Federal privacy law gives consumers data rights—but lets companies cure violations repeatedly
H.R. 8413 — SECURE Data Act · Filed by John Joyce (R-PA) · 10 cosponsors · Introduced Apr 21, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
The SECURE Data Act creates a comprehensive federal privacy framework giving consumers rights to access, delete, and opt out of the sale of their personal data, while establishing a code-of-conduct system administered by independent organizations to help companies comply. It applies to large data collectors (those processing 200,000+ consumers annually with $25M+ revenue, or 100,000+ consumers if 25%+ revenue comes from data sales), exempts healthcare, financial, and government entities, and enforces violations through the FTC and state attorneys general with a 45-day cure period before enforcement action.
Why we flagged it
The bill's core mechanism is establishing enforceable consumer privacy rights (access, deletion, opt-out) and a federal regulatory framework for data handling. While it includes cross-border data flow provisions favoring U.S. commercial interests, the primary functional character is consumer protection, not deregulation or industry carve-out.
What the text implies
- The 45-day cure period before enforcement may allow repeat violators to delay consequences by repeatedly 'curing' the same violation, creating a compliance loophole if not monitored closely.
- The rebuttable presumption for code-of-conduct participants may incentivize companies to join industry-friendly codes rather than comply with the statute directly, potentially weakening enforcement.
- Section 9 (cross-border data flows) positions the Secretary to negotiate international agreements that 'promote' data flows; this may prioritize U.S. commercial interests over consumer privacy in foreign negotiations.
- Exemptions for nonprofits, higher education, and government entities create large carve-outs where consumer data can be processed without SECURE Act protections, potentially shifting data collection to exempt sectors.
- The definition of 'publicly available information' and broad carve-outs for law enforcement, research, and security may allow significant data use without consumer consent under the guise of these exceptions.
Who it affects
Ordinary consumers gain enforceable rights to know what data is collected, delete it, and opt out of sales—protections currently absent under federal law. The cure period and code-of-conduct pathway reduce compliance burden on smaller businesses while maintaining enforcement teeth through the FTC and state AGs.
Who stands to gain
- Independent organizations administering codes of conduct
- Compliance and privacy technology vendors
- Data brokers (via code-of-conduct safe harbor)
- Large tech platforms (via exemptions and cure periods)
Named in the bill
Federal Trade Commission (FTC), Secretary of Commerce, State Attorneys General, Data brokers, Controllers and processors, Common carriers, Communications Act of 1934, Gramm-Leach-Bliley Act, HIPAA, Fair Credit Reporting Act, COPPA (Children's Online Privacy Protection Act)
Where it stands
10 cosponsors: 10 Republicans.
- Apr 21, 2026 — Introduced · Congress.gov: “Introduced in House”
- Apr 21, 2026 — Referred to House Committee on the Judiciary and House Committee on Energy and Commerce · Congress.gov: “Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a…”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
Money around this bill
76 lobbying clients named this bill on 78 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $69,105,696 in lobbying spend. A filing names 12 bills on average, so that figure is what each filing reported, not a share belonging to this bill.
More lobbying clients named this bill than 99% of bills with at least one filing.
John Joyce, the sponsor, reported $1,473,437 in PAC receipts in the 2026 cycle. $30,500 of that came from 8 PACs tied to these lobbying clients.
- Chamber of Commerce of the U.S.A. — $16,950,000 on 1 filing
- Business Roundtable Inc — $6,950,000 on 1 filing
- American Medical Association — $5,643,000 on 2 filings
- Ctia-the Wireless Association — $3,640,000 on 1 filing
- Biotechnology Innovation Organization — $2,360,000 on 1 filing
Lobbying Disclosure Act filings through Jul 22, 2026. A filing shows who paid to lobby on a bill it names, not what changed.
How this was measured
Analysis — Quorum's AI read the full bill text on Jun 8, 2026; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
Money — Senate Lobbying Disclosure Act filings whose specific-issue field names this bill for quarters ending Jun 2026 to Jun 2026. A filing's amount is reported whole beside the median number of bills a filing names; it is never divided across them. PAC receipts are FEC-reported contributions to the sponsor's candidate committee in the 2026 cycle.
As of — lobbying records through Jul 22, 2026 · page rendered 2026-10-20.
“Federal privacy law gives consumers data rights—but lets companies cure violations repeatedly” QuorumCivic. https://share.quorumcivic.app/bill/119/hr8413 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.