SECURE Data Act Enforcement — FTC Powers, State AG Actions & Penalties
Who Enforces the SECURE Data Act?
Enforcement under the SECURE Data Act is split between two authorities:
- The Federal Trade Commission (FTC)
- State Attorneys General
Crucially, individual consumers cannot sue companies directly for violations. This “no private right of action” provision is one of the most contested parts of the bill.
FTC Enforcement
How It Works
Violations of the SECURE Data Act are treated as violations of FTC regulations on unfair or deceptive acts or practices. This gives the FTC its full arsenal of enforcement tools.
What the FTC Can Do
- Investigate companies
- Issue civil investigative demands
- Bring enforcement actions in federal court
- Seek civil penalties, injunctive relief, and consumer redress
- The FTC’s authority extends to common carriers (telecoms) — closing a traditional loophole
Civil Rights Violations — Exception
The FTC cannot enforce violations of Section 3(c) (the civil rights/anti-discrimination provision). If the FTC receives complaints about discriminatory data processing, it must forward them to the appropriate agency with civil rights enforcement authority.
State Attorney General Enforcement
State AGs can bring civil actions as parens patriae — on behalf of their state’s residents — in federal district court. They can seek:
- Injunctions to stop the unlawful practice
- Enforcement of compliance
- Damages, restitution, or other compensation for residents
- Other legal and equitable relief
Notice Requirement
Before filing suit, a state AG must provide written notice and a copy of the complaint to the FTC.
FTC Can Intervene
After receiving notice, the FTC has the right to intervene in any state AG action, be heard on all matters, and file petitions for appeal.
State Actions Paused During Federal Actions
If the FTC or US Attorney General has already filed a federal action against a company, no state AG can file a separate action against the same defendant for the same violations while the federal action is pending.
The 45-Day Cure Period
Before either the FTC or a state AG can bring an enforcement action, they must:
- Provide written notice to the company identifying the specific violation
- Wait at least 45 days
If the company cures the violation during that 45 days and provides a written commitment not to repeat it, there is no violation for enforcement purposes.
If the company fails to cure, or cures but then reoffends, enforcement can proceed.
No Private Right of Action
Individuals cannot sue companies directly under the SECURE Data Act. This is a major political fault line:
Industry’s position: Private lawsuits create a litigation industry that burdens businesses without improving privacy outcomes.
Privacy advocates’ position: Without private suits, enforcement depends entirely on government resources. Companies can violate the law at scale with low detection risk.
This provision has killed or stalled previous federal privacy bills (including the American Privacy Rights Act) and remains a major obstacle to bipartisan support.
Key Takeaways
- FTC is the primary enforcer — full unfair/deceptive practices powers
- State AGs can sue on behalf of residents
- No private right of action — individuals cannot personally sue
- 45-day cure period before any enforcement action
- Curing a violation + written commitment = no violation
- Federal action preempts state AG action against the same defendant
Frequently Asked Questions
What are the actual penalties for violations? The bill incorporates FTC Act penalties by reference. Civil penalties for violations of FTC rules can reach up to $51,744 per violation (adjusted annually for inflation). In data privacy cases involving millions of consumers, this can result in massive total penalties.
If a company ignores my deletion request, what can I do? You can file a complaint with the FTC (ftc.gov/complaint) or your state attorney general’s office. You cannot personally sue the company.
Has the FTC enforced privacy laws like this before? Yes — the FTC has brought major enforcement actions under Section 5 of the FTC Act against companies like Facebook, Google, and Amazon for privacy violations. The SECURE Data Act would give them a more specific statutory basis for enforcement.