The "Consumer Information and Data Protection Act" introduces comprehensive regulations for the collection and protection of consumer data in New Mexico. It establishes new definitions for terms such as "consumer," "personal data," and "sensitive data," and applies to businesses that handle significant amounts of consumer data. The Act prohibits the sale of consumer health data without explicit consent and restricts the use of geofencing technology near mental health and reproductive health facilities. It grants consumers rights to access, correct, delete, and obtain copies of their personal data, while mandating businesses to comply with these requests and imposing civil penalties for violations. Exemptions are provided for certain entities, ensuring existing privacy laws remain intact.

Additionally, the bill emphasizes the responsibilities of data controllers and processors, requiring them to conduct data protection assessments, particularly for online services aimed at minors. It mandates that controllers take reasonable measures to protect de-identified data and outlines limitations on personal data processing. The attorney general is granted enforcement powers to seek civil penalties for violations, and the bill includes provisions for severability, ensuring that valid applications remain in force even if some provisions are found unconstitutional. The effective dates for the provisions are staggered, with certain sections taking effect on July 1, 2026, and others on July 1, 2027, allowing for a gradual implementation of the new legal framework.