The Privacy Law Patchwork Just Got a Federal Contender

2026 has been a busy year for privacy law, and almost none of it has made front-page news. No single dramatic breach drove it — just the slow, compounding effect of state legislatures, one federal bill, and a regulator that's been sending letters. Here's where things actually stand, as of this writing.

A real attempt at one federal law

On April 22, 2026, House Republicans introduced the SECURE Data Act (formally, the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act) through the House Energy & Commerce Committee. It's being described as the most serious attempt at comprehensive federal privacy legislation in years — the goal is to replace the current 20-plus-state patchwork with a single national standard.

The bill's substance, as introduced:

• Opt-in consent would be required before a company processes "sensitive data" — health records, geolocation, financial information, and employee data all fall under that category.
• Parental consent would be required to collect personal data from teens between 13 and 16.
• A national data broker registry would be created at the FTC, requiring brokers to publicly register and disclose their data practices.

It isn't the only bill in play. Rep. Zoe Lofgren's Online Privacy Act of 2026 and the Senate's Consumer Data Privacy and Security Act of 2026 are both alive in committee, each with a different balance of federal preemption versus state authority — historically the sticking point that's killed every previous attempt at a federal privacy law. None of these bills has passed as of this writing. We're tracking bill text, not law.

States keep moving without waiting

While Congress debates preemption, states have kept legislating. Oklahoma became the 20th state to enact a comprehensive consumer data privacy law when Governor Kevin Stitt signed SB 546. Alabama followed shortly after as the 21st. Indiana, Kentucky, and Rhode Island's own comprehensive laws took effect January 1, 2026.

A few narrower but meaningful bills also passed:

• Connecticut SB 4 amends the state's consumer data privacy law and establishes a data broker registration requirement — brokers doing business in the state now have to identify themselves to regulators.
• Kentucky HB 692 adds "automatic content recognition" (the technology smart TVs use to track what you're watching) as a category of sensitive data under the state's privacy law.
• Virginia SB 338 prohibits a controller from selling or offering to sell precise geolocation data outright — not just requiring consent, but banning the sale.

Louisiana and Oklahoma have additional privacy provisions taking effect January 1, 2027; Alabama's law phases in further requirements by May 1, 2027; Vermont's law takes effect January 1, 2028.

The FTC took a run at data brokers directly

On February 9, 2026, the FTC sent formal warning letters to 13 data brokers, reminding them of their obligations under the Protecting Americans' Data from Foreign Adversaries Act (PADFAA), which restricts selling Americans' sensitive data to entities connected to China, Russia, and other designated adversary nations. The letters put a concrete number on the table: penalties up to $53,088 per violation. The FTC described itself as "monitoring the marketplace" for violations going forward.

That enforcement continues a pattern from the last few years targeting the location-data brokerage industry specifically — the FTC's 2024 actions against X-Mode/Outlogic and InMarket Media, and its case against Gravy Analytics and its subsidiary Venntel over the sale of precise location data tied to visits to medical facilities, religious institutions, and other sensitive locations.

What this means if you're not a lawyer

None of this changes what a router can do for you, and we want to be upfront about that. A comprehensive federal privacy law, if the SECURE Data Act or something like it eventually passes, would primarily change what companies are allowed to do with data they collect from you — opt-in requirements, broker registries, enforcement teeth. It's a meaningfully different lever than anything running on your home network.

What it does mean: the legal landscape is shifting toward less tolerance for silent data collection and resale, not more. Data broker registries mean brokers can no longer operate anonymously. Geolocation sale bans (Virginia) and sensitive-data opt-in requirements (the SECURE Data Act, if passed) target exactly the kind of practices that have made data brokers a profitable, largely unaccountable industry for the last decade.

GhostPort's job is the layer underneath all of this: what leaves your house before any of these laws or their exceptions even come into play. Encrypted DNS, tracker blocking at the network level, and keeping your ISP from logging and reselling your browsing history don't require Congress to pass anything. They're things you control today.