On April 22, 2026, the House Energy & Commerce Committee released the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act, known as the SECURE Data Act. The proposal represents one of the most significant federal privacy efforts in recent memory, seeking to replace the increasingly fragmented patchwork of state consumer privacy laws with a single, uniform national standard. For businesses navigating overlapping and sometimes conflicting state regimes, the bill signals a potential turning point in how consumer data is regulated and how compliance programs are structured across the United States.
The SECURE Data Act would apply to companies that process the personal data of more than 200,000 U.S. consumers, with an express exemption for small businesses generating less than $25 million in annual revenue. This dual threshold meaningfully narrows the compliance population relative to several existing state laws, which often sweep in smaller enterprises or rely on lower processing thresholds. Mid-market and enterprise businesses, however, should anticipate substantive obligations under the proposed framework, particularly those engaged in advertising technology, analytics, or data brokerage activities.
Among the bill's central requirements are mandatory registration for data brokers, consumer opt-out rights for both data sales and targeted advertising, and opt-in consent for the processing of sensitive personal data. These provisions track many of the substantive protections found in leading state laws but consolidate them into a single federal regime, reducing the operational complexity of maintaining state-specific privacy notices, consent flows, and rights-response workflows.
Perhaps the most consequential feature for the business community is the absence of a private right of action. Enforcement under the SECURE Data Act would rest with regulators rather than private plaintiffs, materially reducing the class action exposure that has come to define privacy risk under several state regimes. While regulatory enforcement remains a meaningful consideration, the elimination of private litigation would shift the risk calculus for companies handling large volumes of consumer data.
The SECURE Data Act remains a proposal, and its scope, thresholds, and enforcement mechanics may evolve significantly during the legislative process. Clients should consult counsel for tailored advice regarding how the bill, if enacted, could affect their specific compliance posture and risk exposure.