A small business advocacy coalition this week voiced conditional support for the SECURE Data Act, the House Republican bill introduced on April 21, 2026, that would replace all US state privacy laws with a single federal framework - while simultaneously raising pointed concerns about the legislation's potential consequences for digital advertising access.

Internet for Growth, a coalition representing hundreds of small businesses and creators across the United States, released a statement on April 22, 2026, responding to the introduction of H.R. 8413. Executive Director Brendan Thomas issued the statement, making the coalition one of the first small-business-focused groups to weigh in publicly on what is shaping up to be one of the most consequential pieces of consumer data legislation since the California Consumer Privacy Act.

The bill's structure

The SECURE Data Act - formally titled the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act - was introduced by Representative Joyce of Pennsylvania on April 21, 2026, during the 119th Congress, 2nd Session, and was referred to committee on the same day. As PPC Land reported when the bill was introduced, the legislation would create a unified national framework for consumer privacy rights and the protection of personal data, with enforcement authority split between the Federal Trade Commission and state attorneys general.

The bill applies to entities subject to the FTC Act or to common carriers subject to the Communications Act of 1934, but only where specific thresholds are met. An entity must either collect and process personal data of more than 200,000 consumers annually with annual gross revenue of $25 million or more, or collect and process personal data of 100,000 or more consumers annually while deriving 25 percent or more of annual gross revenue from the sale of that personal data. Those thresholds matter enormously for smaller operators. Businesses below those floors would not be covered as controllers under the bill's primary obligations, though they may still face obligations as processors if they handle data on behalf of covered entities.

Section 15 of the bill states that no state may "prescribe, maintain, or enforce any law, rule, regulation, requirement, standard, or other provision having the force and effect of law" relating to the provisions of the Act. Total federal preemption would override state-level enforcement regimes, including California's, and shift all authority to the FTC and state attorneys general acting under federal law. As PPC Land has noted in coverage of the ANA's endorsement of the bill, the Association of National Advertisers - whose members collectively control the majority of US advertising expenditure - explicitly framed their support around the economic weight of the advertising industry, citing 29 million US ad jobs at stake.

What Internet for Growth said

According to the Internet for Growth statement, the coalition supports the bill's direction toward a national standard, describing the introduction of H.R. 8413 as "an important step in the ongoing effort to establish a national privacy framework." The statement acknowledged that the bill builds on existing state privacy laws, including the right to opt out of the sale of personal data and targeted advertising, as well as the right to access and delete personal data.

Thomas was specific about what the coalition wants resolved. According to the statement, the bill presents "an opportunity to resolve key differences among them, including data minimization and sensitive data definitions, that today create uncertainty and increase compliance costs for small businesses." The phrase "data minimization" refers to the principle that entities should collect only the data strictly necessary for specified purposes - a requirement with direct compliance implications for smaller companies operating marketing tools across multiple channels.

The statement also addressed the concept of "workable obligations for smaller firms," framing this as a distinct consideration from larger enterprises that have dedicated legal and compliance teams. Moving toward a single national standard, the statement said, "has the potential to provide the clarity and consistency that both consumers and businesses need."

That caveat - "has the potential" - is doing real work in the statement. It signals conditional rather than unconditional support.

The advertising access concern

The most direct tension in the Internet for Growth statement centers on digital advertising. According to the statement, "for millions of small businesses, entrepreneurs, and creators, digital advertising is not a luxury - it is the most efficient and affordable way to reach customers, compete with larger companies, and grow."

That claim sits within a broader policy debate about whether opt-out rights for targeted advertising, even when framed as consumer protections, carry costs for smaller advertisers that are disproportionate compared with larger platforms. Large technology platforms have legal teams, compliance infrastructure, and alternative revenue streams. A small business running search and social campaigns through self-service platforms does not.

The concern is structural. Digital advertising revenue in the United States reached $294.6 billion in 2025, according to IAB data cited by PPC Land, growing 13.9% year-over-year without the cyclical boost of an Olympics or major election cycle. The targeted advertising ecosystem that small businesses depend on operates inside that larger infrastructure. A national opt-out right for targeted advertising, applied to the entire US population rather than just residents of states with existing privacy laws, changes the addressable audience for every business that buys digital ads - including businesses well below the bill's controller thresholds.

The Proximic by Comscore 2024 State of Privacy in Advertising Report found that 88% of advertising decision-makers anticipated a moderate to significant impact on their ability to deliver personalized advertising in regions with data privacy laws. Among more than 200 surveyed brands, agencies, and publishers, 56% reported already facing limitations in audience targeting where such laws were in effect. Thirty-one percent said they had experienced increased costs as a direct result of privacy compliance efforts.

That research predates the SECURE Data Act, but the direction it points is relevant context for evaluating the Internet for Growth statement. If a patchwork of state laws is already generating measurable cost increases and targeting limitations, the question the coalition is raising is whether a national law set at the same or higher baseline would amplify those effects uniformly across the US market.

The patchwork problem

Internet for Growth was explicit that the status quo is not acceptable either. The statement described the current landscape as a "patchwork of state laws" driving up costs and creating uncertainty for smaller firms. That framing aligns with the core argument made by the ANA and other industry groups in support of federal preemption.

California, for its part, has maintained one of the most active enforcement regimes in the country. The state secured a $1.55 million settlement with Healthline Media in July 2025 for failing to honor opt-out requests, followed by a $1.4 million settlement with mobile gaming company Jam City in November 2025 for violations including failure to provide opt-out mechanisms across 21 mobile applications. Those settlements involved companies of a size that could absorb the financial impact. A small business facing an investigation under a state privacy regime operates under very different conditions.

California's CCPA updates effective January 1, 2026 expanded requirements around consumer consent, requiring businesses to enter agreements with any third party, service provider, or contractor receiving consumer data. Those contracts must specify that information transfers occur only for limited purposes. Each new layer of state-level obligation adds to the compliance burden Internet for Growth describes.

Google, as PPC Land's analysis of the SECURE Data Act noted, has had to implement Restricted Data Processing mode across an expanding list of states and rolled out Universal Opt-Out Mechanism support to eight additional states as of June 2025. That overhead sits on top of the broader ecosystem. Consent management platforms must route signals according to the applicable state framework. Data processing contracts must be customized for each jurisdiction. None of that disappears without federal legislation that preempts the state regimes entirely.

Balancing act

The Internet for Growth statement was careful to avoid suggesting that consumer privacy protections should be weakened. According to the statement, "Internet for Growth supports strong, clear, and consistent privacy protections for Americans. People deserve transparency and control over their data, and companies have a responsibility to safeguard that data through responsible practices and protections."

The statement positioned small businesses as already taking data obligations seriously, framing trust as commercially essential rather than merely regulatory. "Small businesses take this obligation seriously because trust is essential to their success," according to Thomas.

The distinction the coalition is drawing is between the principle of privacy protection and the specific mechanism by which it is implemented. A framework that "protects consumers while still allowing small businesses to connect with customers in responsible and transparent ways" - as the statement describes it - would need to keep compliance costs low, limit unnecessary legal risk, and preserve access to the advertising tools that smaller firms use to compete with companies that have larger marketing budgets and brand recognition.

Whether the SECURE Data Act achieves that balance is a question the statement leaves open. The coalition's position is supportive in direction but explicitly conditional on how Congress resolves the outstanding technical and policy details - particularly around data minimization standards, sensitive data definitions, and the specific scope of exemptions for smaller firms.

What this means for the marketing community

For advertising professionals and marketing practitioners, the Internet for Growth statement matters because it represents the voice of the demand side of digital advertising - specifically, the smaller end of that demand. Large brands with nine-figure media budgets have compliance resources. Agencies serving mid-market clients have legal support. Independent businesses running $10,000 to $100,000 annually in digital ads do not.

The SECURE Data Act's opt-out mechanism for targeted advertising applies nationally if the bill passes. That means the fraction of the US population currently outside the reach of state opt-out rights would gain those rights. The practical effect on targeting reach for any given campaign would depend on opt-out rates, which vary by channel, audience demographic, and how opt-out mechanisms are presented to users.

New COPPA rules that took effect on June 23, 2025 already illustrated how layered federal requirements reshape digital advertising operations. Those amendments required separate consent for third-party data sharing and introduced enhanced transparency disclosures, fundamentally altering how data collection and targeted advertising operate in children-directed services. The SECURE Data Act, if enacted, would operate on a much broader population.

The bill's timeline is also relevant. According to PPC Land's coverage of the legislation, most provisions would take effect two years after enactment. Consumer rights provisions, data security obligations, and data broker requirements would activate after one year. That compressed timeline - particularly the one-year window for data broker registration and compliance - would require companies across the programmatic supply chain to assess quickly whether they meet the bill's data broker definition, which applies where 50 percent or more of annual gross revenue derives from selling or licensing personal data to third parties not acting as service providers.

The Internet for Growth coalition's intervention signals that the political coalition around the SECURE Data Act is not simply between large technology platforms and privacy advocates. Small business voices are entering the discussion, and their concerns about advertising access could shape the legislative debate over exemptions, thresholds, and the specific contours of opt-out rights as the bill moves through the House.

Timeline

Summary

Who: Internet for Growth, a coalition representing hundreds of small businesses and creators across the United States, issued a statement through Executive Director Brendan Thomas.

What: The coalition expressed conditional support for the SECURE Data Act (H.R. 8413), a House Republican bill introduced on April 21, 2026, that would replace all US state privacy laws with a single federal framework, while warning that digital advertising restrictions could harm small business hiring and growth.

When: The Internet for Growth statement was issued on April 22, 2026, one day after the bill's introduction in the House.

Where: The statement was issued in Washington, D.C., in response to activity in the US House of Representatives. The bill, if enacted, would apply to covered entities conducting business in the United States or processing personal data of US residents.

Why: Internet for Growth entered the debate because the SECURE Data Act's provisions - including an opt-out right for targeted advertising that would apply nationally - could materially affect the cost and effectiveness of digital advertising for smaller firms. The coalition wants Congress to resolve key differences around data minimization standards, sensitive data definitions, and exemptions for smaller firms, to ensure that a national privacy framework does not price small businesses out of the digital advertising tools they rely on to compete.

Share this article
The link has been copied!