Data Privacy Bill to Replace State Laws Floated by House GOP (1)

House Republicans on Wednesday released highly anticipated legislation that would establish a national data privacy standard and override state laws, aiming to fulfill longtime demands from industry and advocacy officials for a single framework.

The new bill, if passed by Congress, would create consumer privacy rights at the national level for the first time. The US trails the rest of the world in data privacy protections, and states such as Virginia, Kentucky and Texas have moved to fill the regulatory gap by enacting new laws in recent years to give consumers greater control over their personal information online.

The legislation, led by a House Republican working group, seeks to mirror some of those data privacy laws and replace the state-by-state regulatory landscape. The bill would allow consumers to review, correct, and delete their personal data online and includes carve outs to protect young users.

Companies would also have to obtain consent from users before processing sensitive information, minimize their collection of user data, and give them the option to opt out of using their data for targeted advertising, among other mandates.

House Republicans are seeking to inject new momentum into the effort after past data privacy bills on Capitol Hill have failed. House Energy and Commerce Chair Brett Guthrie (R-Ky.) launched the nine-member working group early last year. The product was a result of consulting with dozens of industry officials, consumer advocates, and policy experts.

“The SECURE Data Act will provide all Americans with robust consumer protections and strong data security standards, while establishing clear, consistent, and operable obligations for businesses that handle Americans’ data,” said Rep. John Joyce (R-Pa.), who led the working group. “This legislation offers a clear-eyed, objective solution to addressing the challenges posed by a constantly evolving data-driven digital economy.”

Push and Pull on Action

The push comes as top industry groups like Chamber of Commerce, TechNet, and others representing tech companies, retailers, and online businesses have repeatedly called on Congress to pass a national standard. Consumer advocates have also demanded lawmakers create strong privacy protections amid growing concerns over how companies may collect and use people’s data.

Energy and Commerce Committee Republicans rolled out the legislation jointly with a companion bill from the House Financial Services Committee, which would apply data privacy and security protections to financial firms.

“This legislation reflects a thoughtful effort to protect privacy, promote innovation, and strengthen trust in our digital economy,” said Rep. Jay Obernolte (R-Calif.), a member of the working group. “By setting clear rules, we can empower businesses to grow responsibly while safeguarding the rights of Americans.”

Industry welcomed the draft legislation as a start to ending the compliance challenge of disparate state laws.

“For too long, Congress has delayed action while the stakes have only grown,” Daniel Castro, vice president at the Information Technology and Innovation Foundation, said in a statement. “This bill moves the conversation in a more practical direction, focusing on real safeguards rather than recreating the burdensome, box-checking compliance regime seen under GDPR.”

Others noted that the bill is a necessary step toward Congress’ aims to develop an artificial intelligence framework.

“Responsible data stewardship isn’t just a compliance task; it is foundational to building trust in emerging technologies like AI,” Barbara Cosgrove, chief privacy and digital trust officer at Workday, said by email.

Bill Faces Steep Climb

Still, the road ahead for the GOP-led approach is unclear. Republicans would need to work with Democrats on the bill to ensure better chances of advancing in both chambers, where the GOP holds slim majorities and the Senate has a 60-vote threshold for passage. A Republican aide on the committee said the bill aims to reflect the consensus between the various state privacy laws and left the door open for potential forthcoming changes to the language.

Democrats already are raising questions about the bill. Energy and Commerce ranking member Frank Pallone (D-N.J.) on Wednesday criticized his Republican colleagues for pursuing the legislation without their input and said they have “lost the plot on efforts to pass a strong national privacy bill.”

“We’re always willing to work with them on any issue, but when they just do things on their own and don’t work with us, that’s not a good way to approach such an important issue,” Pallone said in a hallway interview.

Major points of contention, previously around state preemption and enforcement language, are likely to emerge again as negotiations between the two parties begin.

“This Republican ‘privacy’ bill protects corporations and their bottom line, not people’s privacy,” Pallone later said in a statement. “We should be protecting the little guy with a bill that empowers consumers, not one that pre-empts consumer protections at the behest of Big Tech.”

Some states like California, which has the country’s most comprehensive data privacy law, have resisted efforts to replace their rules with potentially weaker standards. Democrats have backed federal legislation that would create a national floor, not a ceiling, to allow states to roll out new regulations as technology evolves and risks emerge.

Democrats have also supported provisions that would allow people to bring lawsuits—known as a private right of action—against companies over alleged violations of their privacy rights. The proposed text would instead give the Federal Trade Commission and state attorneys general enforcement authority.

“I look forward to digging into the bill but I’m skeptical at this point,” said Rep. Kathy Castor (D-Fla.), a lead proponent of advancing online safety and privacy protections.