Source: National Law Review

On April 21, 2026, House Republicans introduced the SECURE Data Act (H.R. 8413), presented as a comprehensive attempt to establish a national data privacy standard. The Act would grant consumers enforceable rights against data controllers to access, correct, delete, and port their personal data, as well as to opt out of targeted advertising, data sales, and profiling decisions that have significant effects. Data controllers would be required to respond to verified consumer requests within 45 days, allow two free requests per right per year, and provide an appeals process for denied requests.

The Act includes provisions for data minimization, limiting collection to data that is adequate, relevant, and reasonably necessary for the purposes disclosed to consumers. It mandates affirmative opt-in consent before processing sensitive personal data, which the Act defines to include racial or ethnic origin, religious belief, health diagnoses, sexual orientation, immigration status, genetic or biometric identifiers, data collected from children or teens, and precise geolocation. Automated decision-making that produces legal or similarly significant effects without human involvement would require disclosure and give consumers the right to opt out. The SECURE Data Act is paired with the GUARD Financial Data Act (H.R. 8398), which addresses privacy protections for financial institutions under the Gramm-Leach-Bliley Act.