House Republicans on Wednesday unveiled an industry-friendly privacy
bill that would override laws in at least 20 states and, as currently drafted, wouldn't require businesses to allow consumers to reject common forms of online ad targeting.
The Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Data Act), introduced by Rep. John Joyce (Pennsylvania), would give consumers some rights
over data that clearly identifies them -- including the right to learn if such data is being processed, and to opt out of its sale.
The proposed law also has a provision
allowing consumers to opt out of targeted advertising, but with a significant exception: Consumers would not have the right to opt out of targeted ads based on pseudonymous data -- such as mobile
device identifiers, or tracking cookies -- provided that the pseudonymous identifiers are stored separately from other information that's "necessary to identify" the consumer.
advertisement
advertisement
Most state
privacy laws give consumers the right to reject targeted ads based on pseudonymous data.
Ad industry groups are praising the SECURE Act, with the Association of National
Advertisers stating that the bill "charts the best path to a national privacy standard."
The umbrella industry group Privacy for America likewise cheered the bill, describing it as a law that
"protects consumers while preserving beneficial practices that promote competition and drive innovation and economic growth."
Stuart Ingis, counsel to Privacy for America,
tells MediaPost that the organization supports the idea that consumers have the right to opt out of targeted advertising based on pseudonymous data.
He adds that the portion of
the bill that doesn't give consumers that right appears to reflect a "drafting error that needs to be fixed."
The ad industry's self-regulatory principles have long provided that advertisers
must allow consumers to reject behaviorally targeted ads based on pseudonymous information, such as data stored in tracking cookies.
Privacy advocates denounced the bill as too
weak.
"The protections are pretty flimsy," Justin Brookman, director of technology policy for Consumer Reports, tells MediaPost.
"The broad carve-out
for pseudonymous data seems like a massive loophole," he adds.
Other groups including Public Knowledge and the Center for Democracy & Technology also criticized the
proposed law.
"This new bill would federally codify industry-favored state privacy rules while preempting state laws that include stronger protections," Eric Null at Center for
Democracy & Technology stated.
The measure grows out of an initiative dating to February 2025, when Republicans on the House Energy and Commerce
Committee formed a working group to explore potential legislation.
The advertising-friendly approach in the new bill marks a departure from two prior bipartisan proposals -- both of which were
opposed by industry groups.
The American Data Privacy and Protection Act, proposed in 2022, would have prohibited companies from collecting or processing data about people's
cross-site activity for ad purposes -- effectively outlawing one form of behavioral targeting.
The House Energy and Commerce Committee advanced that bill by a vote of 53-2 in 2022, but the full House didn't
vote on the measure, and the Senate didn't hold hearings on it.
In 2024, Senator Maria Cantwell (D-Washington) and Representative Cathy McMorris Rodgers (R-Washington) unveiled
the bipartisan American Privacy Rights Act. That bill, which failed to advance, also would have
prohibited businesses from serving targeted ads to consumers based on their activity across unaffiliated sites and apps.