Attorney General Jay Jones Opposes Federal Legislation That Would Weaken State Privacy Protections

Attorney General Jay Jones Opposes Federal Legislation That Would Weaken State Privacy Protections 

Federal data privacy law should not preempt Virginia’s strong privacy laws 

RICHMOND, Va.  — Attorney General Jay Jones joined a coalition of 18 attorneys general and state agencies in opposing the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Data Act), a proposed federal law falsely being held up as a data privacy bill. The SECURE Act would prevent states from regulating data privacy and holding bad actors accountable, and would effectively nullify Virginia’s robust data privacy law. In the letter, the coalition calls on Congress to reject the SECURE Data Act, and to ensure states like Virginia are able to pass and enforce laws to protect consumer data. 

“Virginians deserve data privacy laws that protect them from exploitation and create an avenue for just recourse when their rights are violated. The SECURE Data Act is another wolf in sheep’s clothing, claiming security on the surface but weakening Virginians privacy at its core,” said Attorney General Jay Jones. “Virginians trust their state leaders to enact and enforce laws that fit their needs and protect their rights. This law does exactly the opposite, and I urge Congress to vote no.”  

The Virginia Consumer Data Protection Act provides Virginians specific rights that controllers of large data must honor, including the right to delete personal data, correct inaccuracies, to confirm whether their data is being processed, to obtain a copy of the consumer’s personal data, and to opt out of the processing of personal data for purposes for targeted advertising. The OAG’s Consumer Privacy Unit is dedicated to enforcing this law and ensuring that consumers’ rights are protected; actively reviewing consumer complaints filed with the OAG and issuing notices of violations under the law to make sure companies are following privacy laws.  

Comprehensive state privacy laws have set minimum data privacy standards, including heightened protections for minors and sensitive consumer data, limits on how data may be used and retained, and the ability for consumers to stop the sale of their data via a universal opt-out preference signal. The SECURE Data Act would wipe out these meaningful protections, making it harder for consumers to exercise their rights, give businesses more discretion on how to use and retain their data, and significantly limit enforcement remedies.  

In the letter, the coalition argues that the bill moves privacy rights in the wrong direction, leaving consumers worse off and with fewer protections. Any federal privacy framework must leave room for states to legislate responsively to changes in technology and data collection practices, as states are better equipped to address the unique needs of their citizens and quickly adjust to the challenges presented by technological innovation. 

In sending the letter, the Commonwealth joins the attorneys general of California, Connecticut, Delaware, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Hampshire, New Jersey, New York, Oregon, Vermont, and Washington, as well as the California Privacy Protection Agency and the Hawai’i Department of Commerce and Consumer Affairs.   

Published on: June 4, 2026

###