A New Federal Push for Digital Privacy
House Republicans introduced sweeping digital privacy legislation on Wednesday, marking Congress's latest attempt to establish a nationwide framework governing how businesses collect and use Americans' personal data. The proposed legislation, called the Secure Data Act, would grant consumers the right to opt out of data collection by individual businesses when that data is used for targeted advertising, sold to third parties, or fed into automated decisionmaking systems.
The bill also mandates that companies inform consumers when their personal data is being collected or processed, provide individuals with a portable copy of their data on request, and extend special consent rights to parents over the data collection practices affecting teenagers.
Rep. Brett Guthrie (R-Ky.), Chair of the House Energy and Commerce Committee, and Rep. John Joyce (R-Pa.), who led the working group charged with developing the draft, issued a joint statement declaring:
"This bill establishes clear, enforceable protections so that Americans remain in charge of their own data and companies are held accountable for its safe keeping."
Key Provisions of the Bill
Beyond consumer opt-out rights, the Secure Data Act would impose data minimization requirements, obligating businesses and other organizations to limit personal data collection to what is described as "adequate, relevant and reasonably necessary" — and only for purposes disclosed to consumers in advance. Companies would also be required to implement new safeguards for customer data and disclose any third parties with whom they share or sell that data, explicitly including adversarial foreign governments such as Russia and China.
Increased Oversight of Data Brokers
One of the more notable elements of the legislation involves strengthened federal oversight of the data broker industry. The Federal Trade Commission (FTC) would receive expanded authority over data brokers — entities that buy, collect, repackage, and sell personal consumer data. Under the draft bill:
- Data brokers would be required to register with the FTC.
- They would need to comply with data minimization, disclosure, and data security mandates.
- The legislation would establish a new national data broker registry.
How It Compares to Existing State Laws
Cobun Zwiefel-Keegan, managing director at the International Association of Privacy Professionals, told CyberScoop that based on the released draft and conversations on Capitol Hill, the bill most closely resembles privacy laws recently passed by Virginia or Kentucky — the home state of Chairman Guthrie — with an emphasis on consumer notice and opt-out rights, and a tendency to tie business compliance to "reasonable" standards of evidence that companies acted to protect consumer data.
Zwiefel-Keegan also noted the bill could further empower both the Federal Trade Commission and state Attorneys General to investigate and sanction bad actors, which he viewed as a potential positive element.
Sixteen Months in the Making — But Without Democratic Input
The legislation is the product of more than 16 months of internal discussion and consensus-building within the Republican majority. The working group led by Rep. Joyce solicited feedback from 170 organizations and received more than 250 public responses to a Request for Information released last year.
However, House Republicans did not involve Democratic members in either the working group or the drafting process — an exclusion observers say could complicate efforts to attract bipartisan support. Zwiefel-Keegan noted that Republican drafters would likely challenge Democrats to explain why they cannot support the kind of bill already enacted in blue states. At the same time, he acknowledged there are "plenty of ways that people will point to how it's weaker than a lot of blue state privacy laws."
Key Weaknesses Critics Have Identified
- Federal preemption of stronger state privacy laws, including California's more robust protections.
- The absence of a private right of action, meaning individuals cannot sue companies directly for violations.
- A mandatory 45-day cure period allowing businesses found in violation to come into compliance before facing formal sanctions.
Zwiefel-Keegan suggested that the privacy working group and committee leadership believe the bill has a strong chance of passing out of committee, but that its broader prospects hinge on winning some Democratic support and navigating concerns from "red state representatives who may not like their own laws being preempted."
Opposition From Democrats and Advocacy Groups
Rep. Frank Pallone (D-N.J.), ranking member on the House Energy and Commerce Committee, came out against the bill shortly after its release, accusing House Republicans of having "lost the plot" on passing national privacy legislation.
"This Republican privacy bill protects corporations and their bottom line, not people's privacy. We should be protecting the little guy with a bill that empowers consumers, not one that preempts consumer protections at the behest of Big Tech."
Civil Society Raises Alarm Over Loopholes and AI Gaps
Eric Null, director of the privacy and data project at the Center for Democracy and Technology, was sharply critical, characterizing the Secure Data Act as riddled with "easily exploitable loopholes" that allow companies to "hide behind cookie banners and lengthy terms of service rather than establishing meaningful privacy protections."
Null also took aim at the bill's limited treatment of artificial intelligence, arguing that Large Language Models pose significant and growing privacy challenges. He stated:
"Any federal privacy law discussed in 2026 should be future-proofed by protecting against growing AI-related privacy harms, namely by limiting data collection for AI training and preventing use of the technology to discriminate against protected classes, but this bill does neither sufficiently."
The American Civil Liberties Union also opposed the legislation. Senior staff attorney Cody Venzke argued that the bill "places the onus on regular people" to wade through complex privacy policies drafted by businesses in order to request opt-outs or data deletion.
"And it leaves us without real recourse – even blocking us from going to court – if our requests go unanswered."
What Comes Next
Despite the early opposition, Guthrie and Joyce expressed optimism in their joint statement, saying they "look forward to working with our colleagues to build support for this bill and advance data privacy protections fit for our 21st century economy." Whether the Secure Data Act can bridge the gap between Republican priorities and Democratic demands — as well as the expectations of civil liberties and privacy advocacy organizations — remains to be seen as the legislative process moves forward.
Source: CyberScoop