Cybersecurity Policy Report, Federal Privacy Bill’s State Preemption Provisions Face Opposition From California Officials, (Apr 28, 2026)

By Tony Foley

The California Privacy Protection Agency (CalPrivacy) yesterday outlined the agency’s opposition to recently introduced legislation that would create a federal privacy and data protection law.

The Securing and Establishing Consumer Uniform Rights and Enforcement over (SECURE) Data Act (H.R. 8413, 119th Cong. (2026)) would establish a preemptive federal privacy standard that would enact consumer rights and impose obligations on data controllers and processors, with provisions similar to those in state laws. It was introduced last week by House Energy and Commerce Committee Republicans (CPR, April 22).

In a letter to Reps. Brett Guthrie (R., Ky.), the committee’s chairman, and Frank Pallone Jr. (D., N.J.), its ranking member, CalPrivacy emphasizes that the bill’s preemption language would eliminate privacy protections currently available to more than 100 million Americans based on the comprehensive privacy laws enacted in 21 states. The letter focuses on California’s enactment of a variety of privacy provisions, with an emphasis on the provisions of the California Consumer Privacy Act (CCPA) in 2018, as amended by the voter-initiated California Privacy Rights Act (CPRA) in 2020, as well as the DELETE Act in 2023, which amended existing data broker requirements and required the development and launch of a “one-stop-shop” deletion mechanism.

The agency claimed that the SECURE Data Act would represent a significant step back for consumer privacy and offered the following points:

1. The bill would not require businesses to honor opt-out preference signals, tools that allow consumers to easily communicate their privacy preferences to the businesses with which they interact;

2. The bill would significantly reduce important data broker disclosure requirements and functionally eliminate California’s data deletion tool applicable to data brokers, the Delete Request and Opt-out Platform (DROP) mechanism;

3. The bill would not prohibit businesses from “nudging” consumers into sharing their data, particularly through the use of dark patterns, which are prohibited under the CCPA;

4. The bill would limit consumer requests to exercise their privacy rights, allowing businesses to charge for, or simply ignore, such requests in excess of two per year; and

5. The bill would fail to require risk assessments for processing that presents a significant risk to consumer privacy.

The letter adds that the SECURE Data Act would weaken a variety of guardrails on the collection, use, and sharing of personal data in existing state privacy laws, among them the failure to limit how much data businesses can use, retain, and share about consumers.

The federal proposal also would fail to adequately restrict the purposes for using consumer data or establish any limits on data retention and would not offer heightened protection for many types of sensitive personal data, it says.

With respect to enforcement of privacy protections, the letter maintains that the SECURE Data Act seeks to eliminate a robust multi-layered enforcement system, preempting the creation of state-level privacy authorities like CalPrivacy and allowing for enforcement only by the Federal Trade Commission or state attorneys general. The agency also contends that the bill’s permanent 45-day cure period would incentivize noncompliance, encouraging businesses to take a “wait-and-see” approach to compliance.

“A strong federal privacy law is worth pursuing, but it should not strip away rights that tens of millions of people already depend on,” said Tom Kemp, CalPrivacy’s executive director. “The SECURE Act would set privacy rights back and make it much harder for consumers to exercise them in this AI-driven world where personal data is being collected at unprecedented scale.”

“At a time when technology is moving faster than ever, limiting states’ ability to protect consumers beyond the federal minimum would dismantle longstanding safeguards for Californians,” added Maureen Mahoney, CalPrivacy’s deputy director–policy & legislation. “This bill will block essential flexibility and innovation.”

News: FederalLegislation StateLegislation DataPrivacy CCPA