The Midterms Will Decide Your Privacy Rights, and the Irony Is States' Rights
The Midterms Will Decide Your Privacy Rights, and the Irony Is States' Rights
By Tom Daly, Founder and CEO, Priwall by mePrism · October 2026
The short version
-
The midterms could shape federal privacy law. The November 3 elections may affect the future of the SECURE Data Act (H.R. 8413), a Republican-led proposal containing broad state-law preemption provisions.
-
State privacy protections are at issue. The bill's preemption language raises questions about the future of California's CCPA and Delete Act, Texas's privacy law, and laws in other states.
-
Opposition crosses party lines. A coalition of 18 state attorneys general and privacy agencies, including New Hampshire's Republican attorney general, has urged Congress to reject the bill, citing concerns about state authority.
-
Privacy advocates have raised objections. The Electronic Frontier Foundation calls the proposal "not a serious consumer privacy bill," criticizing its approach to consumer protections and privacy rights.
What privacy experts say
"The federal SECURE Data Act is not a serious consumer privacy bill, and its provisions—if enacted—would be a retreat from already insufficient state protections." — Electronic Frontier Foundation (EFF)
"Surveillance is the business model of the Internet." — Bruce Schneier, security technologist (Schneier on Security)
I don't usually write about elections. But in less than three weeks, Americans will decide who controls Congress, and almost nobody is talking about what that means for privacy. They should be. The result will go a long way toward deciding whether the privacy rights tens of millions of Americans already have make it through the next two years.
I'll be upfront about where I sit. I run a company that removes people's personal information from data brokers, so I have a professional stake in how this plays out. I also spend every day watching what happens when that information is for sale. That's why I think this bill deserves more attention than it's getting.
What's on the ballot for your privacy
House Republicans introduced the SECURE Data Act in April. Rep. John Joyce is the sponsor, with the backing of Energy and Commerce Chairman Brett Guthrie (Epstein Becker Green). It's pitched as a national privacy standard. What it would actually do is erase the stronger state laws that already protect people and bar states from doing better in the future.
The fight over it has broken down along party lines. At the June subcommittee hearing, Republicans argued for one national standard and Democrats warned it would strip away hard-won state protections (StateScoop). No Democrat supported the bill when it was introduced (The Verge). Rep. Frank Pallone, the committee's top Democrat, said it would "eliminate hard won privacy protections that millions of Americans currently enjoy" and leave states "forever barred" from addressing future harms (Route Fifty).
Nobody expects it to pass this year. Experts put the odds at "vanishingly small" (StateScoop). The question is the next Congress. If Democrats win the House and the Senate, the committees that write privacy law change hands, and this bill very likely goes nowhere. If Republicans keep control, I expect to see it, or something close to it, back in 2027 with more momentum.
That's why the timing matters. A blue wave is the most reliable protection consumer privacy rights have in the next Congress, and November 3 is when voters get to decide.
The states' rights irony
For decades, the Republican Party has made states' rights and local control part of its identity. This bill runs the other way. Its preemption clause says no state "may prescribe, maintain, or enforce any law" that "relates to the provisions of this Act" (H.R. 8413, Sec. 15). The U.S. Chamber of Commerce, one of its leading backers, has been explicit that a national privacy law "must explicitly state that it preempts or supersedes state laws and regulations related to data privacy and security" (U.S. Chamber).
"Relates to" is about as broad as legal language gets. The IAPP's analysis found it would likely preempt state consumer privacy laws, data broker registries, and possibly some sector-specific state laws (IAPP). EFF was blunter: the clause "would kill the 21 state consumer privacy laws passed in the past few years" (EFF). California's privacy agency told Congress it would strip away rights that more than 100 million Americans have today (CalPrivacy).
The states have noticed. In June, a coalition of 18 state attorneys general and privacy agencies wrote to congressional leaders opposing the bill and insisting that federal privacy law set "a floor, not a ceiling" (multistate letter). One signer was New Hampshire Attorney General John Formella, a Republican (Republican Attorneys General Association). Another was the attorney general of Virginia, the state whose privacy law became the model for the bill's framework (California Attorney General). The bipartisan National Conference of State Legislatures says it plainly: "Every preemptive law diminishes other expressions of self-government" (NCSL).
Look at Texas. Republican Attorney General Ken Paxton brought the first enforcement action any state attorney general has filed under a comprehensive state privacy law. He sued Allstate and its data subsidiary Arity, alleging they collected and sold driving data on more than 45 million Americans without consent (Texas Attorney General). The suit also alleges violations of Texas's data broker law (The Record). Those are exactly the kinds of state laws this bill's preemption clause is likely to reach.
So in this case, a Republican defeat would protect states' rights, and a Republican win would put them at risk. The bill gives up individual rights and states' rights alike, and what it gets in return is protection for the industry that profits from personal data.
Whose bill is this?
Supporters call the SECURE Data Act a consensus. I'd ask whose. More than 50 business associations have lined up behind it, including the Business Roundtable, NetChoice, the Association of National Advertisers, the Network Advertising Initiative, the Digital Advertising Alliance, and Privacy for America (Consumer Technology Association).
Its framework has a history. Supporters say it builds on a model "already adopted in 20 states" (U.S. Chamber). That model goes back to Virginia, where the first draft of the state's privacy law was written by an Amazon lobbyist, and TechNet's CEO said her group "worked hard to make sure" it became the national template (Politico). The watchdog group Issue One documented lobbyists handing state legislators full bill text closely resembling Virginia's law, with no private right of action and enforcement left to attorneys general alone (Issue One).
Bruce Schneier has spent years explaining why that matters. "Surveillance is the business model of the Internet," he writes, and data brokers "buy that surveillance data from the smaller companies, and assemble detailed dossiers on us" (Schneier on Security). A law built around that business model is going to protect it. The SECURE Data Act is the industry's preferred model scaled up to the national level, with the power to erase anything stronger. Our team traced the lobbying and campaign money behind it in SECURE Data Act: Follow the Money Behind H.R. 8413.
It makes it harder to protect yourself
The fine print matters most for people trying to get their information out of the data broker market. Under the SECURE Data Act:
There's no one-step deletion. The bill creates an FTC registry of brokers but no centralized deletion tool like California's (Security Boulevard). Connecticut is building its own, due by July 2028 (Legal500). Both would be exposed to preemption.
"Data broker" is defined narrowly. A company only counts if 50 percent or more of its revenue comes from selling personal data about people who aren't its customers (H.R. 8413, Sec. 16). A company that sells data as a lucrative side business never shows up in the registry.
"Publicly available" information isn't personal data. That covers government records and anything a business "has a reasonable basis to believe" is lawfully public (H.R. 8413, Sec. 16). It's the raw material of people-search sites: home addresses, property records, relatives, court filings.
You go one company at a time. You get two free requests per company per year for each right, and nothing in the bill lets an authorized agent act for you (H.R. 8413, Sec. 2). With hundreds of brokers out there, that right mostly exists on paper.
You can't sue. Only the FTC and state attorneys general can enforce it, and neither can file until a company has had 45 days to "cure" the violation (H.R. 8413, Sec. 12).
The states are moving the other way. California just extended the CCPA deletion right to data a business got from brokers and other third parties, effective January 1, 2027 (National Law Review). Connecticut will require brokers to register before selling data in the state starting the same day (CommLaw Group). This bill would lock the country in at a lower level just as state protections are starting to catch up with the industry.
EFF reached the same conclusion: the bill "would cause even more corporate surveillance of our personal information, by wiping out state laws that are more protective than this federal bill" (EFF). What you'd get is free-wheeling commercial surveillance with a federal stamp of approval. The profiles keep getting built and sold, and stopping it stays the job of individuals with the fewest tools to do it.
The Fourth Amendment runs on expectations
This is the part that worries me most, because it goes beyond consumer protection.
Since Katz v. United States in 1967, the Supreme Court has treated a government intrusion as a Fourth Amendment "search" when it violates an expectation of privacy "that society is prepared to recognize as reasonable" (Carpenter v. United States). In the 1970s, the Court added the third-party doctrine: "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties" (Carpenter v. United States). In 2018, Carpenter carved out cell phone location records because they hold "the privacies of life." The basic test hasn't changed, though. Your constitutional protection depends on what society expects.
Once people stop expecting privacy, it gets much harder to argue they're entitled to it. Law is one of the main ways a society says what it expects. As Schneier put it years ago, technology may produce the data, but "who is allowed access to it, how it is stored, how it is deleted—this is all a matter of laws" (Schneier on Security). When California lets residents delete their data from every registered broker in one step, it's saying people expect their information not to be bought and sold without their say. Connecticut's registry says the same thing, and so does Montana's requirement that state agencies get a warrant before buying sensitive data.
Justice Gorsuch made the connection himself. Legislatures, he wrote, have a role in defining Fourth Amendment rights, and "if state legislators or state courts say that a digital record has the attributes that normally make something property, that may supply a sounder basis for judicial decisionmaking than judicial guesswork about societal expectations" (Carpenter v. United States). State privacy laws are that kind of statement. Preempt them with a standard that treats commercial surveillance as normal, and you erase the record.
The Fourth Amendment limits the government, not private companies. In practice, the line between them is thin. A declassified 2022 intelligence community report confirmed that federal agencies buy commercially available data and that it can often be deanonymized to identify Americans (PCMag). We wrote about FBI Director Kash Patel confirming the practice in Is the Fourth Amendment Officially Fiction? Schneier and longtime EFF leader Cindy Cohn describe the pattern in a recent Lawfare essay: "This pipeline from private collection to governmental collection means that as companies collect more information for surveillance capitalism purposes, more is available to law enforcement as well" (Schneier and Cohn). Data that's been deleted from the commercial market can't be quietly bought by anyone.
The SECURE Data Act leaves that loophole open. It counts a sale to a government entity as a "sale" and asks companies to mention government sharing in their privacy notices, but it doesn't restrict it. It exempts government entities, and it says nothing in the Act restricts a company's ability to cooperate with law enforcement (H.R. 8413, Secs. 3, 11, 13, 16). EFF flagged another risk: the exemption for government contractors "could be wrongly interpreted to exempt certain data brokers from sale restrictions when those sales are made to the government" (EFF). Montana closed the loophole for state and local agencies in 2025 (EFF). The federal Fourth Amendment Is Not For Sale Act passed the House in April 2024 and has sat in the Senate ever since (Tech Times). Schneier and Cohn would go further and "reset the promise of the Fourth Amendment and recognize that a warrant is required prior to collection, access or use of information gathered through mass surveillance" (Schneier and Cohn).
Why this matters for democracy
Privacy isn't a luxury. In Schneier's words, "Privacy isn't just about having something to hide; it's a basic right that has enormous value to democracy, liberty, and our humanity" (Schneier on Security). A democracy depends on people being able to read, worship, organize, see a doctor, and disagree with their government without being catalogued. When a detailed profile of every American is for sale and the law treats that as normal, those freedoms erode without anyone voting to give them up.
That's the long-term cost. The near-term cost is simpler: protections states spent years fighting for would disappear the day the bill took effect. As EFF warned, it "would block state legislatures from protecting their residents from the privacy threats of tomorrow that are unforeseeable today" (EFF).
A floor, not a ceiling
I'd support a strong federal privacy law. Plenty of Americans live in states with no privacy law at all, and they deserve protection too. But it has to work the way California's privacy agency and the state attorneys general described: "a floor, not a ceiling" (CalPrivacy). EFF has said the same for years: "Federal privacy law must be a floor and not a ceiling" (EFF). A bill that erases stronger state protections fails that test, and right now the surest way to keep this one from becoming law is the outcome on November 3.
What you can do now
Federal privacy legislation is still being debated. There are practical steps you can take to understand the proposals, make your views known, and protect your personal information.
-
Vote on November 3
Before you vote, find out where your House and Senate candidates stand on federal preemption of state privacy laws.
-
Tell your representatives where you stand
Ask them directly whether they support a federal floor or a federal ceiling.
-
Use the rights you already have
If you live in California, file the state's free one-step deletion request with registered data brokers. Many other states give you the right to access and delete your data and to opt out of its sale.
-
Shrink your footprint
The less of your data is on the market, the less there is to sell, breach, or buy without a warrant.
At Priwall by mePrism, we remove personal information from 700+ data brokers and people-search sites, for individuals and for companies protecting their employees and executives. See what's exposed about you.
Ready to try Priwall by mePrism?
If you're a company protecting at-risk employees, or an individual concerned about your digital footprint, start your privacy removal today at mePrism.com
Because your data shouldn’t be a roadmap for violence.
Tom Daly is the founder and CEO of Priwall by mePrism, the enterprise open-source data-removal platform used by security, executive-protection and digital-risk teams to shrink broker exposure across U.S. data brokers and people-search sites.
