The New US Data Reality: A Guide to the SECURE Data Act, Data Minimization, and the End of the State Patchwork

The United States is moving closer to a unified federal data privacy standard, fundamentally altering how businesses handle consumer information. Introduced in April 2026, the SECURE Data Act aims to replace the fragmented landscape of state-level privacy laws with a single, preemptive national framework. For enterprise data governance, the legislation shifts the compliance burden from navigating minor differences across twenty state laws to adhering to a strict federal baseline enforced by the Federal Trade Commission and state attorneys general.[1][5]

At the core of the SECURE Data Act is a stringent data minimization mandate. Controllers—nonfinancial firms that dictate how consumer data is processed—are required to limit their data collection strictly to what is adequate, relevant, and reasonably necessary for disclosed processing purposes. This represents a departure from the traditional "notice and consent" model, forcing companies to justify their data acquisition at the point of collection rather than simply burying broad usage rights in lengthy privacy policies.[1][3]

The legislation also establishes a comprehensive suite of consumer rights that mirror the most robust state laws. Individuals gain the right to access, correct, delete, and obtain a portable copy of their personal data. Furthermore, consumers can opt out of targeted advertising, the sale of their personal data, and automated profiling that produces legal or significant effects. Businesses must establish clear, accessible mechanisms for consumers to exercise these rights, fundamentally changing how digital platforms interact with their user base.[1][4]

A critical expansion in the SECURE Data Act involves the treatment of youth privacy. The bill classifies the personal data of teenagers between the ages of 13 and 16 as sensitive data, requiring verifiable parental consent before processing. This extends the protections traditionally afforded by the Children's Online Privacy Protection Act (COPPA), which previously only covered children under 13, and forces digital platforms to implement more rigorous age-gating and consent verification systems for a much larger demographic.[4]

Sensitive data protections extend beyond youth privacy. The legislation mandates explicit opt-in consent before a business can process any sensitive information, which includes biometric data, precise geolocation, genetic information, and data revealing racial or ethnic origin, religious beliefs, or health diagnoses. This opt-in requirement creates a significant operational hurdle for data brokers and ad-tech companies that rely on passive collection of sensitive consumer attributes.[1][5]

The most consequential and heavily debated provision of the SECURE Data Act is its broad preemption of state laws. The bill explicitly prohibits states from enacting or enforcing laws that "relate to" its provisions. This language is designed to displace existing comprehensive state privacy laws, such as the California Consumer Privacy Act (CCPA), as well as state-level data broker registries and potentially some sectoral privacy laws.[1][4]

For businesses, this preemption offers a massive reduction in compliance complexity. Instead of engineering separate data architectures to satisfy the unique requirements of California, Virginia, Colorado, and seventeen other states, enterprises can build a single compliance program. The SECURE Data Act allows industries to develop voluntary codes of conduct; companies that adhere to these independent guidelines receive a rebuttable presumption of compliance, providing a safe harbor for proactive businesses.[3][5]

However, the shift to a federal standard fundamentally alters which businesses are actually regulated. The SECURE Data Act applies to entities that collect and process the personal data of more than 200,000 consumers annually and have an annual gross revenue of $25 million or more. Alternatively, it covers businesses handling 100,000 consumers if they derive 25 percent or more of their revenue from selling that data.[1][3]

This dual-threshold requirement creates a significant regulatory gap when compared to existing state laws. Under the CCPA, a business is regulated if it meets any one of three criteria: $25 million in gross revenue, processing the data of 100,000 California residents, or deriving 50 percent of revenue from data sales. Because California uses an "OR" condition, a company with $26 million in revenue is regulated regardless of how few consumers it tracks.[2]

By requiring businesses to meet both the $25 million revenue mark and a doubled 200,000-consumer count, the SECURE Data Act effectively exempts thousands of mid-market digital businesses that are currently captured by California's threshold. A B2B software provider generating $30 million in revenue but only processing data for 50,000 users would fall out of scope under the federal law, despite being heavily regulated under the current state patchwork.[1][2][6]

Enforcement under the SECURE Data Act is shared between the FTC and state attorneys general, notably excluding a private right of action. This omission shields businesses from the threat of class-action lawsuits over minor technical violations, a major concern under some state frameworks. Before initiating any enforcement action, regulators must provide written notice and allow a 45-day cure period, giving companies a window to rectify violations without penalty.[3][4]

The transition from a state patchwork to a federal standard represents a trade-off between uniformity and comprehensive coverage. While the SECURE Data Act simplifies compliance for massive enterprises and establishes strong baseline rights like data minimization and teen privacy, its high applicability thresholds mean a substantial portion of the mid-market economy will operate outside its jurisdiction, fundamentally reshaping the U.S. data reality.[1][3][6]