New Privacy Legislation Threatens Digital Rights: An EFF Analysis of the SECURE Data Act and UK Age-Gating

Featured image: Photo by Miguel Á. Padriñán on Pexels.

Across the globe, legislative bodies are increasingly proposing and enacting measures intended to enhance online safety and privacy. However, a closer examination often reveals that these initiatives, while well-intentioned on the surface, frequently introduce significant threats to fundamental digital rights, individual anonymity, and the very architecture of the open internet. Two prominent examples currently under scrutiny are the proposed SECURE Data Act in the United States and the push for widespread age-gating requirements in the United Kingdom. Both pieces of legislation, despite their stated goals, risk undermining existing protections, expanding surveillance, and creating a more controlled, less accessible digital landscape for everyone.

The SECURE Data Act: A Flawed Federal Approach to Privacy

The federal SECURE Data Act, drafted by Republicans on the House Energy and Commerce Committee, has been critically assessed as an inadequate and even detrimental piece of privacy legislation [1]. Far from offering robust consumer protections, its provisions would represent a significant retreat from the already insufficient state-level safeguards currently in place across the U.S. Compared to congressional proposals from previous years and the 21 state consumer privacy laws already enacted, the SECURE Data Act falls short in numerous critical areas [1].

One of the most troubling aspects of the bill is its extensive preemption clause. Section 15 of the Act would preempt any “law, rule, regulation, requirement, standard, or other provision [that] relates to the provisions of this Act.” This broad language could effectively nullify dozens, if not hundreds, of existing state privacy protections, including all 21 state consumer privacy laws passed in recent years, all 50 state data breach laws, and specific state prohibitions on the sale of biometric or location information. Even constitutional provisions in states like California, which protect an individual’s right to privacy, could be jeopardized [1]. This approach contrasts sharply with many federal privacy laws, such as HIPAA, which allow states to build stronger rights on top of a federal floor, rather than dismantling them [1].

Lack of Enforcement and Weak Defaults

A cornerstone of effective consumer protection is the ability for individuals to defend their own rights in court. However, the SECURE Data Act conspicuously lacks a private right of action, meaning consumers would be unable to sue companies for violations of their privacy. Instead, enforcement authority rests primarily with the Federal Trade Commission (FTC) and state attorneys general, bodies that often lack the resources to address every infraction [1]. Compounding this issue, the bill introduces a 45-day “cure period,” allowing companies to rectify any violation without penalty after being caught. Furthermore, a vaguely defined self-regulatory scheme in Section 8 would permit companies to be audited by an “independent organization” applying a “code of conduct,” granting them a presumption of compliance—an implicit admission that the bill provides no new enforcement resources [1].

The bill also suffers from weak privacy defaults, placing the burden squarely on the consumer to opt out of invasive practices rather than requiring companies to obtain explicit consent. Practices like targeted third-party advertising, the sale of personal data, and profiling would continue unless a user actively navigates complex settings to opt out [1]. While consent is required for processing sensitive data, this often translates into companies designing deceptive interfaces to trick users into agreeing to terms they don’t fully understand [1]. Moreover, the bill’s definition of “data minimization” in Section 3 is largely superficial, only limiting data processing to what a company “disclosed to the customer,” effectively sanctioning broad data collection as long as it’s buried in an unread privacy policy [1].

Loopholes and Ambiguous Definitions

The SECURE Data Act is riddled with loopholes and poorly defined terms that technology companies could exploit. For instance, government contractors are exempt under Section 13(b)(2), which could be misinterpreted to shield data brokers selling information to the government from sale restrictions, potentially benefiting surveillance firms [1]. The definition of “sale” itself is too narrow, excluding exchanges for “other valuable consideration” present in stronger privacy laws [1]. The definition of “biometric information” is also problematic, excluding data generated from photos or videos and face scans not explicitly intended to “identify a specific individual,” which could permit biometric identification from security footage or sentiment analysis [1]. The bill also exempts “de-identified data” from the definition of personal data, despite the known risks of re-identification [1]. Furthermore, consumers’ deletion requests for data obtained from third parties are treated merely as opt-out requests, and companies could still retain data for “research purposes” [1]. Even profiling is allowed as long as it’s not “solely automated,” meaning a flimsy human review could exempt highly automated processes [1].

UK Age-Gating: A Threat to the Open Web

Simultaneously, the United Kingdom is pursuing aggressive age-gating and access restriction measures, particularly following the passage of the Children’s Wellbeing and Schools Bill. These proposals, while framed as efforts to protect children online, risk fundamentally reshaping the internet in harmful ways for all users [2]. A coalition of 19 organizations, including the EFF, Mozilla, Tor Project, and Open Rights Group, has urged UK policymakers to address the root causes of online harm instead of resorting to blunt restrictions that undermine the open web [2].

The Perils of Age Assurance Technologies

The proposed policies heavily rely on age assurance technologies, which are often either inaccurate, privacy-invasive, or both. Mandating such systems across a vast array of online services—from social media and video games to VPNs and even basic websites—would compel users to verify their identity simply to access the internet [2]. This creates severe risks, including expanded surveillance, increased vulnerability to data breaches, and a significant erosion of anonymity online [2]. The idea that age gates are a “silver bullet” for the internet’s problems is a dangerous misconception, potentially leading to a “dangerous new system of control” [3].

Fragmenting the Internet and Suppressing Anonymity

Beyond privacy concerns, these measures pose a direct threat to the core architecture of the open internet. Widespread age-gating could fragment the web into a patchwork of restricted jurisdictions, limiting access to information and entrenching the dominance of powerful gatekeepers like app stores and platform ecosystems [2]. This approach risks weakening the very qualities of interoperability, accessibility, and openness that have made the internet a global public resource. The coalition emphasizes that the internet remains a vital space for young people, offering access to information, support networks, and opportunities for expression that may not be available offline. Policies that restrict access risk cutting off these crucial lifelines without meaningfully reducing harm [2].

Addressing Root Causes, Not Symptoms

The organizations opposing these UK measures argue that the current policy approach misses the crucial point: meaningful efforts should focus on addressing the underlying drivers of online harm. Many digital platforms are designed to maximize engagement and profit through pervasive data collection and targeted advertising, often at the expense of user safety and autonomy [2]. Instead of imposing access bans, policymakers should hold companies accountable for these systemic practices and prioritize user rights by design, fostering an internet that is safe and empowering without sacrificing privacy or openness [2]. This sentiment echoes concerns about similar legislative efforts, like a proposed social media ban in California, which also raise questions about online censorship and constitutional rights [3].

Conclusion: A Unified Front for Digital Rights

Both the U.S. SECURE Data Act and the UK’s age-gating proposals illustrate a concerning trend where legislative efforts, ostensibly aimed at improving online safety or privacy, inadvertently threaten the foundational principles of a free and open internet. From the SECURE Data Act’s potential to preempt stronger state laws and its lack of meaningful consumer enforcement, to the UK’s embrace of privacy-invasive age verification technologies that could fragment the web and erode anonymity, these policies represent a step backward for digital rights. True progress in online safety and privacy requires thoughtful, rights-respecting policies that address the systemic issues of data exploitation and platform design, rather than imposing blunt, top-down controls that compromise the very freedoms they claim to protect.

Key Takeaways

• The SECURE Data Act is a weak federal privacy bill that could preempt stronger state laws and offers inadequate consumer protections.
• The Act lacks a private right of action, has weak opt-out defaults, and contains numerous loopholes and flawed definitions.
• UK age-gating proposals threaten digital rights by mandating privacy-invasive identity verification for broad internet access.
• These age assurance technologies risk expanded surveillance, data breaches, and the fragmentation of the open internet.
• Effective online safety measures should focus on addressing the root causes of harm, such as exploitative platform design and data collection, rather than imposing restrictive controls.

Sources

1. [1] The SECURE Data Act is Not a Serious Piece of Privacy Legislation (www.eff.org)
2. [2] EFF and 18 Organizations Urge UK Policymakers to Prioritize Addressing the Roots of Online Harm (www.eff.org)
3. [3] 👎 California's Terrible, No Good, Very Bad Social Media Ban | EFFector 38.9 (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.