Congress is taking another swing at a federal privacy framework. Wonder what the odds are on Kalshi.
Earlier this week, House Republicans introduced a new bill that, if enacted, would create a single national privacy standard that preempts existing state privacy laws. (Preemption is one of the main reasons past federal privacy bills haven’t gone anywhere. States like California don’t want Washington telling them they can’t enforce their own state laws.)
The SECURE Data Act, as it’s called, which stands for Securing and Establishing Consumer Uniform Rights and Enforcement over Data – because Congress never misses the chance to craft a backronym – would apply to companies that do business in the US and meet certain data and revenue thresholds.
The thresholds are fairly high. A company would either have to collect personal data on more than 200,000 consumers a year and earn at least $25 million in annual revenue, or handle the data of at least 100,000 consumers and derive 25% or more of its revenue from data sales.
By comparison, many state‑level privacy laws kick in at 100,000 consumers or less. In places like Connecticut, Delaware and Maryland, the threshold is 35,000, which makes the SECURE Data Act’s bar look relatively forgiving.
At a high level, though, the bill doesn’t reinvent the wheel. It bakes in familiar privacy concepts – only collect what you need, don’t use data for unrelated purposes, keep it secure – and proffers the usual bundle of consumer rights to access, correct and delete data and opt out of targeting advertising.
The Federal Trade Commission would be the primary enforcer, with state attorneys general providing backup. There is no private right of action, which means individuals wouldn’t be able to sue – one reason business groups are already looking at this bill more favorably than its predecessors. The IAB, for example, seems rather into it.
If all this sounds familiar, don’t worry, you’re not having a Bill-Murray-from-Groundhog-Day moment. This is far from Congress’ first run at a privacy framework.
Past attempts, including the American Privacy Rights Act (2024), the American Data Privacy and Protection Act (2022) and a grab bag of earlier proposals all stalled over the same issues, namely preemption and whether to give consumers a right to sue.
So we asked the experts.
Does the SECURE Data Act have a snowball’s chance of passing – and why or why not?
- Richart Ruddie, founder, Captain Compliance
- Gary Kibel, partner, Davis+Gilbert
- Jessica Lee, partner, Loeb & Loeb
- Brendan Thomas, executive director, Internet for Growth
Richart Ruddie, founder, Captain Compliance
The SECURE Data Act is the latest attempt at a federal privacy law meant to supersede the less-than-beloved patchwork of state laws. It’s clearly a starting draft. Staff are already signaling they expect major revisions.
While this bill is worth watching closely, we should remember that this happens every few years – and ultimately gets nowhere. Several of the challenges that killed previous attempts at a federal privacy law remain in place.
California said last time that it was going to do its own thing regardless of a federal privacy law, and expect House passage along party lines. The Senate is where the bill will stall and join the American Privacy Rights Act, which was canceled after revisions sparked opposition from both privacy groups and business interests. The American Data Privacy and Protection Act advanced out of committee but never reached the House floor due to preemption fights and state opposition in California – which will happen again.
Same story, different year.
Gary Kibel, partner, Davis+Gilbert
The SECURE Data Act represents a potentially transformative shift in the American privacy landscape, because it finally establishes a single, uniform national framework for consumer privacy rights to replace the complex mix of conflicting state laws.
The obligations on controllers and processors seem to follow a middle-of-the-road approach and should not be overly burdensome, while nearly every company, regardless of location, will have to comply with basic privacy principles.
Preemption is desperately needed by the industry, and the SECURE Data Act would provide that relief by significantly empowering the FTC to step up its enforcement in the area of privacy. The industry is begging for a solution, both sides of the aisle realize a solution is necessary and consumers would presumably welcome a consistent standard that applies to all Americans.
That said, if I had $100, I’d sooner bet it on the Mets winning the World Series than this bill becoming law this year in its current state.
Jessica Lee, partner, Loeb & Loeb
While I am usually very cynical when it comes to the annual threat of federal privacy legislation, I think the SECURE Data Act has a better chance of passing than previous iterations.
On balance, the bill is largely business friendly. It tracks many aspects of the state consensus framework. It also has no private right of action, the opportunity to cure, a narrow definition of “data broker” and punts universal opt-out mechanisms to a future study.
Some businesses will be concerned with the applicability thresholds, the requirements to get parental consent for teen data and the opt-in consent required for sensitive information. CalPrivacy has already raised an objection to the preemption standard.
That said, this appears to have significant partisan support. Whether the bill passes will likely depend on the outcome of attempts to mark up or amend it and the reality of what can be accomplished in the time this Congress has left to pass significant legislation.
Brendan Thomas, executive director, Internet for Growth
In the last Congress, federal privacy legislation did not gain sufficient support in committee, which helps explain why Republicans in the majority have taken a more bottom-up approach this time, with Democrats waiting to see how the bill develops before playing a more active role.
According to the bill’s drafters, the SECURE Data Act draws from bipartisan state privacy laws to establish a national baseline. Whether those provisions are enough to attract broad support, particularly with midterms approaching, remains unclear. The bill likely has enough support to move through committee – especially if paired with financial data legislation as part of a broader package – though its prospects in the full House and Senate are less certain.
How the legislation is structured will matter enormously for small businesses, creators and their audiences who rely on responsible data-driven advertising to reach customers, monetize content and compete in the digital economy.
Answers have been lightly edited and condensed.
