CONSUMER RIGHTS Present law authorizes a consumer to invoke certain consumer rights at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A "controller" is the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information. A known child's parent or legal guardian may invoke the child's consumer rights. A controller must comply with an authenticated consumer request to exercise certain rights, including opting out of a controller's processing of personal information for purposes of (i) selling personal information about the consumer; (ii) targeted advertising; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. DESIGNATED AGENT This bill authorizes a consumer to designate another person to serve as the consumer's authorized agent and act on the consumer's behalf to opt out of the processing of the consumer's personal data for the purposes of (i) selling personal information about the consumer; (ii) targeted advertising; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. The consumer may designate an authorized agent using a technology, including a link to an internet website, an internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of such processing. A controller must comply with an opt-out request received from an authorized agent if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf. OPT-OUT METHODS This bill requires opt-out methods to provide a clear and conspicuous link on the controller's internet website to an internet web page that enables a consumer, or a consumer's authorized agent, to opt out of the targeted advertising or sale of the consumer's personal data. On or before January 1, 2026, this bill authorizes a consumer to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data through an opt-out preference signal sent with the consumer's consent, to the controller by a platform, technology, or mechanism that meets all of the following requirements:  Must not unfairly disadvantage another controller.  Must not make use of a default setting, but must require the consumer to make an affirmative, freely given, and unambiguous choice to indicate the consumer's intent to opt out of any processing of a consumer's personal data.  Must be consumer-friendly and easy to use by the average consumer.  Must be consistent with any federal or state law or rule.  Must allow the controller to accurately determine whether the consumer is a resident of this state and whether the consumer has made a legitimate request to opt out of any sale of a consumer's personal data or targeted advertising. INCENTIVE DISCLOSURES If a consumer's decision to opt out of any personal data processing for the purposes of targeted advertising, or any sale of personal data, conflicts with the consumer's existing controller-specific privacy setting or voluntary participation in a controller's bona fide loyalty, rewards, premium features, discounts, or club card program, then this bill requires the controller to comply with the consumer's opt-out preference signal but may notify the consumer of the conflict and provide the choice to confirm controller-specific privacy settings or participation in such a program. If a controller responds to consumer opt-out requests by informing the consumer of a charge for the use of any product or service, then the controller must present the terms of any financial incentive offered for the retention, use, sale, or sharing of the consumer's personal data.

Statutes affected:
Introduced: 47-18-3304