18 states are pushing back against the SECURE Data Act — here’s why it matters
Congress is trying to pass the first major federal data privacy law in years. But a growing coalition of state attorneys general says it would make things worse, not better.
What is the SECURE Data Act?
H.R. 8413 — formally the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act — was introduced on April 22, 2026 by House Energy and Commerce Committee Vice Chair John Joyce (R-PA). It is the first serious comprehensive federal privacy bill of the 119th Congress, the result of a Privacy Working Group that consulted over 170 organizations and received more than 250 written responses.
On paper, the bill looks like progress. It gives consumers rights to access, correct, delete, and port their personal data. It lets people opt out of data sales, targeted advertising, and profiling. It treats data belonging to teenagers under 16 as sensitive, requiring parental opt-in consent. It establishes a federal data broker registry administered by the FTC.
The problem, according to critics, is what it takes away.
The core issue: Section 15 of the bill would preempt state privacy laws — overriding California’s CCPA/CPRA, Illinois’ BIPA, Washington’s My Health My Data Act, and dozens of other state-level frameworks. States that have spent years building stronger consumer protections would be forced back to a weaker federal baseline.
Who supports it — and who opposes it
The bill has support from business groups who argue that a patchwork of 50 different state laws creates compliance confusion and costs. Supporters estimate eliminating that patchwork could save businesses up to $1 trillion over 10 years. The bill also has no private right of action — meaning consumers can’t sue companies directly, a feature businesses strongly prefer.
But that same feature is exactly what critics find alarming.
Supporters say
- Creates a single national standard
- Reduces compliance burden for businesses
- Eliminates confusing state-by-state variation
- Includes baseline consumer rights
Critics say
- Replaces stronger state laws with weaker rules
- Removes private right of action for consumers
- Limits future state-level innovation
- Concentrates enforcement in politically appointed FTC
The coalition pushing back
On June 2, 2026, California Attorney General Rob Bonta led a coalition of 18 attorneys general and state agencies in formally calling on Congress to reject the bill. Their letter argues the SECURE Data Act moves privacy rights in the wrong direction — and that any federal framework must preserve states’ ability to go further.
“Federal action to protect Americans’ privacy is essential, but not at the expense of the strong state laws that already protect Californians.”
— AG Rob Bonta, California“The SECURE Data Act is another wolf in sheep’s clothing, claiming security on the surface but weakening Virginians’ privacy at its core.”
— AG Jay Jones, VirginiaAll 18 members of the coalition
01
California
AG Rob Bonta (lead) · CCPA/CPRA
02
Connecticut
AG · CT Data Privacy Act
03
Delaware
AG · DE Personal Data Privacy Act
04
Illinois
AG · BIPA + state privacy law
05
Maine
AG · Maine Privacy Act
06
Maryland
AG Anthony G. Brown · MODPA
07
Massachusetts
AG · State privacy framework
08
Minnesota
AG · MN Consumer Data Privacy Act
09
Nevada
AG · Nevada Privacy of Information Act
10
New Hampshire
AG · NH Privacy Act
11
New Jersey
AG · NJ Data Privacy Act
12
New York
AG · SHIELD Act + pending NYPA
13
Oregon
AG · Oregon Consumer Privacy Act
14
Vermont
AG Charity Clark · Vermont Privacy Act
15
Virginia
AG Jay Jones · VCDPA
16
Washington
AG · My Health MY Data Act
17
Hawaiʻi
Dept. of Commerce & Consumer Affairs
18
California Privacy Protection Agency
CalPrivacy · CPRA enforcement body
What happens next
The bill has been referred to the House Committee on Energy and Commerce and the Committee on the Judiciary. The IAPP has described it as “an opening salvo” likely to be refined significantly before any vote. The coalition’s letter, combined with opposition from privacy advocacy groups like EPIC, EFF, and ACLU, suggests the preemption clause in Section 15 will face serious resistance — the same issue that derailed the last two major attempts at a federal privacy bill.
Whether Congress can thread the needle between national consistency and preserving stronger state protections remains the central question. For now, 18 states have a clear answer: not like this.