Keep American Families Safe Online

Americans want to feel safer online, and have had enough of greedy corporations profiting from the secret exchange of their own and their families’ personal information like addresses, financial information, and even their travel patterns. Lawmakers can protect Americans’ personal freedoms and reduce online scams by ensuring the right to privacy we value also applies online, without burdening small businesses or hardworking Americans.

components enacted in

Click below to see legislation

PARTNERS

Parents and Families
Older Americans
Privacy Advocates
Companies looking for uniform requirements across states

OPPOSITION

Greedy corporations that collect and sell or buy private online data

FREQUENTLY ASKED QUESTIONS

In The News

Wired

Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location

READ THE ARTICLE

The New York Times

Automakers Are Sharing Consumers’ Driving Behavior With Insurance Companies

READ THE ARTICLE

Austin American-Statesman

What does Texas AG Ken Paxton's lawsuit against Allstate mean for driver data privacy?

READ THE ARTICLE

MODEL POLICY

This Act shall be known as the Protect Consumers’ Privacy & Data Online Act.

SECTION 1 (TITLE):

This act shall be known as the This Act shall be known as the Protect Consumers’ Privacy & Data Online Act.

SECTION 2 (PURPOSE):

To enhance protection of consumers’ online data and provide consumers greater control over their personal data.

SECTION 3 (PROVISIONS):

Application and Exemptions
1. This subtitle applies to a person that:
  1. Conducts business in the State or provides products or services targeted to residents of the state, and that during the preceding calendar year did any of the following:
    1. Controlled or processed the personal data of at least 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
    2. Controlled or processed the personal data of at least 10,000 consumers and derived more than 20 percent of its gross revenue from the sale of personal data.
2. This subtitle does not apply to:
  1. A federal, state, tribal, or local government entity in the ordinary course of its operations.
  2. Data subject to a statute or regulation identified under (a) below that is controlled by a covered entity or service provider that is:
    1. Required to comply with:
      1. Title V of the federal Gramm-Leach-Bliley Act; or
      2. The federal Health Information Technology for Economic and Clinical Health Act; or
      3. Regulations promulgated under §264(C) of the Health Insurance Portability and Accountability Act of 1996; and,
    2. In compliance with the Information Security requirements of applicable statutes or regulations identified in (a) above.
  3. Information collected as part of a clinical trial subject to the federal policy for the protection of human subjects in accordance with:
    1. Good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; or
    2. Human subject protection requirements of the U.S. Food and Drug Administration.
  4. The collection, maintenance, disclosure, sale, communication, or use of personal data bearing on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that the activity is regulated and authorized under the federal Fair Credit Reporting Act.
3. Controllers and processors that comply with the verifiable parental consent requirements of the federal Children’s Online Privacy and Protection Act shall be considered compliant with an obligation to obtain parental consent in accordance with this subtitle with respect to a consumer who is a child.
Rights of the Consumer
1. A consumer shall have the right to:
  1. Confirm whether a controller is processing the consumer’s personal data;
  2. If a controller is processing a consumer’s personal data, access the consumer’s personal data;
  3. Correct inaccuracies in the consumer’s personal data;
  4. Require a controller to delete consumer’s personal data provided unless retention of the personal data is required by law;
  5. When exercising the right to access personal data pursuant to paragraph 2) of this subsection, a consumer has the right to obtain the personal data in a readily usable format that allows the consumer to transmit the data to another entity without hindrance. Nothing in this paragraph requires a controller to provide the data to a consumer in a manner that would disclose the controller’s trade secrets;
  6. Obtain a list of the categories of third parties to which the controller has disclosed the consumer’s personal data or a list of the categories of third parties to which the controller has disclosed any consumer’s personal data if the controller does not maintain this information in a format specific to the consumer; and
  7. Opt out of the processing of personal data for purposes of: targeted advertising; the sale of personal data; or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
2. A controller shall establish a secure and reliable method for a consumer to exercise a consumer right under this section free of charge. A consumer may exercise a consumer right established under this selection by the method established by the controller.
3. A parent or legal guardian of a child may exercise a consumer right listed in subsection i) of this section on the child’s behalf regarding the processing of personal data.
4. A guardian or conservator of a consumer subject to a guardianship, conservatorship or other protective arrangement may exercise a consumer right listed in subsection i) of this section on the consumer’s behalf regarding the processing of personal data.
5. A controller shall respond to a consumer request not later than 45 days after the controller receives the consumer request. A controller may extend the completion period by an additional 45 days if: it is reasonably necessary to complete the request based on the complexity and number of the consumers requests; and the controller informs the consumer of the extension and the reason for the extension within the initial 45-day response period.
6. If a controller declines to act regarding a consumer’s request, the controller shall inform the consumer not later than 45 days after receiving the request, of the justification for declining to act and provide instructions for how to appeal the decision.
7. A controller that has obtained personal data about a consumer from a source other than the consumer shall be considered compliant with the consumer’s request to delete the consumer’s data in accordance with subsection i)4) of this section by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring that the consumer’s personal data remains deleted from the controller’s records and is not being used for any other purpose.
8. A controller shall establish a straightforward and accessible process for a consumer to appeal the controller’s refusal to act on a consumer rights request within a reasonable period after the consumer receives the decision. A controller must inform the consumer in writing of any action taken or not taken in response to the appeal within 60 days of receiving an appeal, with an online mechanism, if available, through which the consumer may submit a complaint regarding an appeal denial.
9. A consumer may designate an individual to serve as the consumer’s authorized agent and act on the consumer’s behalf to opt out of the processing of the consumer’s personal data for one or more of the purposes specified in subsection i)7) of this section.
Data Minimization and Limitations on Controllers
1. A controller may not:
  1. Collect, process, or share sensitive data concerning a consumer except where the collection or processing is strictly necessary to provide or maintain a specific product or service requested by the consumer to whom the personal data pertains;
  2. Sell sensitive data;
  3. Process personal data in violation of State or federal laws that prohibit unlawful discrimination including to collect, process, or transfer data, including publicly available data, in a manner that unlawfully discriminates or otherwise unlawfully makes unavailable the equal enjoyment of goods or services on the basis of [protected classes as defined in existing state law];
  4. Process the personal data of a consumer the controller knew or should have known is under the age of 18 years, including for the purpose of targeted advertising, unless it is strictly necessary to provide the online service, product, or feature requested by a minor with which the minor is actively and knowingly engaged;
  5. Discriminate against the consumer for exercising a consumer right contained in this subtitle, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the consumer;
2. A controller shall:
  1. Limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains; and,
  2. Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue.
3. Nothing in this section may be construed to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program, provided that the selling of personal data is not a condition of participation in the program.
4. A controller shall provide a consumer with a reasonably accessible, clear, and meaningful privacy notice that includes:
  1. The categories of personal data processed by the controller, including sensitive personal data;
  2. The controller’s purpose for processing personal data;
  3. How a consumer may exercise the consumer’s rights under this subtitle, including how a consumer may appeal a controller’s decision regarding the consumer’s request;
  4. The categories of third parties with which the controller shares personal data with a level of detail that enables a consumer to understand the type of, business model of, or processing conducted by each third party;
  5. The categories of personal data, including sensitive data, that the controller shares with third parties;
  6. An active e-mail address or other online mechanism that the consumer may use to contact the controller; and,
  7. One or more secure and reliable methods for a consumer to submit a request to exercise a consumer right in accordance with this Act that take into account: the ways in which consumers normally interact with the controller; the need for secure and reliable communication of consumer requests; and, the ability of the controller to verify the identity of a consumer making the request.
5. If a controller sells personal data to third parties or processes personal data for targeted advertising or for the purposes of profiling the consumer in furtherance of decisions that produce legal or similarly significant effects, the controller shall clearly and conspicuously disclose the sale or processing, as well as the manner in which a consumer may exercise the right to opt out of the sale or processing.
6. The disclosure required under vi) of this section shall be prominently displayed, and use clear, easy to understand, and unambiguous language, to state whether the consumer’s information will be sold or shared with a third party.
7. A controller may not require a consumer to create a new account in order to exercise a consumer right. A controller may require a consumer to use an existing account to exercise a consumer right.
Universal Opt Out Mechanism
1. On or before [Date 1 Year from Implementation], a controller shall allow a consumer to opt out of any processing of the consumer’s personal data for the purpose of targeted advertising, or any sale of personal data through an universal opt-out preference signal sent, with the consumer’s consent, by a platform, technology, or mechanism to the controller indicating the consumer’s intent to opt out of the processing or sale.
2. A platform, technology, or mechanism used in accordance with subsection i) of this section shall:
  1. Be consumer-friendly and easy to use by the average consumer;
  2. Use clear, easy to understand, and unambiguous language;
  3. Be as consistent as possible with any other similar platform, technology, or mechanism required by any federal or state law or regulation;
  4. Enable the controller to reasonably determine whether the consumer is a resident of the state and has made a legitimate request to opt out of the sale of the consumer’s personal data or targeted advertising;
  5. Require a consumer to make an affirmative, unambiguous, and voluntary choice in order to opt out of any processing of the consumer’s personal data.
3. A platform, technology, or mechanism used in accordance with subsection i) of this section may not unfairly disadvantage another controller;
4. If a consumer’s decision to opt out of the processing of the consumer’s personal data for the purposes of targeted advertising, or the sale of personal data through an opt-out preference signal sent in accordance with subsection i) of this section conflicts with the consumer’s existing controller-specific privacy setting or the consumer’s voluntary participation in a controller’s bona fide loyalty, rewards, premium features, discounts, or club card program, the controller may notify the consumer of a conflict and provide the choice to confirm controller-specific privacy settings or participation in a program listed in this paragraph.
5. A controller that recognizes signals approved by other states shall be considered in compliance with this section.
6. Notwithstanding a consumer’s decision to exercise the right to opt out of the processing of personal data through a universal opt-out mechanism pursuant to subsection i), a controller shall provide a clear and conspicuous link on the controller’s website to a webpage that allows a consumer, or an authorized agent of the consumer, to opt out of targeting advertising or the sale of the consumer’s personal data.
Rules for Processors
1. If a controller uses a processor to process the personal data of consumers, the controller and the processor shall enter into a contract that governs the processor’s data processing procedures with respect to processing performed on behalf of the controller.
2. The contract shall be binding and shall clearly set forth:
  1. Instructions for processing data;
  2. The nature and purpose of processing;
  3. The type of data subject to processing;
  4. The duration of processing; and,
  5. The rights and obligations of both parties.
3. The contract shall require that the processor:
  1. Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the personal data;
  2. Establish, implement, and maintain reasonable, administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data, considering the volume and nature of the personal data;
  3. Stop processing data on request by the controller made in accordance with a consumer’s authenticated request;
  4. At the controller’s direction, delete or return all personal data to the controller as requested at the end of the provision of service, unless retention of the personal data is required by law;
  5. On the reasonable request of the controller, make available to the controller all information in the processor’s possession necessary to demonstrate the processor’s compliance with the obligations in this subtitle;
  6. After providing the controller an opportunity to object, engage a subcontractor to assist with processing personal data on the controller’s behalf only in accordance with a written contract that requires the subcontractor to meet the processor’s obligations regarding the personal data under the processor’s contract with the controller; and,
  7. Allow and cooperate with reasonable assessments by the controller, the controller’s designated assessor, or a qualified and independent assessor arranged for by the processor to assess the processor’s policies and technical and organizational measures in support of the obligations under this subtitle.
4. On request, the processor shall provide a report of an assessment required by subsection iii)5) of this section to the controller. An assessment conducted in accordance with subsection iii)5) of this subsection shall be conducted using an appropriate and accepted control standard or framework and assessment procedure.
5. A processor shall:
  1. Adhere to the contract and instructions of a controller;
  2. Assist the controller in meeting the controller’s obligations under this Act, including:
    1. By appropriate technical and organizational measures as much as reasonably practicable to fulfill the controller’s obligation to respond to consumer rights requests, considering the nature of processing and the information available to the processor; and,
    2. By assisting the controller in meeting the controller’s obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of a system; and,
  3. Provide necessary information to enable the controller to conduct and document data protection assessments.
6. Nothing in this section may be construed to relieve a controller or a processor from the liabilities imposed on the controller or processor by virtue of the controller’s or processor’s role in the processing relationship in accordance with this section.
7. The determination of whether a person is acting as a controller or a processor with respect to a specific processing of data is a fact-based determination that depends on the context in which personal data is being processed.
  1. A person is considered to be a controller if the person:
    1. Is not limited in the person’s processing of specific personal data in accordance with a controller’s instructions; or,
    2. Fails to adhere to a controller’s instructions with respect to a specific processing of personal data.
  2. A processor that continues to adhere to a controller’s instructions with respect to a specific processing of personal data remains a processor.
  3. If a processor or third party begins, alone or jointly with others, determining the purposes and means of the processing of personal data, the processor:
    1. Is a controller with respect to the processing; and
    2. May be subject to an enforcement action under this subtitle.
8. Nothing in this section may be construed to alter a controller’s obligation to limit a person’s processing of personal data or to take steps to ensure that a processor adheres to the controller’s instructions.
9. If a third party uses or shares a consumer’s information in a manner inconsistent with promises made to the consumer at the time of collection of the information, the third party shall provide an affected consumer with notice of the new or changed practice before implementing the new or changed practice. The notice shall be provided in a manner and at a time reasonably calculated to allow a consumer to exercise the rights provided under this subtitle.
Limitations
1. Nothing in this Act may be construed to require a controller or processor to: re-identify de-identified data; maintain data in an identifiable form; or collect, obtain, retain, or access any data or technology in order to be capable of associating an authenticated consumer request with personal data.
2. A controller that discloses de-identified data shall exercise reasonable oversight to monitor compliance with any contractual commitments to which the de-identified data is subject; and, take appropriate steps to address any breaches of any contractual commitments.
3. The determination of whether oversight is reasonable and whether appropriate steps were taken in accordance with subsection iii) shall take into account whether the disclosed data includes data that would be considered sensitive data if that data were re-identified.
4. Nothing in this Act may be construed to restrict a controller or processor’s ability to:
  1. Comply with federal, state, or local laws or regulations;
  2. Comply with a civil, criminal, or regulatory warrant, subpoena, or summons by a federal, state, local, or other governmental authority;
  3. Report to and cooperate with law enforcement agencies concerning conduct or activity that the controller or processor discovered and reasonably and in good faith believes may violate federal, State, or local laws or regulations, or presents a serious and imminent, danger of violence;
  4. Investigate, establish exercise, prepare for, or defend a legal claim;
  5. Provide a product or service specifically requested by a consumer;
  6. Perform under a contract to which a consumer is a party, including fulfilling the terms of a written warranty;
  7. Take steps at the request of a consumer before entering into a contract;
  8. Take immediate steps to protect an interest that is essential for the life of physical safety of a consumer or another individual and when the processing cannot be manifestly based on another legal basis;
  9. Prevent, detect, protect against, investigate, prosecute those responsible, or otherwise respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any other type of illegal activity;
  10. Preserve the integrity or security of systems; or
  11. Assist another controller, processor, or third party with an obligation under this Act.
5. This subsection does not apply to an obligation required under Section f)i) -f)iv). An obligation imposed on a controller or processor under this subtitle may not restrict a controller’s or processor’s ability to collect, use, or retain personal data for internal use to:
  1. Effectuate a product recall;
  2. Identify and repair technical errors that impair existing or intended functionality; or,
  3. Perform internal operations that are:
    1. Reasonably aligned with the expectations of the consumer or can be reasonably anticipated based on the consumer’s existing relationship with the controller; or
    2. Otherwise compatible with processing data in furtherance of:
      1. The provision of a product or service specifically requested by the consumer; or,
      2. The performance of a contract to which the consumer is a party.
6. An obligation imposed on a controller or a processor under this Act does not apply when compliance by the controller or processor with the Act would violate an evidentiary privilege under State law. Nothing in this Act may be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under State law as part of a privileged communication.
7. A controller or processor that discloses personal data to a processor or third-party controller in compliance with this Act is not in violation of this Act if the processor or third-party controller that receives the personal data violates this Act and:
  1. At the time the disclosing controller or processor disclosed the personal data, the disclosing controller or processor did not have actual knowledge that the receiving processor or third-party controller would violate this Act; and,
  2. The disclosing controller was, and remained, in compliance with its obligations as the discloser of the personal data.
8. A third-party controller or processor that receives personal data from a controller or processor in compliance with this subtitle is not in violation of this subtitle for the independent misconduct of the controller or processor from which the third-party controller or processor received the personal data.
9. Nothing in this Act may be construed to:
  1. Impose an obligation on a controller or a processor that adversely affects the rights or freedoms of any person, including the rights of a person to freedom of speech or freedom of the press as guaranteed in the First Amendment to the U.S. Constitution; or,
  2. Apply to a person’s processing of personal data during the person’s personal or household activities.
10. If a controller or processor processes personal data in accordance with an exemption under this section, the controller or processor shall demonstrate that the processing qualifies for an exemption and complies with the requirements of subsection xii) of this section.
11. Personal data processed by a controller or processor in accordance with this section:
  1. Shall be subject to reasonable administrative, technical, and physical measures to: protect the confidentiality, integrity, and accessibility of the personal data; and, reduce reasonably foreseeable risks of harm to consumers relating to the collection, use, or retention of personal data; and,
  2. May be processed to the extent that the processing is: reasonably necessary and proportionate to the purpose listed in this section; and, adequate, relevant, and limited to what is necessary in relation to the specific purposes listed in this section.
12. A person that processes personal data for a purpose expressly identified in this section may not be considered a controller solely based on the processing or personal data.
Enforcement
1. The Attorney General, District Attorneys, or City Attorneys have exclusive authority to enforce this Act by bringing action in the name of the State or as parens patriae on behalf of persons residing in the state, including seeking an injunction to enjoin a violation of this Act.
2. For purposes of enforcement of this Act by the Attorney General, District Attorney, or City Attorney, a violation of this Act is an unfair, abusive, or deceptive trade practice within the meaning of [existing law on deceptive trade practices] and subject to the enforcement and penalty provisions contained in [existing state law on enforcement of violations of existing deceptive trade practices law].
Right to Cure
1. Before initiating any action under this Act, the [State Attorney General’s Office] may issue a notice of violation to the controller or processor if the [State Attorney General’s Office] determines that a cure is possible.
2. If the division issues a notice of violation under paragraph 1) of this subsection, the controller or processor shall have at least 60 days to cure the violation after receipt of the notice. If the controller or processor fails to cure the violation within the time period specified by the [State Attorney General’s Office], the [State Attorney General’s Office] may bring an enforcement action.
3. In determining whether to grant a controller or processor an opportunity to cure an alleged violation, the [State Attorney General’s Office] may consider the following factors:
  1. The number of violations;
  2. The size and complexity of the controller or processor;
  3. The nature and extent of the controller’s or processor’s processing activities;
  4. The likelihood of injury to the public;
  5. The safety of persons or property;
  6. Whether the alleged violation was likely caused by a human or technical error; and,
  7. The extent to which the controller or processor has violated this Act or similar laws in the past.
Definitions
1. “Affiliate” means a person that, directly or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with another person, such that the person:
  1. Owns or has the power to vote more than 50% of the outstanding shares of any voting class of the other person’s securities;
  2. Has the power to elect or influence the election of a majority of the directors, members, or managers of the other person;
  3. Has the power to direct the management of the other person; or
  4. Is subject to the other person’s exercise of the powers described in paragraph 1), 2), or 3) of this subsection.
2. “Authenticate” means to use reasonable means to determine that a request to exercise a consumer right in accordance with this Act is being made by, or on behalf of, a consumer who is entitled to exercise the consumer right with respect to the personal data at issue.
3. “Biometric Data” means data generated by automatic measurements of the biological characteristics of a consumer that can be used to uniquely authenticate a consumer’s identity. “Biometric data” includes: a fingerprint; a voice print; an eye retina or iris image; and any other unique biological characteristics that can be used to uniquely authenticate a consumer’s identity. “Biometric data” does not include: a digital or physical photograph; an audio or video recording; or, any data generated from a digital or physical photograph or an audio or video recording, unless the data is generated to identify a specific consumer.
4. “Child” has the same meaning as in the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 – 6505).
5. “Consent” means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer for a particular purpose. “Consent” includes: a written statement; a written statement by electronic means; or any other unambiguous affirmative action. “Consent” does not include:
  1. Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other unrelated information;
  2. Hovering over, muting, pausing, or closing a piece of content; or,
  3. Agreement obtained through the use of a user interface designed or manipulated with the substantial effect of subverting use autonomy, decision making, or choice, or any practice the Federal Trade Commission refers to as a “dark pattern.
6. “Consumer” means an individual who is a resident of the state. “Consumer” does not include an individual acting in a commercial or employment context or as an employer, an owner, a director, an officer, or a contractor of a company, partnership, sole proprietorship, nonprofit organization, or governmental unit whose communications or transactions with the controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit organization, or governmental unit.
7. “Consumer health data” means personal data that a controller uses to identify a consumer’s physical or mental health.
8. “Control” means:
  1. Ownership of or the power to vote more than 50% of the outstanding shares of any class of voting security of a business;
  2. Any manner of control over the election of a majority of the directors of a business, or individuals exercising similar functions; or,
  3. The power to exercise a controlling influence over the management of a business.
9. “Controller” means a person that, alone or jointly with others, determines the purpose and means of processing personal data.
10. “Decisions that produce legal or similarly significant effects concerning the consumer” means decisions that result in the provision or denial of: financial or lending services; housing; education enrollment or opportunity; criminal justice; employment opportunities; healthcare services; or, access to essential goods or services.
11. “De-identified data” means data that cannot reasonably be used to infer information about, or a device linked to an individual consumer, provided that the covered business that possesses the data: takes reasonable measures to ensure that the data cannot be associated with a consumer; publicly commits to maintain and use the data only in a deidentified fashion and not attempt to reidentify the data; and contractually obligates any recipients of the data to comply with all provisions of this subsection.
12. “Identified or identifiable consumer” means a consumer who can be readily identified, either directly or indirectly.
13. “Personal data” means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household. Personal data does not include deidentified data.
14. “Precise geolocation” means any data that accurately identifies within a radius of 1,850 feet an individual’s present or past location or the present or past location of a device that links or is linkable to an individual or any data that is derived from a device that is used or intended to be used to locate an individual within a radius of 1,850 feet by means of technology that includes a global positioning system that provides latitude and longitude coordinates. “Precise geolocation” does not include the content of communications or any data generated or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
15. “Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, modification, or otherwise handling of personal data.
16. “Processor” means a person that processes personal data on behalf of a controller.
17. “Profile” or “profiling” means any form of automated processing of personal data to evaluate, analyze, or predict certain aspects relating to an individual, including an individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
18. “Sale of personal data” means the exchange of personal data by a controller, a processor, or an affiliate of a controller or processor to a third party for monetary or other valuable consideration. “Sale of personal data” does not include:
  1. The disclosure of personal data to a processor that processes personal data on behalf of a controller if limited to the purposes of the processing;
  2. The disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the consumer;
  3. The disclosure or transfer of personal data to an affiliate of the controller;
  4. The disclosure of personal data where the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party;
  5. The disclosure of personal data that the consumer intentionally made available to the general public through a channel of mass media and did not restrict to a specific audience; or,
  6. The disclosure or transfer of personal data to a third party as an asset that is part of an actual or proposed merge, acquisition, bankruptcy, or other transaction where the third party assumes control of all or part of the controller’s assets.
19. “Sensitive data” means personal data that includes:
  1. Data revealing: racial or ethnic origin; religious beliefs; consumer health data; sex life; sexual orientation; status as transgender or nonbinary; national origin; or citizenship or immigration status;
  2. Genetic data or biometric data;
  3. Personal data of a consumer that the controller knows or has reason to know is a child; or,
  4. Precise geolocation data.
20. “Targeted advertising” mean displaying advertisements to a consumer or on a device identified by a unique identifier, where the advertisement is selected based on personal data obtained or inferred from the consumer’s activities over time and across nonaffiliated website or online applications that are unaffiliated with each other, in order to predict the consumer’s preferences or interests. Targeted advertising does not include:
  1. Advertisements based on the context of a consumer’s current search query, visit to a website, or online application;
  2. Advertisements based on a consumer’s activities within a controller’s websites or online applications;
  3. Advertisements directed to a consumer in response to the consumer’s request for information or feedback; or,
  4. Processing personal data solely to measure or report advertising frequency performance or reach.
The provisions of this Act are severable. If any provision of this Act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

Related Policies

Fair Markets

Creating Good Jobs By Supporting Small Businesses

Fair Markets

Maintaining ACA protections

Effective Government