Overview

The SECURE Data Act establishes a comprehensive national framework for consumer data privacy and protection in the United States. The legislation creates enforceable consumer rights over personal data, imposes substantive obligations on entities that collect and process such data, and builds a regulatory infrastructure administered primarily by the Federal Trade Commission. The bill's central objective is to standardize privacy protections across the country, replacing the fragmented patchwork of state-level privacy laws with a unified federal standard. It addresses the full lifecycle of personal data — from collection and processing to storage, transfer, and deletion — and applies to a broad range of commercial actors including controllers, processors, and data brokers. The Act also establishes a formal registry for data brokers, creates a code of conduct approval mechanism, and provides both federal and state-level enforcement pathways. By granting consumers affirmative rights and imposing baseline security and transparency obligations on industry, the bill represents one of the most expansive federal privacy proposals to date.

Core Provisions

The Act creates four foundational consumer rights under §2: the right to access personal data held by a controller, the right to correct inaccuracies in that data, the right to delete personal data, and the right to opt out of processing for targeted advertising and the sale of personal data. Controllers must respond to consumer requests within a defined period, with an allowable 45-day extension when reasonably necessary. Controllers are also prohibited from processing personal data in violation of federal anti-discrimination laws, and must obtain affirmative consent before processing sensitive data as defined under §16(30). Under §3, controllers must implement and maintain comprehensive data security programs, conduct data protection impact assessments, and enter into binding contracts with processors that govern the scope and purpose of data processing. Processors, in turn, are required to act solely on controller instructions and maintain equivalent data security standards. The Act's data broker provisions under §5 require data brokers to post conspicuous notices on their websites and mobile applications disclosing their data practices. The Commission is directed to establish a publicly searchable, centralized data broker registry no later than 18 months after enactment, with data brokers required to register within 12 months of enactment. Section 8 authorizes the FTC to approve codes of conduct for processors and other covered entities, with a 90-day public comment period and 180-day approval or denial window for applications. The Secretary of Commerce is assigned duties related to cross-border data flows under §9, and the Act addresses the treatment of deidentified and pseudonymous data under §7, establishing conditions under which such data falls outside the Act's core requirements.

Key Points

• Consumer right to access, correct, delete personal data, and opt out of targeted advertising and data sales [§2]
• Controller obligation to implement data security programs and conduct impact assessments [§3, §4]
• Processor obligation to follow controller instructions and maintain data security [§3, §6]
• Data broker registration requirement within 12 months of enactment [§5]
• FTC-maintained public data broker registry established within 18 months of enactment [§5]
• FTC code of conduct approval process with 90-day comment and 180-day decision windows [§8]
• Consent required for processing sensitive data [§3(c)]
• Secretary of Commerce responsibilities for cross-border data flow governance [§9]

Legal References

• 15 U.S.C. 6501 et seq. (Children's Online Privacy Protection Act of 1998)
• 15 U.S.C. 6801 et seq. (Title V, Gramm-Leach-Bliley Act)
• 42 U.S.C. 1320d et seq. (Part C of Title XI, Social Security Act / HIPAA)
• 42 U.S.C. 17921 et seq. (Subtitle D, HITECH Act)
• 15 U.S.C. 41 et seq. (Federal Trade Commission Act)
• 20 U.S.C. 1232g (Family Educational Rights and Privacy Act of 1974)
• 15 U.S.C. 1681a(f) (Fair Credit Reporting Act)
• 15 U.S.C. 6809 (Gramm-Leach-Bliley Act definitions)
• 7 U.S.C. 21 (Commodity Exchange Act)
• 15 U.S.C. 78o–3 (Securities Exchange Act of 1934)

Implementation

The Federal Trade Commission serves as the primary federal enforcement authority under §12, with broad authority to enforce the Act's requirements against covered entities. State attorneys general are granted concurrent authority to bring civil actions on behalf of their residents, creating a dual-track enforcement structure. The FTC also holds the right to intervene in state-initiated actions, ensuring federal coordination and consistency in enforcement outcomes. The Secretary of Commerce plays a supporting role, particularly with respect to cross-border data flows under §9 and the publication of codes of conduct for smaller businesses that do not meet the Act's primary applicability thresholds, with that publication required no later than two years after enactment. Independent organizations may administer approved codes of conduct, subject to FTC oversight and a 180-day cure period for alleged deficiencies. Compliance obligations are phased in over time: data brokers must register within 12 months, the registry must be operational within 18 months, and the Act's broader provisions take effect two years after enactment. The Secretary is further required to publish a report on universal opt-out mechanisms within three years of enactment. No specific funding appropriations are identified in the bill text, leaving resource allocation to the discretion of Congress and the relevant agencies. Reporting requirements are not extensively detailed in the available sections, though the data broker registry and codes of conduct framework create ongoing administrative obligations for the FTC.

Legal References

• 15 U.S.C. 41 et seq. (Federal Trade Commission Act)
• Communications Act of 1934
• Health Insurance Portability and Accountability Act (HIPAA)
• Gramm-Leach-Bliley Act

Impact

The Act's primary beneficiaries are American consumers, who gain affirmative, enforceable rights over their personal data for the first time under federal law. These rights — to access, correct, delete, and opt out of certain uses of their data — represent a significant shift in the balance of power between individuals and the commercial entities that profit from their information. Data brokers face the most immediate and concrete compliance burden, as they must register with the FTC within 12 months and maintain public-facing disclosures about their data practices. Controllers and processors across industries face substantial administrative obligations, including the implementation of data security programs, execution of compliant processor contracts, and the conduct of data protection impact assessments. The compliance burden is expected to be significant for small and mid-sized businesses that lack existing privacy infrastructure, though the codes of conduct mechanism provides a potential pathway for streamlined compliance. The Act's exemptions for certain entities — including financial institutions covered by the Gramm-Leach-Bliley Act, entities subject to HIPAA, and non-profit organizations — limit its direct applicability to a subset of the commercial data ecosystem. The long-term expected outcome is a more transparent and accountable data marketplace, with reduced incidence of unauthorized data use, discriminatory profiling, and data breaches. No formal cost estimates are provided in the available bill text, and no sunset provisions are identified.

Legal References

• 15 U.S.C. 6801 et seq. (Gramm-Leach-Bliley Act)
• 42 U.S.C. 1320d et seq. (HIPAA)
• 15 U.S.C. 6501 et seq. (COPPA)

Legal Framework

The Act derives its constitutional authority from Congress's Commerce Clause power, as it regulates commercial entities engaged in the collection, processing, and sale of personal data in interstate commerce. The FTC's enforcement authority is grounded in the Federal Trade Commission Act, and the Act explicitly incorporates the penalties and immunities provided under that statute. The bill establishes federal preemption of state privacy laws under §15, creating a uniform national standard that supersedes the growing body of state-level privacy legislation, including laws enacted in California, Virginia, Colorado, and other states. This preemption is one of the Act's most legally significant and politically contentious features, as it would displace stronger state protections in exchange for a guaranteed federal floor. The Act intersects with and partially defers to several existing federal regulatory regimes, including HIPAA for health data, the Gramm-Leach-Bliley Act for financial data, COPPA for children's data, and the Family Educational Rights and Privacy Act for educational records — entities already subject to these regimes are generally exempted from duplicative requirements. The codes of conduct framework under §8 creates a quasi-regulatory mechanism through which private organizations can develop and administer compliance standards subject to FTC approval, a model with precedent in other regulatory contexts. Judicial review provisions are not explicitly detailed in the available sections, but enforcement actions by the FTC and state attorneys general would be subject to standard administrative and civil litigation procedures.

Legal References

• U.S. Const. art. I, §8, cl. 3 (Commerce Clause)
• 15 U.S.C. 41 et seq. (Federal Trade Commission Act)
• 15 U.S.C. 6501 et seq. (COPPA)
• 15 U.S.C. 6801 et seq. (Gramm-Leach-Bliley Act)
• 42 U.S.C. 1320d et seq. (HIPAA / Part C of Title XI, Social Security Act)
• 42 U.S.C. 17921 et seq. (HITECH Act, Subtitle D)
• 20 U.S.C. 1232g (FERPA)
• 15 U.S.C. 1681a(f) (Fair Credit Reporting Act)
• 7 U.S.C. 21 (Commodity Exchange Act)
• 15 U.S.C. 78o–3 (Securities Exchange Act of 1934)

Critical Issues

The Act's federal preemption of state privacy laws is its most significant point of controversy. States with stronger privacy protections — most notably California under the California Consumer Privacy Act and its amendments — will see those protections displaced, generating substantial opposition from consumer advocacy groups and state officials who argue that federal preemption sets a ceiling rather than a floor on privacy rights. The adequacy of the FTC's enforcement resources is a persistent concern; the agency has historically been under-resourced relative to the scale of the data economy it is now tasked with regulating, and the Act provides no explicit funding appropriations to address this gap. The dual enforcement structure involving both the FTC and state attorneys general, while expanding enforcement capacity, also creates the potential for inconsistent interpretations and conflicting litigation strategies. The exemptions for HIPAA-covered entities, financial institutions, and non-profits create significant gaps in coverage, as large volumes of sensitive personal data processed by these entities fall outside the Act's protections. The consent-based framework for sensitive data processing may prove difficult to operationalize in practice, as consent fatigue and the complexity of modern data flows make meaningful informed consent difficult to achieve at scale. The treatment of deidentified and pseudonymous data under §7 may also generate litigation, as the boundaries between truly deidentified data and re-identifiable data are technically contested. Finally, the Act's cross-border data flow provisions under §9 raise questions about international compatibility with frameworks such as the EU's General Data Protection Regulation, potentially creating compliance conflicts for multinational entities operating in both jurisdictions.

Key Points

• Federal preemption displaces stronger state privacy laws, drawing opposition from consumer advocates and state governments
• FTC lacks explicit funding appropriations to enforce the Act at scale
• Exemptions for HIPAA-covered entities, financial institutions, and non-profits create significant coverage gaps
• Consent-based framework for sensitive data is difficult to implement meaningfully at scale
• Deidentification standards under §7 are technically contested and likely to generate litigation
• Dual FTC and state attorney general enforcement creates risk of inconsistent outcomes
• Cross-border data flow provisions may conflict with international frameworks such as the GDPR

Legal References

• California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.)
• General Data Protection Regulation (EU) 2016/679
• 15 U.S.C. 41 et seq. (Federal Trade Commission Act)
• 42 U.S.C. 1320d et seq. (HIPAA)
• 15 U.S.C. 6801 et seq. (Gramm-Leach-Bliley Act)