Why the SECURE Data Act Fails to Protect Consumer Privacy

Introduction

The proposed SECURE Data Act, recently released as a draft by Republicans on the House Energy and Commerce Committee, has drawn sharp criticism from privacy advocates. Rather than strengthening consumer protections, the bill would roll back existing state-level safeguards and leave individuals with limited recourse against corporate data abuses. This article examines the bill's key provisions, its problematic preemption of state laws, and the major flaws that make it a weak alternative to current privacy frameworks.

Why the SECURE Data Act Fails to Protect Consumer Privacy — Source: www.eff.org

Key Provisions of the SECURE Data Act

Standard Consumer Rights

The bill grants individuals the right to access, correct, delete, and port their personal data—rights that have become common in privacy legislation. While these are positive steps, they do little to address deeper systemic issues.

Consent for Sensitive Data

Companies would need consumer consent before processing sensitive data (e.g., health, biometric, or precise location) or using personal data for previously undisclosed purposes. Without consent, such activities are prohibited.

Opt-Out Mechanism

The bill allows consumers to opt out of (1) targeted third-party advertising, (2) the sale of personal data, and (3) profiling that has legal, housing, or employment consequences. However, these invasive practices continue until an individual actively opts out—a burden that many will not overcome.

Data Broker Registry

Data brokers deriving at least 50% of revenue from selling personal information must register in a public Federal Trade Commission (FTC) database. While this is a transparency measure, it does not restrict the underlying data sales.

Preemption of Stronger State Laws

One of the most troubling aspects of the SECURE Data Act is its broad preemption clause (Section 15), which would wipe out any state law “related to the provisions of this Act.” This would invalidate all 21 existing state consumer privacy laws, including California’s leading protections—such as the data broker deletion tool and mandatory compliance with automatic opt-out signals. By contrast, landmark federal privacy laws like the Health Insurance Portability and Accountability Act (HIPAA), the Video Privacy Protection Act (VPPA), and the Electronic Communications Privacy Act (ECPA) allow states to build stronger protections on top of a federal floor. The SECURE Data Act takes the opposite approach, erasing state innovations that often surpass federal inadequacies.

Major Flaws Undermining Privacy

No Private Right of Action

The bill does not allow consumers to sue companies for privacy violations—known as a private right of action. This leaves enforcement solely to the FTC, which has limited resources, and denies individuals the ability to directly defend their own rights. Without this deterrent, companies face little risk for noncompliance.

Weak Opt-Out Defaults

As noted, the opt-out system places the burden on consumers to take action. Many people remain unaware of their rights or find the process cumbersome, meaning companies can continue tracking and profiling them by default.

Inadequate Data Minimization

The bill lacks strong data minimization requirements—principles that compel companies to collect only the data necessary for a specific purpose. Without such limits, firms are free to gather excessive information, fueling the behavioral advertising ecosystem.

Definitional Loopholes

Vague terms and broad exemptions create loopholes that allow companies to circumvent the law. For instance, “targeted advertising” may be narrowly defined, exempting certain cross-context tracking practices. Similarly, exemptions for “security” or “service improvement” can be exploited to justify extensive surveillance.

Failure to Ban Behavioral Advertising

Unlike the California Privacy Rights Act (CPRA) or the proposed American Privacy Rights Act, the SECURE Data Act does not prohibit online behavioral advertising. Instead, it merely provides an opt-out—a weak measure given that third-party tracking remains the primary driver of data collection and monetization. Until such practices are banned outright, consumer privacy remains under constant threat.

Conclusion

The SECURE Data Act falls far short of genuine privacy reform. By preempting stronger state laws, eliminating private enforcement, and failing to tackle core harms like behavioral advertising, the bill would leave Americans worse off than they are today. While federal legislation is needed to create a uniform baseline, it must not sacrifice protections that communities have fought to secure. Lawmakers should reject this draft and work toward a bill that truly puts consumers first.