The proposed bill establishes comprehensive rights for individuals concerning their personal data, including their name, image, likeness, and digital identity. It requires entities processing personal data to adhere to these rights unless overridden by other state or federal laws. Key rights outlined in the bill include the ability to opt out of targeted advertising, access personal data, correct inaccuracies, delete data, and request data portability. Additionally, it mandates that data controllers respond to individual requests within a specified timeframe and allows individuals to authorize others to act on their behalf regarding these rights.

Furthermore, the bill amends existing laws related to violations involving older persons and persons with disabilities, as well as the commercial use of a natural person's name, image, or likeness. It expands the definition of deceptive trade practices to include violations of the new personal data provisions and establishes civil penalties for such violations, including restitution for victims and attorney fees. The legislation also clarifies that the remedies provided are cumulative and do not limit existing rights regarding personal data. The attorney general is tasked with creating necessary rules for implementation, and the act is set to take effect on July 1, 2025, aiming to enhance protections for vulnerable populations and regulate personal data use in consumer transactions.

Statutes affected:
25LSO-0089 v0.5: 40-12-102, 40-12-105