SECURE Data Act Definitions — Complete Glossary of Key Terms
SECURE Data Act — Complete Definitions Glossary
Section 16 contains 35 defined terms. Understanding these definitions is essential for compliance — the scope of your obligations depends entirely on which definitions apply to your business.
Affiliate A legal entity that controls, is controlled by, or shares common ownership or common branding with another entity. Control means owning 50%+ of voting shares, controlling the election of the majority of directors, or exercising controlling influence over management.
Authenticate To verify through commercially reasonable means that the consumer exercising a privacy right is actually the consumer whose data is at issue.
Biometric Data Data generated by automatic measurements of biological characteristics — fingerprints, voiceprints, retinal scans, iris patterns, or other unique biological patterns — used to identify a specific individual. Does not include photographs, video/audio recordings, or data collected for healthcare purposes under HIPAA.
Child An individual under the age of 13. (Governed by COPPA rules under this Act.)
Commission The Federal Trade Commission.
Consent A clear affirmative act that signifies a freely given, specific, informed, and unambiguous agreement to process personal data. Must be an actual affirmative action — pre-checked boxes and silence do not qualify. Can be written (including electronic) or any other unambiguous affirmative action.
Consumer An individual acting in a personal or household capacity. Does not include individuals acting in an employment or commercial context. Employees, contractors, and B2B contacts are not “consumers” for purposes of this Act.
Controller Any person that, alone or jointly with others, determines the purpose and means of processing personal data. If you decide what data to collect and why, you are a controller.
Covered Nation Defined by reference to 10 U.S.C. §4872(f) — currently includes China, Russia, Iran, and North Korea.
Data Broker A controller that: (1) collects and processes personal data about consumers who are not its customers, clients, users, readers, or subscribers, AND (2) derives 50% or more of annual gross revenue from selling that data. Does not include processors.
Deidentified Data Data that cannot reasonably be linked to an identified or identifiable individual or a device linked to an individual. Outside the scope of the Act.
Decision That Has a Legal or Similarly Significant Effect A decision made about a consumer that denies them: (A) a healthcare service, (B) housing rental or lease, or (C) an employment opportunity. This narrow definition limits which automated decisions trigger disclosure and opt-out requirements.
Health Record A record relating to an individual kept by a healthcare provider as a result of the professional relationship — excluding financial and billing records.
HIPAA Health Insurance Portability and Accountability Act of 1996.
Identified or Identifiable Natural Person A person who can be readily identified, directly or indirectly.
Institution of Higher Education As defined in the Higher Education Act of 1965 — colleges, universities, and other degree-granting institutions.
Nonprofit Organization An organization described in IRC Section 501(c)(3) and exempt from taxation. Nonprofits are fully exempt from the Act.
Parent An adult with the legal right to make decisions on behalf of a child or teen — including natural parents, adoptive parents, legal guardians, and individuals with legal custody.
Personal Data Any information that is linked or reasonably linkable to an identified or identifiable natural person. Does not include deidentified data or publicly available information.
Precise Geolocation Data Location information derived from technology that identifies a person’s specific location within a radius of 1,750 feet (roughly 1/3 of a mile). Does not include utility meter data or the content of communications.
Process / Processing Any operation performed on personal data — including collection, use, storage, disclosure, analysis, deletion, or modification — whether manual or automated.
Processor A person that processes personal data on behalf of a controller, following the controller’s instructions. Distinguished from a controller by the absence of independent decision-making authority over the data.
Profiling Any form of solely automated processing of personal data used to evaluate, analyze, or predict aspects of a consumer’s economic situation, health, preferences, interests, reliability, behavior, location, or movement. The “solely automated” qualifier is important — if a human is involved in the decision, it is not profiling for purposes of this Act.
Pseudonymous Data Personal data that cannot be attributed to a specific individual without additional information — where that additional information is kept separately and protected. Still personal data under the Act, but with limited consumer rights applicability.
Publicly Available Information Information lawfully available through government records, or information a business reasonably believes is lawfully available to the public through widely distributed media, by the consumer, or by someone to whom the consumer disclosed it — unless the consumer restricted it to a specific audience.
Sale of Personal Data The exchange of personal data for monetary consideration by a controller to another controller or government entity.
Does NOT include:
- Disclosure to a processor
- Sharing to provide a service the consumer requested
- Transfer to an affiliate
- Disclosure of information the consumer made public
- Transfer in a merger, acquisition, or bankruptcy
- Disclosure for journalism or public interest reporting
Secretary The Secretary of Commerce.
Sensitive Data A special category of personal data requiring consent before processing. Includes:
- Racial or ethnic origin
- Religious belief
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic data
- Biometric data processed to uniquely identify someone
- Personal data collected from a child or teen
- Precise geolocation data
State Each US state, the District of Columbia, commonwealths, territories, possessions, and federally recognized Indian Tribes.
Targeted Advertising Displaying advertisements selected based on personal data gathered from a consumer’s activities across nonaffiliated websites or apps over time.
Does NOT include:
- Ads based on activity within your own website/app
- Contextual ads based on a current search query or page visit
- Ads in response to a direct consumer request
- Measurement or reporting of ad performance
Teen An individual aged 13 through 15. A new category created by this bill with enhanced parental consent requirements for sensitive data processing.
Trade Secret As defined in 18 U.S.C. §1839 — confidential business information with commercial value that is subject to reasonable measures to maintain its secrecy.
Verifiable Consent For teens (ages 13–15): any reasonable effort by a controller to ensure the teen’s parent receives direct notice of data processing practices AND freely and unambiguously authorizes that processing before the teen’s data is collected. Must cover both the initial processing and any subsequent use.
Frequently Asked Questions
If I collect business contact information (name, work email, job title), is that “personal data”? The definition of “consumer” excludes individuals acting in a commercial or employment context. B2B data — contact information for someone in their professional capacity — is likely outside the Act’s scope.
Is an IP address “personal data”? Possibly. If an IP address is “reasonably linkable” to an identified person (which it often is, with ISP records), it would qualify as personal data. However, if it’s held in a form where re-identification is not reasonably possible, it may qualify as deidentified.
Does “sale of personal data” include sharing data with advertising platforms? This is one of the most contested questions in privacy law. The bill defines “sale” as exchange for monetary consideration. Data sharing in exchange for free advertising services may not qualify as a “sale” under this definition — a more permissive interpretation than California’s CCPA.
This glossary reflects the bill as introduced on April 21, 2026. Definitions may change as the bill progresses through Congress. Last updated: May 2026.