SECURE Data Act Preemption Would Rewrite U.S. Privacy Compliance

For the first time in years, a comprehensive federal privacy bill has real momentum behind it. On April 22, 2026, House Republicans on the Energy & Commerce Committee introduced H.R. 8413, the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act — the SECURE Data Act — with backing from the chairs of both Energy & Commerce and Financial Services, and the stated intent to push it through committee1617. For compliance teams, this is the most consequential privacy development since California's CCPA, and the reason is structural rather than substantive: the bill's significance lies less in the rights it creates — which largely track what most states already require — than in how it would restructure the regulatory landscape by preempting that state patchwork.

The context is a decade of failure. The United States remains the only G20 country without a comprehensive federal privacy statute, and recent attempts — the American Data Privacy and Protection Act and the American Privacy Rights Act — both stalled in Congress, with APRA dying in January 2025 after House leadership signaled it would block the bill regardless of committee action18. Into that vacuum, roughly twenty states have enacted their own comprehensive privacy laws, with Indiana, Kentucky, and Rhode Island adding theirs on January 1, 2026, and Oklahoma and Alabama arriving in 2027 — leaving businesses to manage a rolling, ever-expanding set of state-by-state obligations1017.

What the SECURE Data Act would actually require

The bill builds on the consensus framework most states have already adopted, but with meaningful federal additions. Covered entities — those doing business in the U.S. or processing U.S. residents' data above certain volume thresholds — would need to give consumers rights to access, correct, delete, and obtain copies of their personal data, plus opt-outs for targeted advertising, data sales, and consequential profiling decisions11. Controllers would have to publish privacy notices identifying every category of data processed, every purpose, and every category of data shared with other controllers or governments11.

Two obligations deserve particular attention from compliance leadership. First, data minimization: collection must be limited to what is "adequate, relevant, and reasonably necessary" for disclosed purposes, with consent required before any non-disclosed secondary use1118. Second, sensitive data — health information, precise geolocation, race and ethnicity data, and data of children under 13 and teens aged 13-15 — could only be processed with opt-in affirmative consent, with the teen category requiring parental consent1618.

The bill also creates a national data broker registry: brokers would register annually with the FTC, which would maintain a public registry linking to broker websites so consumers can exercise their rights directly16. Because the framework regulates brokers inside the general privacy law, it could effectively sweep away the state-specific broker statutes that have proliferated separately17.

Notably absent from the bill are several features compliance teams might have expected from a "comprehensive" law. There is no requirement for data protection impact assessments on higher-risk activities, no universal opt-out mechanism (the Commerce Secretary is instead directed to study the question and report within three years), and no private right of action1718.

The preemption fight is the whole ballgame

Everything else in this bill is negotiable; preemption is the reason it exists. The bill would override state laws that "relate to" its provisions, replacing 21 comprehensive state statutes with one federal standard1116. State attorneys general would retain the ability to sue in federal court to enforce the new act, but the substantive floor would be set in Washington11.

Supporters, including the U.S. Chamber of Commerce, argue that national standards lower barriers to entry and reduce an untenable multi-jurisdictional burden. Opponents see it differently: states like California built deliberately stronger regimes, and a federal floor would function as a ceiling, rolling back protections consumers already have. That precise fault line killed APRA in 2024, when California Democrats balked at language that could undermine their home-state law8. The SECURE Data Act's sponsors reportedly spent over a year building intra-Republican consensus before introduction — a direct lesson from the defections that killed prior bills — but the bill still lacks bipartisan support, and it would need 60 Senate votes to survive a filibuster.

My read: this bill is the strongest vehicle federal privacy has had in years precisely because it is partisan. It was designed to move through a House committee controlled by one party, not to win a bipartisan stamp of approval. That makes committee progress likely and enactment genuinely uncertain — and it means compliance teams should treat it as a live planning scenario, not a hypothetical.

Competing visions are already on the table

The SECURE Data Act is not the only federal proposal in this Congress, and the contrasts matter for compliance planning. Rep. Zoe Lofgren's Online Privacy Act of 2026, introduced March 19, 2026, would go far further in the opposite direction: GDPR-style rights including deletion, portability with real-time APIs, and a "right to impermanence" limiting retention; aggressive minimization duties; preservation of end-to-end encryption; and an entirely new federal regulator, the Digital Privacy Agency, with an appropriation of $550 million per year214. Critically, it includes a private right of action and bans predispute arbitration for privacy claims, meaning class-action exposure rather than just regulatory enforcement14. It would also create a federal doxxing crime carrying up to 15 years14.

A Senate counterpart, the Consumer Data Privacy and Security Act of 2026, takes yet another approach — including deemed-consent provisions, designated privacy officers, and a requirement that the FTC hire at least 440 additional enforcement personnel12. That these bills coexist illustrates the real problem: the parties don't merely disagree on details, they disagree on the enforcement architecture, the regulator, and whether consumers should be able to sue at all. Analysts tracking the Lofgren bill note it has a single sponsor and little traction — a step in the right direction, perhaps, but not a rival14.

What compliance teams should do now

Even if enactment is uncertain, the compliance preparation is not wasted, because the SECURE Data Act largely mirrors what sophisticated operators already do under state law. Three gaps are worth closing immediately.

First, data inventory and purpose mapping. Minimization tied to disclosed purposes — and consent gates for secondary uses — requires knowing what you hold and why, which many organizations still cannot document at the category level the bill demands1118.

Second, sensitive-data consent flows. Opt-in consent for precise geolocation, health data, and teen data is a genuine technical and UX project, not a policy update, and it is where state laws and this bill both converge1618.

Third, vendor and broker hygiene. The bill pushes contractual obligations onto processors, and broker registration with the FTC would interact with existing state broker regimes; companies that have already built CCPA-compliant programs should specifically test them against the broker, minimization, and consumer-rights provisions rather than assuming portability1117.

One more consideration cuts in compliance's favor: the bill's enforcement model is deliberately forgiving by design. Enforcement sits exclusively with the FTC and state attorneys general, and regulators must give written notice citing the specific provision violated and allow at least 45 days to cure before proceeding — a guaranteed right-to-fix that softens the compliance cliff considerably1618. Under the Lofgren bill, by contrast, there is no cure period, there are private plaintiffs, and there is a dedicated agency — an enforcement environment with far higher stakes14. The direction Congress ultimately chooses on that single question — who can enforce, and how — will shape privacy compliance budgets for a decade.

For now, the honest status report is this: no federal law exists yet13. But with a partisan-backed House bill advancing, a maximalist alternative on record, and states continuing to layer on obligations through 2027, the compliance question in 2026 is no longer whether to prepare for a national privacy standard — it is which one.