GovTech Videos

Unpacking the SECURE Data Act

The Tech Policy Press podcast breaks down the newly introduced Secure Data Act, a Republican‑led effort to create a federal privacy framework. Host Justin Hendrickx interviews CDT privacy director Eric Null, who frames the bill as a regression compared with the more robust state statutes that have emerged over the past few years. Null points out that the legislation copies the Kentucky model, adopts a narrow definition of “sensitive data” that omits most health, neural and communication information, and relies on a data‑minimization clause that merely requires companies to disclose practices in privacy policies. In addition, the bill contains sweeping exemptions—service‑related, contractual, and internal‑research clauses—that effectively let firms avoid compliance, especially for AI training data. The conversation highlights concrete concerns: Null calls the act a “major step backward,” noting the absence of impact‑assessment requirements and dark‑pattern prohibitions. He cites Meta’s plan to track keystrokes for AI training and the ubiquitous “accept‑all” cookie banners as examples of how companies could exploit the law’s weak safeguards. If enacted, the Secure Data Act would preempt state privacy and civil‑rights statutes, eroding the primary enforcement mechanisms for discrimination claims in the digital economy. The result would be a federal framework that offers little new protection while cementing industry‑friendly rules at a time when AI‑driven data collection is accelerating.