House Republicans Introduce Comprehensive Federal Privacy Bill: “SECURE Data Act”

On April 22, 2026, the House Energy & Commerce Committee announced the introduction of and intention to advance the “Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act” (the “SECURE Data Act”). The SECURE Data Act, which was crafted by the majority committee members’ Privacy Working Group, would replace the state-by-state patchwork of consumer privacy laws in the U.S. and instead establish a single federal law.

The SECURE Data Act primarily follows the consensus data privacy and security framework enacted by the majority of U.S. states that have enacted their own comprehensive consumer privacy legislation. The bill would apply to businesses subject to the FTC Act or common carriers subject to title II of the Communications Act of 1934 that conduct business in the U.S., process or sell personal data of U.S. residents, and either (1) process personal data of over 200,000 U.S. consumers annually and have at least $25 million in annual gross revenue or (2) process personal data of at least 100,000 consumers annually and derive at least 25 percent of their annual gross revenue from the sale of personal data. Notably, the bill uses a narrow definition of “sell,” limited to the exchange of personal data to a controller or governmental entity for monetary consideration only. Like many state comprehensive consumer privacy laws, the bill would exclude from application entities and data subject to HIPAA or GLBA, institutions of higher education, nonprofits, and employee and business-to-business representative data.

The bill would grant consumer privacy rights at the national level and provide U.S. consumers with the ability to request access, correction and deletion of their personal data from entities subject to the law. The bill also would provide consumers the ability to opt out of the processing of personal data for purposes of targeted…

Source