Key Takeaways
- • House Republicans introduced the SECURE Data Act (H.R. 8431) on April 22, 2026, establishing a federal privacy framework covering entities processing data on 200,000+ individuals annually with $25M+ revenue, or 100,000+ individuals deriving 25%+ revenue from data sales, with phased implementation over one and two years.
- • The legislation preempts state privacy laws, vests enforcement authority in the FTC and state attorneys general, and explicitly excludes private rights of action—provisions expected to generate Democratic opposition and likely legislative friction.
- • The Act mandates opt-in consent for sensitive data categories (including health, biometric, genetic, and geolocation data), grants consumers rights to access, correct, delete and port personal data, and requires data brokers to register with the FTC and maintain a searchable central registry within 18 months of enactment.
- • The bill exempts regulated financial institutions under the Gramm-Leach-Bliley Act (GLBA), HIPAA-covered entities, government agencies, and nonprofits, while preserving existing federal sectoral privacy regimes including COPPA, FCRA, FERPA, and the DPPA, though it repeals the Video Privacy Protection Act.
- • The legislation emerged from over 12 months of negotiations with 170+ stakeholders producing 250+ written responses, but notably excludes Democratic input—a departure from bipartisan 2022 and 2024 privacy bill attempts that stalled—and faces compressed legislative timelines amid midterm election priorities.
Summary
On April 22, 2026, House Energy and Commerce Committee Republicans unveiled the SECURE Data Act (H.R. 8431), a comprehensive federal privacy framework developed through 12+ months of stakeholder consultation involving 170+ participants and 250+ written submissions. Simultaneously, the House Financial Services Committee Republicans introduced the GUARD Financial Data Act (H.R. 8398), modernizing Gramm-Leach-Bliley Act regulations. The privacy bill represents the first major Republican-led comprehensive privacy proposal in the current Congress and differs significantly from prior bipartisan efforts, including the 2022 American Data Privacy Protection Act and the 2024 American Privacy Rights Act, both of which ultimately stalled—the former due to California preemption objections and Senate opposition to private rights of action.
The SECURE Data Act applies a broad regulatory scope covering any entity that collects and processes personal data on more than 200,000 individuals annually with gross revenue exceeding $25 million, or processes data on 100,000+ individuals while deriving 25% or more of annual revenue from data sales. Notably, payment transaction data is excluded from these thresholds. The legislation establishes mandatory consumer rights including access, correction, deletion, and data portability, alongside the right to opt out of targeted advertising, data sales, and automated profiling decisions with legal significance. Controllers must obtain explicit opt-in consent before processing "sensitive data"—defined to include racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship status, genetic and biometric data, and precise geolocation data—with heightened protections extending to teenagers under age 16, requiring verified parental consent.
The Act imposes strict data minimization and purpose limitation obligations on data controllers, requiring collection limited to information "adequate, relevant and reasonably necessary" for disclosed purposes, with secondary uses prohibited absent consumer consent or reasonable compatibility. Controllers must provide accessible, clear privacy notices before processing, itemizing data categories, processing purposes, consumer rights, third-party disclosures, and transfers to "covered nations" (North Korea, China, Russia, Iran). Data security provisions require reasonable safeguards calibrated to data volume and sensitivity, with rebuttable compliance presumptions for entities adhering to approved codes of conduct or recognized risk management frameworks. The legislation introduces a federal data broker registry administered by the FTC, requiring brokers to publicly disclose status, register annually, report security incidents and data categories sold, with the FTC maintaining a searchable central registry within 18 months featuring privacy policy links and consumer rights exercise instructions.
Implementation occurs on a two-phase timeline: provisions governing controllers, data security, and data brokers take effect one year after enactment; all remaining provisions become effective two years post-enactment. Enforcement authority is vested exclusively in the FTC and state attorneys general under unfair and deceptive practices standards, with state AGs authorized to pursue civil actions as parens patriae. The bill notably excludes private rights of action—a structural choice aligned with several state privacy laws but anticipated to face Democratic opposition. The legislation preempts state privacy laws while preserving existing federal sectoral regimes including COPPA, HIPAA, HITECH, FCRA, FERPA, and the Driver's Privacy Protection Act, though it repeals the Video Privacy Protection Act. Exempt entities include GLBA-regulated financial institutions, HIPAA-covered entities and business associates, government agencies, nonprofits, and higher education institutions.
The compressed legislative calendar presents significant advancement obstacles. Congressional leadership prioritizes must-pass legislation and politically salient issues ahead of midterm elections, leaving limited floor time for comprehensive new initiatives. The Energy and Commerce Committee's Commerce, Manufacturing, and Trade Subcommittee is expected to hold a legislative hearing on the SECURE Data Act in coming weeks. The bill's absence of Democratic participation—a notable departure from past bipartisan privacy efforts—and structural features opposing private rights of action and preempting state laws position partisan conflict as a central obstacle to passage, though the Act's preservation of multiple federal sectoral schemes and alignment with concepts already embedded in existing state privacy law frameworks may accelerate organizational compliance assessment processes.
The SECURE Data Act applies a broad regulatory scope covering any entity that collects and processes personal data on more than 200,000 individuals annually with gross revenue exceeding $25 million, or processes data on 100,000+ individuals while deriving 25% or more of annual revenue from data sales. Notably, payment transaction data is excluded from these thresholds. The legislation establishes mandatory consumer rights including access, correction, deletion, and data portability, alongside the right to opt out of targeted advertising, data sales, and automated profiling decisions with legal significance. Controllers must obtain explicit opt-in consent before processing "sensitive data"—defined to include racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship status, genetic and biometric data, and precise geolocation data—with heightened protections extending to teenagers under age 16, requiring verified parental consent.
The Act imposes strict data minimization and purpose limitation obligations on data controllers, requiring collection limited to information "adequate, relevant and reasonably necessary" for disclosed purposes, with secondary uses prohibited absent consumer consent or reasonable compatibility. Controllers must provide accessible, clear privacy notices before processing, itemizing data categories, processing purposes, consumer rights, third-party disclosures, and transfers to "covered nations" (North Korea, China, Russia, Iran). Data security provisions require reasonable safeguards calibrated to data volume and sensitivity, with rebuttable compliance presumptions for entities adhering to approved codes of conduct or recognized risk management frameworks. The legislation introduces a federal data broker registry administered by the FTC, requiring brokers to publicly disclose status, register annually, report security incidents and data categories sold, with the FTC maintaining a searchable central registry within 18 months featuring privacy policy links and consumer rights exercise instructions.
Implementation occurs on a two-phase timeline: provisions governing controllers, data security, and data brokers take effect one year after enactment; all remaining provisions become effective two years post-enactment. Enforcement authority is vested exclusively in the FTC and state attorneys general under unfair and deceptive practices standards, with state AGs authorized to pursue civil actions as parens patriae. The bill notably excludes private rights of action—a structural choice aligned with several state privacy laws but anticipated to face Democratic opposition. The legislation preempts state privacy laws while preserving existing federal sectoral regimes including COPPA, HIPAA, HITECH, FCRA, FERPA, and the Driver's Privacy Protection Act, though it repeals the Video Privacy Protection Act. Exempt entities include GLBA-regulated financial institutions, HIPAA-covered entities and business associates, government agencies, nonprofits, and higher education institutions.
The compressed legislative calendar presents significant advancement obstacles. Congressional leadership prioritizes must-pass legislation and politically salient issues ahead of midterm elections, leaving limited floor time for comprehensive new initiatives. The Energy and Commerce Committee's Commerce, Manufacturing, and Trade Subcommittee is expected to hold a legislative hearing on the SECURE Data Act in coming weeks. The bill's absence of Democratic participation—a notable departure from past bipartisan privacy efforts—and structural features opposing private rights of action and preempting state laws position partisan conflict as a central obstacle to passage, though the Act's preservation of multiple federal sectoral schemes and alignment with concepts already embedded in existing state privacy law frameworks may accelerate organizational compliance assessment processes.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.