SECURE Data Act State Law Preemption — Which State Privacy Laws Would Be Eliminated
The Most Controversial Provision in the Bill
Section 15 of the SECURE Data Act contains just one paragraph, but it may be the most consequential sentence in the entire bill:
“No State or political subdivision of a State may prescribe, maintain, or enforce any law, rule, regulation, requirement, standard, or other provision having the force and effect of law, if such law, rule, regulation, requirement, standard, or other provision relates to the provisions of this Act.”
In plain English: every state privacy law in the United States would be immediately nullified the moment this Act takes effect.
Which State Laws Would Be Preempted?
As of 2026, at least 20 states have comprehensive consumer privacy laws on the books or taking effect:
| State | Law | Status |
|---|---|---|
| California | CCPA / CPRA | In effect |
| Virginia | CDPA | In effect |
| Colorado | CPA | In effect |
| Connecticut | CTDPA | In effect |
| Utah | UCPA | In effect |
| Texas | TDPSA | In effect |
| Oregon | OCPA | In effect |
| Montana | MCDPA | In effect |
| Iowa | ICDPA | In effect |
| Indiana | IDPL | In effect |
| Tennessee | TIPA | In effect |
| Florida | FDBR | In effect |
| Delaware | DPDPA | In effect |
| New Hampshire | NHPA | In effect |
| New Jersey | NJDPA | In effect |
| Nebraska | NDPA | In effect |
| Minnesota | MHRA | In effect |
| Maryland | MODPA | In effect |
| Kentucky | KCDPA | In effect |
| Others | Various | Progressing |
All of these — along with any future state laws — would cease to have effect.
The Preemption Debate
Arguments For Preemption
The patchwork problem: Businesses operating nationally must currently comply with a different privacy regime in each state. A company with customers in all 50 states faces potentially 50 different compliance frameworks. Proponents argue this is unworkable and stifles innovation.
Clarity and consistency: A single national standard makes compliance simpler, cheaper, and more predictable. Consumers also get consistent rights regardless of where they live.
California shouldn’t set national policy: California’s CCPA, as the strictest state law, effectively sets a de facto national standard. Proponents argue this gives one state disproportionate influence over national commerce.
Arguments Against Preemption
Federal floor, not ceiling: Privacy advocates argue the federal law should be a minimum standard that states can exceed — not a maximum that blocks stronger protections.
California’s CCPA is stronger: The SECURE Data Act is weaker than California’s CCPA in several respects, particularly on the private right of action and enforcement mechanisms. Preempting California means California residents would lose protections they currently have.
No private right of action: CCPA allows individuals to sue for certain data breaches. The SECURE Data Act eliminates this. Preemption removes a powerful enforcement tool.
Regulatory competition: States serve as laboratories of democracy. Preventing states from innovating on privacy protections removes an important check on federal adequacy.
What Preemption Does NOT Cover
The bill preserves state authority in several areas:
- Breach notification laws
- Laws governing government entities
- Generally applicable state laws not specifically related to the provisions of this Act
The Political Reality
State preemption is the provision most likely to prevent the bill from passing. It has cost previous federal privacy bills their bipartisan support. California’s congressional delegation is expected to oppose any bill that weakens CCPA protections. Democratic members who support a federal floor (not ceiling) approach are unlikely to vote for this version without amendments.
Key Takeaways
- Section 15 eliminates all state privacy laws with one sentence
- 20+ state laws would be immediately nullified
- Proponents say it solves the compliance patchwork problem
- Opponents say it weakens consumer protections, especially in states like California
- No private right of action + preemption = major political obstacle
- State breach notification laws appear to be preserved