Your Privacy Rights Under the SECURE Data Act
Section 2 is the heart of the bill. It establishes five fundamental rights every American consumer would have over their personal data.
The Five Core Rights
1. The Right to Access
You can ask any company covered by this law to confirm whether they hold data about you — and to give you a copy of it. The only exception is if providing the copy would force the company to reveal a trade secret.
What this means in practice: You could email your favorite app, retailer, or data broker and demand to see exactly what they know about you.
2. The Right to Correct
If a company holds inaccurate information about you, you can demand they fix it. The company must consider the nature of the data and why they’re using it when deciding how to make the correction.
What this means in practice: If a data broker has your wrong address, income bracket, or marital status, you can force a correction.
3. The Right to Delete
You can request that a company delete personal data they collected about you or obtained from other sources.
What this means in practice: This is the “right to be forgotten” — similar to what Europeans have had under GDPR since 2018. You can ask companies to erase your profile.
4. The Right to Data Portability
Where technically feasible, you can request your data in a portable, machine-readable format that lets you transfer it to another service without hindrance.
What this means in practice: You could take your data from one platform and move it to a competitor. This is designed to reduce lock-in.
5. The Right to Opt Out
You can opt out of three specific uses of your data:
- Targeted advertising — companies tracking you across websites to serve personalized ads
- Sale of your data — companies selling your personal information to third parties for money
- Automated profiling — AI or algorithmic systems making significant decisions about you (hiring, housing, healthcare) with no human review
Special Rules for Children and Teenagers
The bill creates two distinct age categories with stronger protections:
Children (under 13): Governed by the existing Children’s Online Privacy Protection Act (COPPA). Parental consent rules already in place continue to apply.
Teenagers (ages 13–15): A new category created by this bill. Companies cannot process a teen’s sensitive data without obtaining verifiable parental consent first. Only a parent can exercise privacy rights on behalf of a teen.
How to Make a Privacy Request
Under the SECURE Data Act, companies must:
- Provide one or more secure, reliable ways to submit privacy requests
- Respond within 45 days of receiving a verified request
- Either comply with the request OR explain in writing why they’re declining — including how to appeal
- Allow an extension of up to another 45 days if the request is complex, as long as they notify you
- Process your first two requests per right per year for free. After that, they may charge a reasonable fee
You cannot be required to create a new account to exercise your privacy rights. If you already have an account, they may ask you to use it for authentication purposes.
The Appeals Process
If a company denies your request, they must:
- Have a visible, easy-to-use appeals process
- Respond to your appeal within 60 days
- If they still deny it, provide you with a way to contact the FTC or your state attorney general to file a complaint
Key Takeaways
- Five rights: access, correct, delete, portability, opt-out
- Teens (13–15) get extra protections — parental consent required for sensitive data
- Companies have 45 days to respond, extendable to 90
- Two free requests per right per year
- You cannot be forced to create an account to exercise rights
- Denial must come with a written explanation and appeal option
Frequently Asked Questions
Can I demand a company delete all my data? You can submit a deletion request. However, companies may retain certain data if legally required, or if it’s necessary to complete a transaction you requested. They must document any refusal.
What if a company ignores my request? Under the SECURE Data Act, the FTC and state AGs handle enforcement. There is no private right of action — meaning you cannot personally sue the company in court for ignoring your request.
Does the right to opt out of targeted advertising mean no ads? No. You can opt out of behavioral targeted advertising (tracking across sites). Companies can still show you contextual ads based on what you’re currently looking at.
What counts as a “significant decision” for the profiling opt-out? The bill defines this narrowly: decisions that deny you healthcare, housing rental, or employment opportunities made by automated systems with no human review.