SECURE Data Act Explained: Requirements & Consumer Rights

The United States has no single national privacy law. Different states have different laws, so navigating them can be difficult. The SECURE Data Act aims to address a complex system of state laws by establishing a comprehensive federal data privacy framework.

Introduced in April 2026, the SECURE Data Act addresses important aspects of data protection, including consumer privacy rights, consent requirements, business responsibilities, data security, and regulatory enforcement.

If passed, the bill would override most state privacy laws, give consumers greater control over their Personal Information, and establish a single compliance standard for US businesses.

This guide explains what the SECURE Data Act proposes, who would need to comply, how it would protect consumer data, and how it compares with existing federal and state privacy laws.

What Is the SECURE Data Act and Why Does It Matter?

The SECURE Data Act, officially known as the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (H.R. 8413), is a federal bill introduced in the US House of Representatives on April 21, 2026. If passed, it will become the first comprehensive national privacy law in the United States.

The SECURE Data Act intends to simplify the current complex regulatory environment through a nationwide privacy framework. Its key objective is to establish consistent standards for how businesses collect, process, store, use, and share consumers' Personal Information.

The SECURE Data Act aims to:

Give Americans new rights over their personal data
The law will strengthen consumer privacy rights by giving individuals greater control over how organizations handle their personal information.
Establish consistent privacy standards
If passed, the framework will establish consistent data privacy standards for businesses, replacing many overlapping state privacy rules.
Improve transparency
It will require covered businesses to explain what information they collect and how they use or share it.
Improve business accountability
It imposes obligations on businesses that collect and process personal data.
Protect sensitive personal information
The law will require affirmative consent before processing sensitive data.

The SECURE Data Act was introduced by Representative John Joyce on April 21, 2026.

Consumer rights, data security, and data broker rules will take effect rules take effect 1 year after enactment. All other provisions will take effect 2 years after enactment.

The data framework matters for US businesses because it could significantly change the US privacy compliance landscape. Instead of managing numerous privacy frameworks, businesses could follow a common set of federal requirements.

Who Needs to Comply with the SECURE Data Act?

The bill applies to any organization that:

Does business in the U.S. or handles data of US residents, AND
Collects and processes data of more than 200,000 consumers per year and has annual gross revenue of at least $25 million; OR
Processes data of 100,000+ consumers per year and earns at least 25% of its annual gross revenue from selling personal data.

These provisions could affect e-commerce platforms, technology providers, online advertising companies, large retailers, telecommunications providers, and data-driven service businesses.

Who is exempt from the SECURE Data Act?

The SECURE Data Act exempts a wide range of entities and data types, including:

Government entities.
Financial institutions covered by the Gramm-Leach-Bliley Act.
HIPAA-covered entities.
Nonprofit organizations.
Institutions of higher education.

Small businesses will also be exempt from the law.

The proposal also exempts specific categories of information already protected under other federal laws. However, an exemption for one category of information does not automatically mean every activity an organization conducts is exempt.

Consumer Rights Under the SECURE Data Act

The law establishes five fundamental rights every American consumer would have over their personal data:

The right to access
Consumers would have the right to confirm whether a business processes their personal data and request access to that information.
The right to correct
Consumers would be able to request corrections to inaccurate personal information.
The right to delete
Consumers could request that a company delete personal data they collected about them or obtained from other sources. However, this right would not be absolute. Businesses could retain certain information when legally permitted, including for specified operational, security, or legal purposes.
The right to data portability
Consumers would have the right to obtain certain personal information in a portable, readily usable format. Where technically feasible, this would allow individuals to transfer information they previously provided from one service provider to another.
The right to opt out of certain data processing activities
Consumers would have the right to opt out of three important activities:
Targeted advertising: Companies tracking you to deliver advertisements based on your activities across different websites or services.
Sale of personal data: Selling consumer information to third parties, as defined under the legislation.
Certain automated profiling: Using AI or algorithmic systems to make significant decisions about you (housing, hiring, healthcare) with no human review.

How would consumers exercise their rights?

Under the SECURE Data Act, companies would need to:

Provide one or more secure, reliable ways to submit privacy requests.
Respond within 45 days of receiving a verified request.
Either comply with the request or explain in a written form why they’re declining and how to appeal.
Process your first two requests per right per year for free. All subsequent requests could be charged a reasonable fee.

When reasonably necessary, businesses could extend the response period by another 45 days, provided they notify the consumer and explain the extension.

Special rules for children and teenagers

The bill creates two distinct age categories with stronger data protection:

Children (individuals under 13)
Data must be governed by the existing Children’s Online Privacy Protection Act (COPPA). Parental consent rules already in place continue to apply.
Teenagers (individuals between 13–15 years)
The bill creates a new category. To process a teenager’s sensitive data, businesses must obtain prior and verifiable parental consent. Only a parent can exercise privacy rights on behalf of a teen.

Consent Requirements Under the SECURE Data Act

Consent plays an important role in the proposed SECURE Data Act, particularly when organizations process sensitive personal information.

Under the SECURE Data Act, consent means a clear, active choice by a consumer to allow processing of their personal data. It must be freely given, specific, and informed.

explicit consent for sensitive personal data

Under the proposed legislation, businesses would generally need to obtain affirmative consent before processing sensitive personal data.

Sensitive information can include:

Health-related data.
Racial or ethnic origin.
Religious beliefs.
Mental or physical health diagnosis.
Sexual orientation.
Citizenship or immigration status.
Genetic or biometric data processed to uniquely identify a specific individual.
Personal information belonging to a child (under 13) or a teen (ages 13 to under 16).
Precise geolocation data.

What constitutes valid consent under the SECURE Data Act?

The SECURE Data Act defines consent as a clear affirmative action demonstrating that an individual has freely given specific, informed, and unambiguous agreement to the processing of their personal information.

Continuing to browse a website would not satisfy the proposal's affirmative-consent definition.

The bill also outlaws dark patterns such as not interacting with the banner, using manipulative design or a pre-ticked box.

Consent for secondary uses of personal data

SECURE Data Act compliance requires businesses to obtain consent when processing personal information for purposes that are not reasonably necessary or compatible with the purposes initially disclosed to consumers.

For instance, if an organization collects an email address solely to deliver purchase confirmations, using that email for an unrelated purpose could require additional consent.

Parental consent for children and teenagers

For children under 13, businesses must obtain verifiable parental consent, as defined by the Children's Online Privacy Protection Act (COPPA).

For teens aged 13 to under 16, businesses must also obtain verifiable parental consent before processing their sensitive data. This opt-in requirement is a mandatory SECURE Data Act consent requirement.

Not sure if your website uses cookies and you have required consent? Scan your website for free and see what cookies, including Third-Party Cookies, your website uses:

Business Obligations Under the SECURE Data Act

SECURE Data Act requires businesses to provide clear privacy notices, follow data minimization principles, implement reasonable data security safeguards, establish processes for consumer privacy requests, manage third-party data processors, and meet additional requirements for data brokers.

The SECURE Data Act would introduce several obligations on controllers and processors. These requirements focus on transparency, data minimization, consumer rights, information security, non-discrimination, and accountability.

SECURE Data Act requirements include:

1. Provide clear and accessible privacy notices

Businesses would need to explain their data processing practices by providing a reasonably accessible privacy notice.

A privacy notice would need to provide the categories of personal data collected, the purposes for processing it, recipients, international transfers, retention periods, and how consumers can exercise their privacy rights.

2. Follow data minimization principles

The proposed law would require organizations to limit personal data collection to information that is adequate, relevant, and reasonably necessary for the purposes disclosed to consumers. Businesses cannot use that data for a different purpose without obtaining the consumer's opt-in consent.

3. Implement reasonable data security safeguards

Businesses would need to establish and maintain reasonable administrative, technical, and physical security measures. These protections must reflect the volume, sensitivity, and nature of the information processed.

Depending on the organization's risks, appropriate practices could include access controls, encryption, employee security training, and procedures to detect and respond to security incidents.

4. Establish processes for consumer privacy requests

Covered businesses would need reliable mechanisms to receive, authenticate, and respond to consumer requests involving access, correction, deletion, portability, and opt-out rights.

Organizations would also need to explain in their privacy policies how consumers can exercise their rights and appeal denied requests.

5. Manage third-party data processors

The SECURE Data Act would require contractual arrangements between data controllers and processors.

That contract must establish processing instructions, confidentiality obligations, the purpose, the type of personal data involved, the duration, and the rights and duties of each party.

Processors must also assist controllers with certain privacy and security obligations.

6. Meet additional requirements for data brokers

The SECURE Data Act includes dedicated requirements for qualifying data brokers.

A data broker is a business that collects personal data about people on behalf of other entities and earns 50 percent or more of its annual gross revenue from selling that data.

Data brokers would have these obligations:

Provide public notices on their websites disclosing that they are data brokers and explaining how consumers can exercise their rights.
Register annually with the FTC within 12 months of the act’s enactment.
Disclose the categories of personal information sold.

The legislation also proposes a searchable national data broker registry.

Enforcement and Penalties Under the SECURE Data Act

The SECURE Data Act would establish a federal and state enforcement framework designed to hold covered organizations accountable for privacy violations. The Federal Trade Commission (FTC) would serve as a primary enforcement authority.

Violations of the SECURE Data Act would be treated as violations of rules concerning unfair or deceptive acts or practices under the FTC Act.

State attorneys general would have enforcement authority, which would be coordinated and controlled by the FTC.

State attorneys general can take business to federal courts, seek to stop violations, enforce compliance, and recover damages.

Before the FTC or a state AG can take enforcement action, they must first send the business a written notice explaining the alleged violation. The business then has 45 days to fix the issue and confirm in writing that it has done so. Enforcement can only move forward if the business fails to fix the violation or commits violations repeatedly.

The SECURE Data Act does not give consumers a private right of action, meaning that individual consumers cannot sue businesses directly for violations.

What penalties could businesses face?

The proposed legislation does not establish one fixed, standalone penalty amount for every privacy violation. The precise financial consequences would depend on the applicable legal provisions and circumstances of a violation.

The SECURE Data Act incorporates applicable enforcement powers and penalties under the FTC Act. Consequences could include regulatory investigations, authorized civil penalties, compliance-related orders, and other remedies.

A notable feature of the SECURE Data Act is its 45-day opportunity to cure alleged violations.

Use a Consent Management Platform (CMP) to comply with existing state privacy laws and the coming SECURE Data Act and avoid penalties for non-compliance.

CookieScript CMP delivers the right balance of compliance, affordability, and ease of use. You’ll get a fully compliant consent management tool for as little as €8 per month/ per domain for basic features or for €19 per month/ per domain for full compliance with state privacy laws and the SECURE Data Act.

CookieScript CMP has the following features:

SECURE Data Act vs. Existing Federal and State Privacy Laws: What's Different?

The SECURE Data Act seeks to standardize consumer privacy while preserving many existing federal sector-specific protections.

SECURE Data Act vs. state privacy laws

The proposed SECURE Data Act shares several features with state privacy laws, such as the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (VCDPA), and Colorado Privacy Act (CPA).

The proposed Act grants consumers data privacy rights, including access rights, deletion requests, data portability, and opt-out mechanisms.

Compared to the CCPA and the CPRA, the SECURE Data Act is narrower in some areas. The CCPA applies to businesses earning $25 million or more in annual revenue, regardless of their data processing activities. The SECURE Data Act, however, requires businesses to meet both a revenue threshold and a data processing volume threshold.

Its biggest structural difference is its national scope. If enacted, the legislation would preempt state privacy laws and replace state-specific obligations with a single federal standard.

This could simplify compliance for organizations operating nationwide, but it could also replace certain state rules that currently provide stronger consumer protections.

SECURE Data Act vs. existing federal privacy laws

The SECURE Data Act would not simply replace existing federal privacy laws. Instead, it is designed to establish broader consumer privacy requirements while preserving existing federal protections that focus on specific industries, categories of personal information, or populations.

Federal privacy laws regulate specific industries or categories of personal information, and they remain in force.

For example:

HIPAA: Protects certain health information handled by covered healthcare organizations and business associates.
GLBA: Establishes privacy and information security requirements for certain financial institutions.
COPPA: Regulates the online collection of personal information from children under 13.

Frequently Asked Questions

What is the SECURE Data Act?

The SECURE Data Act is a federal bill introduced in the US House of Representatives on April 21, 2026. If passed, it will become the first comprehensive national privacy law in the United States, replacing state privacy laws, such as California's CCPA or Colorado CPA.

What are SECURE Data Act compliance requirements for businesses?

What is personal data under the SECURE Data Act?

Under the SECURE Data Act, personal data means any information that identifies or could reasonably be used to identify a specific person. It covers obvious identifiers like names, addresses, and email addresses, and it can also cover data that can identify individuals when combined with other information.

What is sensitive data under the SECURE Data Act?

Under the SECURE Data Act, sensitive information is a special category of personal data that can include health-related data, racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify a specific individual, personal information belonging to a child (under 13) or a teen (ages 13 to under 16), and precise geolocation data.

What will happen to state data privacy laws if the SECURE Data Act is enacted?

If enacted, the SECURE Data Act would replace the current US state data privacy laws, such as CCPA or Texas TDPSA. No state or local government can create or enforce any law that covers the same ground as this Act. As a result, businesses would only need to follow one federal standard. However, sector-specific federal laws, such as the Gramm-Leach-Bliley Act or HIPAA, would remain.

Can consumers file private lawsuits under the SECURE Data Act?

The SECURE Data Act does not create a private right of action, so consumers could not sue businesses solely for violating it. Instead, enforcement would primarily be handled by the FTC and authorized state officials- state attorneys general.

What would the SECURE Data Act mean for businesses?

If enacted, the legislation would replace state-specific obligations with a single federal standard. This could simplify compliance for organizations operating nationwide. Covered organizations would need to update their privacy policies, data-handling practices, consent mechanisms, processor contracts, and consumer-rights procedures.

Privacy laws

SECURE Data Act Explained: What You Need to Know About Federal Privacy Law