WASHINGTON, D.C. – Consumer Reports issued the following statement on the introduction of the Securing and Establishing Consumer Uniform Rights and Enforcement (SECURE) over Data Act, a comprehensive privacy bill introduced in the House Energy and Commerce Committee today.
“We appreciate efforts to restart consideration of comprehensive privacy legislation in Congress this session, but the SECURE Data Act falls far short of protecting the privacy of American consumers,” said Justin Brookman, director of technology policy at Consumer Reports. “Over the past several years, states have made significant progress toward enacting laws that provide meaningful protections to millions of Americans. This bill would be a significant step back for privacy in this country as it would replace several stronger state and local laws with a weak federal framework riddled with loopholes. This bill is also a substantial retreat from the protections included in bipartisan bills such as ADPPA and APRA considered in recent Congresses”
Aside from the bill’s wide preemption of existing state comprehensive and sectoral privacy laws, the bill currently includes the following provisions that would need to be strengthened or revised:
- Lacks recognition of universal opt-out mechanisms, which are currently required in more than half of the current state privacy laws
- Lacks meaningful enforcement and includes a right for business to cure violations after they are discovered by enforcers without punishment
- Lacks meaningful data minimization provisions — data collection is only limited to any uses listed in a privacy policy — or prohibitions on the sale of sensitive personal information
- Uses weak definitions for key terms, including “sale” and “targeted advertising”
- Includes wide entity-level exemptions for that would exclude industries like healthcare and finance from the bill’s coverage
- Consumer rights do not apply to pseudonymous data, which could include common persistent identifiers used in online advertising
- Overly broad exclusion of “public available information,” which includes any data that a consumer has not explicitly restricted from sharing
- Wholly exempts companies from access, deletion, correction and other rights if they do not share data with third parties
Consumer Reports has been a leading advocate for strong consumer privacy laws. CR helped advocate for the passage of the California Consumer Privacy Act in 2018. In 2024, CR and the Electronic Privacy Information Center (EPIC) published a model state privacy law. Since the initial passage of the CCPA, the number of states with comprehensive privacy laws has grown to 21, though the strength of those laws varies in the level of protection they provide consumers.
Contact: cyrus.rassool@consumer.org