SECURE Data Act

Bill Number

H.R. 8413

Origin Chamber

House

Congress

119th Congress, Session 2

Policy Area

Commerce

Status

Introduced

Latest Action

2026-04-21: Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

Last Updated

2026-05-20T19:43:28Z

AI-Generated Summary

Summary of H.R. 8413: SECURE Data Act

Purpose

The legislation aims to create a uniform national framework for protecting consumer privacy rights and personal data (information linked to an identifiable person). It grants consumers specific rights over their data, imposes obligations on businesses handling data, and establishes enforcement mechanisms while promoting secure cross-border data flows.

Key Provisions

• Consumer Rights (Sec. 2):
• Right to confirm processing, access, correct, delete personal data, and obtain portable copies.
• Right to opt out of targeted advertising (ads based on user data across sites), data sales, and automated profiling with significant effects (e.g., denying jobs or housing).
• Consent required for sensitive data (e.g., health, race, biometrics, child/teen data, precise location); stricter rules for children (<13, under COPPA) and teens (13-15, parental consent).
• Controllers must respond to requests within 45 days (extendable), free for first 2/year, with appeal process.
• Controller Obligations (Sec. 3):
• Collect only necessary data (data minimization); limit secondary uses without consent.
• No discrimination for exercising rights; provide clear privacy notices.
• Disclose data sales/targeted ads/profiling upfront.
• Data Security (Sec. 4): Implement reasonable safeguards; rebuttable presumption of compliance via codes or standards.
• Data Brokers (Sec. 5): Public notices, annual FTC registration, public registry.
• Processors (Sec. 6): Follow controller instructions; contracts ensure confidentiality, audits.
• Deidentified/Pseudonymous Data (Sec. 7): Strict rules to prevent re-identification; rights requests may not apply.
• Codes of Conduct (Sec. 8): Voluntary FTC/Secretary-approved programs for compliance presumption; special for small businesses.
• Cross-Border Flows (Sec. 9): Secretary of Commerce advises President, promotes compatible international standards.
• Other: Study on universal opt-out tech (Sec. 10); exemptions for law enforcement, research, etc. (Sec. 11).

Significant Changes to Existing Law

• Preemption: Overrides all state/local privacy laws (Sec. 15), creating federal uniformity.
• Enforcement (Sec. 12): FTC treats violations as unfair/deceptive practices; state AGs can sue (with notice/cure period); right to cure violations within 45 days.
• Applicability (Sec. 13): Targets businesses processing data of 100,000+ consumers (if data sales >25% revenue) or 200,000+ with $25M+ revenue; exempts government, finance (GLBA), health (HIPAA), nonprofits, education.
• Repeals/Overrides: Repeals video rental privacy law (18 U.S.C. §2710); limits FCC authority over data (except emergencies).
• No Conflict: Complements existing federal laws like COPPA, HIPAA, FCRA.

Potential Impacts

• Citizens: Enhanced control over data, easier opt-outs/deletions, but possible fees for excessive requests; protections for kids/teens.
• Government Agencies: FTC gains broad enforcement (including over common carriers); Secretary of Commerce leads international policy; states limited to federal framework.
• Businesses: Compliance costs (notices, responses, security); benefits from preemption, codes of conduct, data flow facilitation.
• International Relations: Promotes U.S. data exports, assesses foreign laws (e.g., restrictions by "covered nations" like China), enables agreements without weakening standards.

Main Stakeholders Affected

• Consumers: Primary beneficiaries of rights and protections.
• Controllers/Processors: Tech firms, retailers, advertisers (e.g., those meeting thresholds).
• Data Brokers: Required to register and disclose.
• FTC and State AGs: Enforcement roles.
• Secretary of Commerce: International coordination.
• Exempt Entities: Banks, hospitals, nonprofits unaffected.
• Small Businesses: Optional lighter codes.

Notable Legal, Constitutional, or Political Implications

• Federal Preemption: Shifts authority from states (e.g., California CCPA) to federal level, reducing patchwork but limiting state innovation.
• Constitutional Safeguards: Explicitly protects free speech, personal activities (Sec. 11(e)); no waiver of rights in contracts (Sec. 3(f)).
• Enforcement Balance: Cure periods avoid strict liability; rebuttable presumptions encourage compliance tools.
• Political: Bipartisan sponsors; effective 1-2 years post-enactment (earlier for core rights/security/brokers); severability ensures partial survival if challenged.
• No Private Right of Action: Relies on FTC/states, avoiding litigation flood.

This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.

Sponsor

Rep. Joyce, John [R-PA-13]

Cosponsors (8)

Rep. Fry, Russell [R-SC-7], Rep. Kean, Thomas H. [R-NJ-7], Rep. Obernolte, Jay [R-CA-23], Rep. Langworthy, Nicholas A. [R-NY-23], Rep. Goldman, Craig A. [R-TX-12], Rep. Griffith, H. Morgan [R-VA-9], Rep. Balderson, Troy [R-OH-12], Rep. Fedorchak, Julie [R-ND-At Large]

Recent Actions

• 2026-04-21: Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
• 2026-04-21: Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
• 2026-04-21: Introduced in House
• 2026-04-21: Introduced in House

Bill Versions

• Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act — issued 2026-04-21 — PDF (65 pages)