SB 71

Summary

As enacted: - Gives consumers rights over the data collected from them, including a right to confirm and access the data, right to correct, right to delete, right to obtain a portable copy, right to obtain a list of third parties to whom personal data has been sold, and a right to opt out of targeted advertising, sale of personal data, and profiling. - Applies to businesses that control or process the personal data of at least 35,000 consumers, control or process the sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers. - Limits collection and processing of personal data to what is reasonably necessary. Requires reasonable security practices. - Prohibits processing sensitive data without consent. - Prohibits processing personal data for targeted advertising or sale to third parties without consent or for a known minor age 13-16. - Prohibits discriminating against a consumer for exercising rights with an exception for loyalty programs. Requires disclosure of a privacy policy. - Requires controllers to provide a clear and accessible privacy notice and provide mechanisms for consumers to exercise privacy rights and opt out of targeted advertising or the sale of personal data, including through universal opt-out preference signals. - Requires a data protection assessment. - Grants sole enforcement authority with the attorney general with a 60-day right to cure until June 30, 2029. - Protects consumer health data by prohibiting access to data to an employee or contractor without contractual or statutory confidentiality or using a geofence around a health care facility for identifying, tracking, collecting data or sending notifications regarding consumer health data.

Sponsor

Legislative History

Quick Actions

Details

Related Legislation