House Republicans unveiled a pair of data privacy bills Wednesday aimed at creating a national standard for how companies handle consumer data, fueling a debate over whether federal law should override existing state protections.
The legislation aims to establish a universal data policy at the federal level, setting up a broader debate over federal versus state authority on data privacy.
The SECURE Data Act would focus on broader data, including requirements on how companies can collect, use and share data, according to the bill’s text. Meanwhile, the GUARD Financial Data Act aims to restrict access to sensitive financial data and limit third-party data sharing without proper disclosure, per its text.
Federal preemption can restrict states from the ability to enforce or enact laws that are more stringent than federal standards, according to the Congressional Research Service.
Privacy analysts have warned that national legislation with preemption provisions could override stronger state laws, limiting their abilities to enact more stringent protections.
The SECURE Data Act includes a “sweeping preemption provision” that would “invalidate every single state privacy law” along with other protections tied to personal data, Alan Butler, executive director and president of the Electronic Privacy Information Center, told The Daily Caller News Foundation.
Butler added that the legislation would also “take away the rights of both consumers and state enforcement authorities to bring actions under existing state laws,” calling it a “massive step backward” for privacy protections.
He also criticized the substance of the bill itself, saying it “does not include any meaningful privacy protections” and warning that its data rules would allow companies to collect and use information broadly so long as it is disclosed.
Republican Kentucky Rep. Brett Guthrie and Republican Pennsylvania Rep. John Joyce stated the legislation “establishes clear, enforceable protections so that Americans remain in charge of their own data,” in a joint release describing the SECURE Data Act. The lawmakers added that the proposal the proposal was developed through a working group to craft “a consensus bill,” noting it incorporated input from stakeholders.
States across the country have already implemented their own comprehensive privacy laws, with more than 20 including California, Virginia and Texas enacting such measures — creating a growing patchwork of regulations governing how companies collect and use data. The enforcement and scope of consumer rights vary by state, and if these bills are enacted, federal law could override existing, stronger state protections.
Particularly, California is known to have some of the strictest privacy laws in the country. Under the California Privacy Rights Act (CPRA), the state gives residents control over their personal data, including rights to know, delete, correct and opt out of the sale or sharing of their personal data.
In recent years, companies have pushed for and lobbied for federal privacy laws to preempt stricter state regulations and avoid higher compliance costs. In 2024, tech companies hit record lobbying spending of $85.6 million, according to Axios. Companies face regulatory hurdles and increased legal risk due to inconsistent rules across states.
This pair of bills comes as Republican lawmakers push for federal tech regulation. In March, President Donald Trump’s administration rolled out a push for an AI legislative framework aimed at safeguarding communities and preventing censorship.
Over the years, Congress has tried and failed to enact comprehensive federal privacy legislation. In 2024, the American Privacy Rights Act advanced with bipartisan support before it stalled in committee.
All republished articles must include our logo, our reporter’s byline and their DCNF affiliation. For any questions about our guidelines or partnering with us, please contact [email protected].
Republished with permission from Daily Caller News Foundation
