Written by: Haim Ravia, Dotan Hammer
On April 22, 2026, the U.S. House of Representatives Energy & Commerce Committee announced the introduction of the “Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act” (the “SECURE Data Act”), a comprehensive federal privacy bill that would replace the state-by-state patchwork of consumer privacy laws with a single national standard. The bill would apply to businesses subject to the FTC Act or telecom carriers under title II of the Communications Act that conduct business in the United States, process or sell personal data, and meet certain thresholds.
The SECURE Data Act grants consumers rights to confirm whether a controller is processing their personal data and access a copy; correct inaccuracies; delete personal data; obtain a portable copy of their data; and opt out of targeted advertising, the sale of personal data, and certain automated decision-making based on profiling. Controllers must respond to consumer requests within 45 days, with a possible 45-day extension. Consumers may submit two free requests per right per year; additional requests may be subject to a reasonable fee.
The bill requires controllers to obtain opt-in consent before processing sensitive data, defined to include health, geolocation, biometric, and financial data. Notably, it requires parental consent for the collection of personal data from teens (individuals aged 13 to 15). The bill would also establish a federal standard for data brokers, requiring annual registration with the FTC, which would maintain a public registry with links to data broker websites so consumers can exercise their rights. The SECURE Data Act imposes data minimization, data security, and vendor contracting requirements on controllers.
One of the most significant aspects of the bill is its preemption provision. The SECURE Data Act prohibits state efforts that relate to the provisions of the Act, seeking to establish a single, uniform national standard. However, it does allow state attorneys general to bring enforcement actions under the Act. The bill does not create a private right of action.
In parallel, three states took significant action in April:
Alabama became the 21st state to enact a comprehensive consumer privacy law when Governor Kay Ivey signed HB 351, the Alabama Personal Data Protection Act. The law applies to persons that conduct business in Alabama or produce products or services targeted to Alabama residents and that either process data of more than 25,000 consumers or derive 25% or more of revenue from the sale of personal data. Notably, Alabama’s law does not require controllers to recognize universal opt-out preference signals — a departure from the recent trend mandating recognition of signals like the Global Privacy Control. Enforcement is through the attorney general only, with a non-sunsetting 45-day cure period. The law takes effect May 1, 2027.
Virginia Governor Abigail Spanberger signed SB 338 on April 13, 2026, amending the Virginia Consumer Data Protection Act to prohibit the sale of precise geolocation data — defined as data within a 1,750-foot radius — effective July 1, 2026. The bill passed both chambers unanimously. Virginia joins Maryland and Oregon in banning the sale of geolocation data outright, reflecting a broader policy shift away from “notice and choice” frameworks toward absolute prohibitions on certain data practices.
Kentucky Governor Andy Beshear signed HB 692 on April 13, 2026, amending the Kentucky Consumer Data Protection Act to add “automated content recognition data” and “smart monitor” to the law’s definition of “sensitive data.” Automated content recognition (ACR) technology, which is embedded in smart TVs and monitors, captures what users are watching by analyzing audio or video fingerprints in real time. By classifying ACR data as sensitive, the amendment creates an opt-in consent requirement for all smart TV viewing data collection in Kentucky, effective July 1, 2027.
Click here to read the SECURE Data Act.
Click here to read the Alabama Personal Data Protection Act.
Click here to read Virginia’s SB 338 (Prohibition on Sale of Geolocation Data).
Click here to read Kentucky’s HB 692 (Smart TV Data Privacy).
