SB 71

As amended on 3/26/2025: - Gives consumers rights over the data collected from them including a right to confirm and access the data, right to correct, right to delete, right to obtain a portable copy, and right to opt out of targeted advertising, sale of personal data, and profiling. - Limits collection and processing of personal data to what is reasonably necessary. Requires reasonable security practices. - Prohibits processing sensitive data without consent. - Prohibits processing personal data for targeted advertising or sale to third parties without consent or for a known minor age 13-16. - Prohibits discriminating against a consumer for exercising rights with an exception for loyalty programs. Requires disclosure of a privacy policy. - Requires notice for the sale of data or processing for targeted advertising with an opportunity to opt out. Requires a clear and conspicuous link on a website to opt out. Requires recognition of opt out preference signals by January 1, 2026. - Requires a data protection assessment. - Grants sole enforcement authority with the attorney general with a 60-day right to cure. - Protects consumer health data by prohibiting access to data to an employee or contractor without contractual or statutory confidentiality or using a geofence around a health care facility for identifying, tracking, collecting data or sending notifications regarding consumer health data. - The 3/26/2025 amendment deletes the right to know if the data will be used in an artificial intelligence system. Deletes duty of loyalty to minors. Allows processing sensitive data with consent. Deletes private right of action.