SECURE Act: U.S. House Introduces New National Privacy Framework: Wiley

Source Domain: www.wiley.law

House Republicans have introduced a new data privacy bill aimed at establishing a unified federal standard for consumer data privacy while preempting the growing patchwork of state laws. The Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Act) was released on April 22, 2026 with support from the Chairs of the U.S. House Committee on Energy and Commerce and the U.S. House Committee on Financial Services.

Below is a high-level overview of the proposed bill, including key compliance considerations for companies currently subject to the patchwork of state privacy laws, which now includes 21 comprehensive privacy laws.

Key Takeaways

1. A Single, Preemptive National Privacy Standard

The SECURE Act represents the most significant development towards federal privacy efforts since the American Privacy Rights Act (APRA) introduced in 2024 and the American Data Privacy and Protection Act (ADPPA) introduced the year prior, neither of which saw a House floor vote. While the release of the SECURE Act is an important first step, there are numerous steps and obstacles to navigate before it may be adopted as law.

If enacted, the legislation would create a national privacy framework and would preempt state laws that “relate[] to” provisions found in the SECURE Act.

2. Scope of the SECURE Act

The SECURE Act would generally apply to an entity that (a) conducts business in the U.S. or offers for use or sale to a resident of the U.S. a product or service, or (b) processes or engages in the sale of personal data of a resident of the U.S., and

Collects and processes personal data of more than 200,000 consumers annually (excluding personal data controlled or processed solely for the purpose of completing a payment transaction) and has an annual gross revenue of $25 million or more (as adjusted for CPI annually); or
Collects and processes personal data of 100,000 or more consumers annually (excluding personal data controlled or processed…

Source