House Republicans Introduce SECURE Data Act to Replace All State Privacy Laws With a Single Federal Standard
A new GOP-backed bill would create a national consumer privacy framework but preempt stronger state laws like California's CCPA, reigniting a years-long battle over whether federal rules should be a floor or a ceiling.
Overview
House Republicans on April 22 introduced the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act — the SECURE Data Act — a comprehensive federal privacy bill that would establish a single national standard for consumer data rights and explicitly override the patchwork of state laws that has accumulated over the past decade. The legislation, led by a working group chaired by Rep. John Joyce (R-Pa.) and backed by House Energy and Commerce Committee Chair Brett Guthrie (R-Ky.), arrives alongside a companion GUARD Financial Data Act covering the financial sector, as reported by Bloomberg Law.
What the Bill Does
The SECURE Data Act would grant Americans four core rights over their personal data: access, correction, deletion, and portability. Consumers would also gain the right to opt out of targeted advertising, data sales, and automated profiling without human review. For sensitive categories — including health data, precise geolocation, financial information, and the personal data of anyone under the age of 16 — companies would be required to obtain affirmative opt-in consent before processing, according to the House Financial Services Committee announcement.
The bill includes a federal data broker registry, mirroring state-level registries already established in California, Texas, and Vermont. Companies processing data on more than 200,000 U.S. consumers, or those deriving 25 percent or more of their revenue from selling data on more than 100,000 people, would be subject to its requirements. Small businesses below $25 million in annual revenue would be exempt, according to an analysis by the IAPP.
Enforcement would be split between the Federal Trade Commission and state attorneys general. The bill contains no private right of action — consumers could not sue companies directly for violations.
The Preemption Battle
The most contested provision is the bill’s preemption clause. The SECURE Data Act would prohibit any state from “prescribing, maintaining, or enforcing any law, rule, regulation, requirement, standard, or other provision having the force and effect of law” that relates to any of its provisions, as analyzed by the Brookings Institution. That language represents a ceiling, not a floor — states could not enact or enforce stronger protections.
The bill would effectively nullify California’s Consumer Privacy Act, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, and more than 15 other state comprehensive privacy laws passed since 2018. It would also threaten sectoral state laws including the Illinois Biometric Information Privacy Act, Washington’s My Health My Data Act, and data broker registration systems including California’s Delete Act, according to the Brookings analysis.
“This Republican ‘privacy’ bill protects corporations and their bottom line, not people’s privacy,” said Rep. Frank Pallone (D-N.J.), ranking member of the House Energy and Commerce Committee, as reported by Bloomberg Law. Pallone argued the bill was drafted without Democratic input and “pre-empts consumer protections at the behest of Big Tech.”
Industry groups took the opposite view. The Chamber of Commerce, TechNet, and major tech and retail associations expressed support for the unified framework. Daniel Castro of the Information Technology Innovation Foundation said: “This bill moves the conversation in a more practical direction, focusing on real safeguards rather than recreating the burdensome, box-checking compliance regime seen under GDPR,” according to Bloomberg Law’s reporting.
Eric Null, director of a privacy and data program at the Center for Democracy and Technology, said the bill “would federally codify industry-favored state privacy rules while preempting state laws that include stronger protections, including requirements to affirmatively minimize collection of data and bans on selling certain sensitive information like Americans’ precise locations,” as reported by StateScoop.
What Is Missing
Privacy analysts identified several notable omissions. The bill contains no requirement to honor opt-out preference signals such as the Global Privacy Control — the browser-based mechanism California already requires businesses to respect. It provides no data protection impact assessment requirements. Its data minimization standard is weaker than in newer state laws, allowing companies to determine the scope of data collection through broad privacy policy disclosures rather than a necessity standard. Civil rights protections against discriminatory data use, which were included in the 2022 American Data Privacy and Protection Act, are absent, according to the Brookings analysis.
Historical Context and Prospects
The SECURE Data Act follows a pattern of federal privacy legislation that has collapsed before reaching a floor vote. The 2022 American Data Privacy and Protection Act passed committee 53-2 but never advanced after California’s objections over preemption led Speaker Nancy Pelosi to block it. The 2024 American Privacy Rights Act collapsed before full committee consideration after civil rights provisions were stripped.
The current bill faces structural obstacles that echo prior attempts: Democrats prefer a national floor that preserves stronger state protections, while Republicans are advancing maximum preemption. The bill requires 60 votes to advance in the Senate, forcing Republican negotiators to win Democratic support. Speaker Johnson’s thin majority in the House creates additional uncertainty, and the Brookings Institution describes the preemption debate as an “endgame issue” where resolution depends on political choices that neither party has yet been willing to make.
What We Don’t Know
- Whether House Republican leadership will schedule the bill for a committee markup and full floor vote.
- Whether any Democratic senators will support a version of the bill with its current preemption language.
- What California, Colorado, and other states with robust privacy agencies would do if the bill became law — including whether they would challenge preemption in court.
- Whether the absence of a private right of action could be modified in negotiation to attract Democratic votes.
The bill’s introduction comes as previously reported by The Machine Herald, states have accelerated the pace of sectoral privacy legislation in 2026 — creating more potential collision points between state and federal frameworks even before the SECURE Data Act advances to markup.