high-profile data breaches, highlighting the urgency of strong privacy protections.

Key Provisions

The SECURE Data Act does grant consumers some basic rights, including access, correction, deletion, and limited data portability. It also requires companies to obtain explicit consent before processing sensitive data or using personal information for new purposes without notice.

However, the bill allows companies to continue engaging in targeted advertising, data sales, and profiling unless consumers individually opt out. This approach places the burden on users rather than requiring companies to protect privacy by default. “Opt-out systems are notoriously ineffective,” Thompson explained. “Most people never manage to opt out, so companies keep collecting and exploiting their data.”

Additionally, the bill mandates that data brokers earning at least half their profits from selling personal data register with the Federal Trade Commission. While this creates some transparency, critics say it does little to limit the underlying data abuse.

Preemption of State Laws

Perhaps the most far-reaching flaw is the bill’s sweeping preemption clause. Section 15 would invalidate any state law, rule, or regulation that “relates to” any provision of the act. This would wipe out all 21 existing state consumer privacy laws, including California’s, which features a data broker deletion tool and mandatory support for automatic opt-out signals like EFF’s Privacy Badger extension.

“State laws have been the laboratory for privacy innovation,” said University of Michigan law professor Elena Grant. “Congress should let states build on a federal floor, not demolish what they’ve already built.” The bill’s preemption language is far broader than typical federal statutes, which often allow states to add protections.

What This Means

If enacted, the SECURE Data Act would leave consumers with fewer tools to control their personal information, especially those in states with strong privacy laws. Without a private right of action, individuals would have to rely on the FTC and state attorneys general to enforce their rights—a system that has historically been underfunded and slow to respond.

“Companies would face little accountability for mishandling data, and consumers would lose the ability to defend themselves in court,” Thompson warned. The bill also fails to ban online behavioral advertising, the engine of the data economy, meaning companies would continue collecting vast amounts of personal information with minimal restrictions.

The bill now faces an uncertain path through Congress, with Democratic lawmakers expected to oppose it strongly. State legislators have also begun mobilizing to preserve their laws, and privacy advocates are urging the public to contact their representatives. “This is a critical moment for privacy in America,” Grant said. “We need a law that sets a high floor, not a weak ceiling.”