Introduction
Not all privacy bills are created equal. Some appear to offer protections but actually weaken existing safeguards. The federal SECURE Data Act is a prime example—dubbed not a serious piece of privacy legislation by critics. Its provisions would roll back state protections, fail to give consumers real power, and leave massive loopholes for companies. This step-by-step guide will help you—whether you're a policy advocate, a concerned citizen, or a journalist—evaluate any proposed privacy bill by examining the same flaws found in the SECURE Data Act. Use these steps to spot weak legislation and advocate for stronger protections.
What You Need
- A copy of the proposed bill (or a detailed summary)
- Knowledge of existing state privacy laws (e.g., California, Virginia, Colorado)
- Understanding of key privacy concepts: private right of action, preemption, opt-out, data minimization
- A list of reputable privacy organizations' positions (e.g., EFF, ACLU)
- Time to compare the bill against best practices
Step 1: Check for a Private Right of Action
The single most important test: Does the bill allow individuals to sue companies for violations? Without a private right of action, enforcement is left entirely to the government. The SECURE Data Act lacks this provision, meaning even if a company mishandles your data, you can't take them to court. Weak bills often rely on the FTC or state attorneys general, who may be underfunded or slow. Strong privacy legislation always includes a private right of action. If the bill doesn't have one, it's a red flag.
Step 2: Examine Preemption of State Laws
Federal privacy laws should set a floor, not a ceiling. The SECURE Data Act's Section 15 would preempt any state law that relates to the provisions of this Act
—a broad clause that could wipe out over 20 state consumer privacy laws plus hundreds of other protections (e.g., data breach notification, student privacy). To test a bill: look for a preemption clause. If it says this Act supersedes state laws
or uses language like any law that relates to
, it likely blocks states from innovating. Strong bills explicitly allow states to impose stronger protections (like HIPAA does).
Step 3: Evaluate Opt-Out Defaults
The SECURE Data Act requires you to opt out of targeted advertising, sale of data, and harmful profiling. That means companies can continue these invasive practices until you take explicit action. Weak bills put the burden on you. Compare with strong privacy laws that require opt-in consent before any processing for advertising or sale. Even among opt-out bills, check for: are opt-out signals (like browser-based signals) honored? The SECURE Data Act does not require companies to honor universal opt-out signals. Automatic opt-out mechanisms are a sign of consumer-friendly design.
Step 4: Assess Data Minimization Requirements
A core privacy principle is data minimization: companies should only collect what's necessary for the service you're using. The SECURE Data Act has inadequate data minimization provisions—it doesn't clearly limit collection to what's reasonably necessary
and allows broad purposes. To evaluate a bill: look for language like collection limited to what is adequate, relevant, and necessary
. Vague terms like reasonably necessary for the service
leave too much room for interpretation. Strong bills define strict limits and require companies to delete data once the purpose is fulfilled.
Step 5: Review Sensitive Data Consent
The SECURE Data Act requires consent before processing sensitive data (e.g., health, biometric, genetic, precise location). That sounds good, but the definition of sensitive data may have loopholes. For example, the bill may exclude inferred data about race or health. Check the definition carefully: does it cover all categories recognized by state laws? Also, see if the consent requirement is opt-in rather than opt-out. The bill's consent for sensitive data is opt-in, which is one of its few strengths—but still far from comprehensive because other flaws undermine it.
Step 6: Look for a Ban on Behavioral Advertising
Behavioral advertising (tracking across sites to build profiles and serve targeted ads) is a major driver of data collection. The SECURE Data Act does not ban this practice—it only allows you to opt out of third-party targeted advertising. That leaves the door open for companies to still track and profile you for their own advertising. Strong privacy bills prohibit behavioral advertising altogether, or at least require explicit opt-in. If the bill merely gives an opt-out, it's a sign of industry influence.
Step 7: Inspect Definitional Loopholes
The SECURE Data Act contains large definitional loopholes. For instance, personal data
may exclude de-identified data that can easily be re-identified, or exclude data used for security purposes. Also, carve-outs for emergencies
or product improvement
can be abused. To spot loopholes: look for exceptions like nothing in this Act shall restrict a covered entity from using data for [vague purpose]
. Every exception should be narrowly defined and time-limited.
Step 8: Check Data Broker Registration
The SECURE Data Act requires data brokers that earn at least 50% of profits from selling personal data to register with the FTC. This is a positive step but limited. Ask: does the bill apply to all data brokers, or only those above a revenue threshold? Are brokers required to give consumers a way to see and delete their data? The California tool is a better model. Registration alone without transparency or deletion rights is weak.
Step 9: Compare Against Existing State Laws
Finally, compare the proposed federal bill with actual state laws already in effect. For example, California's law allows consumers to request deletion via a state-run deletion tool, requires universal opt-out signals, and includes a limited private right of action. The SECURE Data Act is weaker than most state laws. If a federal bill would preempt stronger state protections, it's a step backward. Good federal legislation should be a floor that allows states to add more rights.
Tips & Conclusion
- Remember: a bill that claims to protect privacy but preempts stronger state laws is likely designed to benefit industry, not consumers.
- Watch for sunset clauses or delayed effective dates that give companies years to comply.
- Don't be fooled by a list of rights (access, correction, deletion) if enforcement is weak.
- Support organizations like EFF that analyze bills in depth.
- Write to your representatives using the evidence you've gathered from steps 1–9.
In conclusion, the SECURE Data Act serves as a textbook example of what a weak privacy bill looks like. By applying these nine steps to any proposal, you can quickly separate genuine consumer protections from industry-friendly window dressing. Strong privacy legislation should empower individuals, not burden them; create a floor for states; and hold companies accountable through private enforcement. Use this guide to advocate for the privacy you deserve.