New Legislation Threatens Digital Privacy: Analyzing the US SECURE Data Act and UK Online Harm Bill

Featured image: Photo by Miguel Á. Padriñán on Pexels.

In the name of online safety and consumer protection, governments worldwide are increasingly proposing and enacting legislation that, while seemingly well-intentioned, poses significant threats to digital privacy and the fundamental architecture of the open internet. Two prominent examples currently under scrutiny are the US SECURE Data Act and the UK Online Harm Bill, both of which illustrate a concerning trend towards greater state control and diminished individual liberties online. These legislative efforts, often framed as necessary safeguards, risk fundamentally reshaping how individuals interact with the digital world, potentially leading to expanded surveillance, fragmented access, and a rollback of established privacy rights.

The US SECURE Data Act: A Step Backward for Privacy

The federal SECURE Data Act, recently drafted by Republicans on the House Energy and Commerce Committee, presents itself as a comprehensive consumer privacy bill. However, a closer examination reveals that its provisions would represent a significant retreat from existing protections and establish a weaker standard for data privacy across the United States. Far from being a robust solution, the bill is weaker than many congressional proposals from prior years and falls short of the standards set by most of the 21 state consumer privacy laws already in effect [2].

One of the most troubling aspects of the SECURE Data Act is its sweeping preemption clause. Section 15 of the bill states that it would preempt any “law, rule, regulation, requirement, standard, or other provision [that] relates to the provisions of this Act.” This broad language could effectively wipe out dozens, if not hundreds, of existing state privacy protections, including state consumer privacy laws, data breach laws, and even those related to specific sensitive data like biometric or location information. For instance, California’s robust data broker deletion tool and requirements for companies to comply with automatic opt-out signals, such as those built into tools like Privacy Badger, would be jeopardized. Even state constitutional provisions protecting individual privacy could be at risk [2].

Beyond preemption, the SECURE Data Act suffers from several other critical flaws. Crucially, it lacks a private right of action, meaning consumers would be unable to sue companies directly to defend their own privacy rights. Instead, enforcement authority would primarily rest with the Federal Trade Commission (FTC) and state attorneys general, agencies often under-resourced to address the vast number of potential violations. To compound this, the bill includes a “cure period,” allowing companies 45 days to remedy any violation without penalty once caught. This provision undermines accountability and incentivizes a reactive, rather than proactive, approach to privacy compliance [2].

Weak Defaults and Loopholes

The bill also establishes weak privacy defaults, placing the burden squarely on consumers to opt out of invasive practices. Instead of requiring companies to minimize data collection by default, the SECURE Data Act allows practices like targeted third-party advertising, the sale of personal data, and profiling to continue unless a user actively opts out. While consent is required for processing sensitive data or using data for previously undisclosed purposes, these consent mechanisms are often designed in ways that trick users into giving away their rights through confusing policies [2].

Furthermore, the bill’s definition of “data minimization” is superficial, limiting data processing only to what a company “disclosed to the customer,” rather than what is strictly necessary to provide a service. This distinction is significant, as it means companies can collect and process vast amounts of data as long as it’s buried in an unread privacy policy. The bill also explicitly states that “nothing in this Act may be construed to restrict” a company from collecting, using, or retaining data to “develop” or “improve” new technologies, creating a broad exemption for data use that many internet users might find concerning [2].

The SECURE Data Act is riddled with definitional loopholes that could be exploited by technology companies. For example, government contractors are exempt from the bill, which could allow surveillance companies to avoid sale restrictions when dealing with government entities. The definition of “sale” is too narrow, excluding exchanges for “other valuable consideration” beyond monetary. The definition of “biometric information” excludes data generated from photos or videos and face scans not explicitly meant to “identify a specific individual,” potentially allowing for widespread biometric identification from security footage or for sentiment analysis. Even “de-identified data” is exempted from the definition of personal data, despite the known challenges in truly anonymizing data. These and other flaws make it clear that the SECURE Data Act, if enacted, would not provide serious consumer privacy protection and could, in fact, worsen the current landscape by overriding stronger state-level efforts [2].

The UK Online Harm Bill: Age-Gating and the Erosion of the Open Web

Across the Atlantic, UK policymakers are also pursuing measures under the umbrella of the Children’s Wellbeing and Schools Bill, often referred to as the UK Online Harm Bill. While presented as efforts to protect children online, these proposals, particularly sweeping age-gating requirements and access restrictions, threaten to fundamentally reshape the internet for all users, not just young people [3].

The core issue lies with the reliance on age assurance technologies. These systems are frequently inaccurate, privacy-invasive, or both. Mandating such technologies across a broad spectrum of online services—from social media platforms and video games to virtual private networks (VPNs) and even basic websites—would effectively force users to verify their identity simply to access the web. This creates severe risks, including expanded surveillance, a heightened potential for data breaches, and a significant erosion of anonymity, a cornerstone of free expression and privacy online [3].

Beyond individual privacy concerns, these measures pose a profound threat to the core architecture of the open internet. Implementing age-gating at scale could fragment the web into a patchwork of restricted jurisdictions, limiting access to information and entrenching the dominance of powerful gatekeepers like app stores and large platform ecosystems. This approach risks weakening the very qualities—interoperability, accessibility, and openness—that have made the internet a global public resource and a vital space for communication, learning, and support networks for young people and adults alike [3].

Addressing Root Causes vs. Blunt Restrictions

A significant criticism of both legislative approaches is their failure to address the underlying drivers of online harm. Many digital platforms are designed to maximize engagement and profit through pervasive data collection and targeted advertising, often at the expense of user safety and autonomy. Rather than imposing blunt access bans or weak opt-out systems, privacy advocates argue that policymakers should hold companies accountable for these systemic practices and prioritize user rights by design [3].

The global trend of governments racing to impose new systems of control in the name of online safety, as seen with both the SECURE Data Act and the UK Online Harm Bill, risks setting dangerous precedents [1]. These efforts often overlook the critical role the internet plays in providing access to information, support networks, and opportunities for expression that may not exist offline. Policies that restrict access, diminish privacy, and preempt stronger state protections risk cutting off these vital lifelines without meaningfully reducing harm. Protecting users online requires thoughtful, rights-respecting policies that tackle the business models and design choices driving harm, while preserving the open, global nature of the web.

Key Takeaways

• The US SECURE Data Act is a weak privacy bill that could preempt stronger state laws and lacks a private right of action for consumers [2].
• The SECURE Data Act’s provisions include weak opt-out defaults, inadequate data minimization, and numerous loopholes that could be exploited by companies [2].
• The UK Online Harm Bill proposes sweeping age-gating requirements that threaten privacy, anonymity, and the open architecture of the internet for all users [3].
• Both legislative efforts exemplify a global trend where “online safety” initiatives risk expanding surveillance and government control over digital spaces [1].
• Effective online protection requires addressing the root causes of harm, such as exploitative business models and pervasive data collection, rather than imposing blunt restrictions or weakening existing privacy rights.

Sources

1. [1] 👎 California's Terrible, No Good, Very Bad Social Media Ban | EFFector 38.9 (www.eff.org)
2. [2] The SECURE Data Act is Not a Serious Piece of Privacy Legislation (www.eff.org)
3. [3] EFF and 18 Organizations Urge UK Policymakers to Prioritize Addressing the Roots of Online Harm (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.