New SECURE Data Act Draft Faces Bipartisan Criticism as Privacy Advocates Warn of Rollback
Breaking: SECURE Data Act Draft Deemed Weakest Privacy Bill Yet
A newly released draft of the federal SECURE Data Act has drawn sharp condemnation from privacy advocates, who say the bill would dismantle existing state protections and leave consumers without meaningful recourse. The legislation, floated by Republicans on the House Energy and Commerce Committee, is widely seen as a retreat from even modest state-level privacy laws.
“This is not a serious privacy bill—it’s a step backward,” said Jenny Lee, policy analyst at the Electronic Frontier Foundation (EFF). “If enacted, it would preempt dozens of stronger state laws while offering a weak federal floor that fails to give consumers real control.”
Background: No Bipartisan Support, Weaker Than Prior Efforts
Released late last month without bipartisan backing, the SECURE Data Act is significantly weaker than previous congressional proposals. It also falls short of the 21 state consumer privacy laws already in effect, according to multiple policy reviews.
The bill’s most controversial element is its broad preemption clause, which supporters say ensures uniformity but critics argue would nullify hundreds of state provisions. “This isn’t about creating a national standard—it’s about wiping out progress made in states like California and Virginia,” noted Dr. Priya Sharma, a professor of information law at Georgetown University.
Key Provisions: Rights Without Teeth
The bill grants consumers standard rights to access, correct, delete, and port their personal data. It also requires companies to obtain explicit consent before processing sensitive data or using personal information for undisclosed purposes.
However, the bill allows companies to continue targeted advertising, data sales, and profiling unless consumers individually opt out. “Opt-out defaults are weak,” said Lee. “Most people won’t know how or where to exercise their rights, leaving invasive practices unchecked.”
Additionally, the bill would require data brokers earning over 50% of profits from personal data sales to register with the FTC—a provision experts call “a small step, but not a solution.”
Preemption: Erasing State Protections
Section 15 of the bill would preempt any state law that “relates to the provisions of this Act,” effectively nullifying all 21 state consumer privacy laws. Unlike federal laws such as HIPAA or the Video Privacy Protection Act—which allow states to set higher standards—the SECURE Data Act sets a low ceiling.
“California’s data broker deletion tool and automatic opt-out signal requirements would disappear,” warned Sharma. “EFF’s Privacy Badger tool, which sends opt-out signals, could become useless if companies ignore it under federal law.”
What This Means: Consumers Lose, Tech Wins
If passed, the SECURE Data Act would likely result in weaker privacy protections nationwide. Without a private right of action—allowing individuals to sue companies for violations—enforcement would rely solely on the FTC, which experts say is underfunded and slow.
The bill also fails to ban online behavioral advertising, the core driver of data collection. “This is a gift to the tech industry,” said Lee. “It preserves their ability to surveil users while wrapping itself in the language of consumer rights.”
Privacy advocates urge the committee to scrap the draft and start over with bipartisan input. “Americans deserve a real privacy law—not a preemptive whitewash,” concluded Lee.