In April 2026, John Joyce introduced a bill called the SECURE Data Act. The name sounds like consumer protection. Read what it does to the laws you already have.

H.R. 8413 sets a single national standard for how companies can collect and sell your personal data — and then it preempts every state law that "relates to" anything it covers. At least 20 states have passed comprehensive privacy laws. Under Joyce's bill, those state laws stop applying, along with state data broker registries and, potentially, sector-specific state laws too.

Joyce is a doctor from Altoona who serves as vice chairman of the House Energy and Commerce Committee — the committee that writes the rules for telecoms, tech platforms and data brokers.

Which laws would go away

The state laws in the crosshairs are not obscure. At the June 3 subcommittee hearing on the bill, critics named them:

• California's Delete Act, which lets you tell every registered data broker in one request to delete everything they hold on you
• Illinois' Biometric Information Privacy Act, the law that lets Illinois residents sue when a company scans their face or fingerprints without permission
• Washington's My Health, My Data Act, which covers health data that HIPAA doesn't — period-tracking apps, location data showing a clinic visit

In total, more than 20 state laws would be knocked out, according to the objections raised at the hearing.

Preemption cuts both ways in time, too. It doesn't just erase what states have already passed — it takes the subject away from them going forward. Whatever Harrisburg might want to do about data brokers in five years, it wouldn't be able to.

You would not be able to sue

The most important thing in a privacy law is not what it promises. It's who can enforce it.

Joyce's bill has no private right of action. Enforcement runs through the Federal Trade Commission and state attorneys general only. If a company sells your data in violation of the law, you cannot take them to court yourself. You can file a complaint and hope a federal agency gets to it.

Compare that to Illinois' biometric law, which the bill would preempt — a law whose entire force comes from the fact that ordinary people can sue. Remove the right to sue and you have converted a law with teeth into a law with a suggestion box.

The bill also loosens the clock. Under California's law a company has 15 days to respond to a request about your data. Under Joyce's bill it gets 90.

He told a reporter who asked for it

The most revealing thing about this bill is how Joyce himself described its origin. Talking to Roll Call in May about why he thinks Democrats will come around, he said:

"I think we're going to find Democrats who recognize how important this is, and that's because of the response of industry."

And on where the demand came from:

"They said industry came to us and said, 'Please, not one more. This should be done at a federal level.'"

Not one more. That is the complaint the bill answers — not "my data got sold," but "we have to comply with too many state laws." Companies wanted one rulebook, and the cheapest rulebook is the one that cancels twenty others.

His committee chairman put the framing even more plainly at the June hearing: "We're not looking to compete with Europe to regulate; we're looking to compete against China to innovate."

Democrats on the committee were blunt. Rep. Frank Pallone said the bill "locks in the failed notice and consent status quo." Rep. Kathy Castor called it "an appalling betrayal of hardworking Americans."

And Caitriona Fitzgerald of the Electronic Privacy Information Center testified that the state-law model the industry now says is too burdensome was written by the industry in the first place: "They took it to Virginia first … and then brought it to these now 22 states."

Who pays for John Joyce

Joyce's committee regulates the companies that would benefit most from this bill, and those companies fund him.

According to Who Bought My Rep, which compiles totals from federal campaign filings, the Comcast Corporation & NBCUniversal PAC has given Joyce $35,000 — his eighth-largest PAC donor. He has raised $7.0 million since 2020, of which 57% came from PACs and just 18% from large individual donations.

The number that should stop you is this one: Joyce ranks #433 out of 440 House members in grassroots funding — and #270 out of 275 Republicans. Almost nobody in Congress raises less of their money from ordinary people than John Joyce does.

That's the context for a bill written to answer industry's request. He is not funded by the people whose privacy laws he would repeal.

This is a strategy, not a bill

Preempting states is the whole game right now. An AI super PAC with $140 million exists specifically to stop states and cities from writing their own AI rules, and is spending $850,000 on one Oklahoma Republican. A California Republican used his first weeks in Congress to ask the Pentagon to study how federal authority could "preempt or otherwise mitigate" California's fuel rules. And when Big Tech money shows up, the promises to "hold Big Tech accountable" tend to arrive right alongside the checks.

State legislatures are where privacy law actually got written in this country, because Congress spent 20 years not doing it. Joyce's answer is to write one weak federal law and use it to switch the state ones off.

We deserve better.

Sources

SECURE Data Act: Analysis of the new federal privacy bill — International Association of Privacy Professionals. Hearing coverage: StateScoop (Keely Quinlan, June 2026) and Roll Call (Allison Mollenkamp, May 14, 2026). Photo: official U.S. House portrait.