A 5827

As introduced: - Limits collection, process, and transfer of data to what is reasonably necessary. - Limits collection of social security numbers and sensitive covered data. - Prohibits transfer of sensitive data to a third party without consent. - Prohibits a video provider of transferring covered data of video content or services requested. - Requires privacy by design with reasonable safeguards. Prohibits retaliating against consumers for exercising rights, with an exception for loyalty programs. Requires a covered entity to disclose a privacy policy. - Creates consumer rights over data collected from them including a right to access, right to correct, right to delete, and a right to a portable copy. - Allows a consumer to object to a transfer of data to a third party through an opt-out mechanism. Allows a consumer to opt out of targeted advertising. Prohibits targeted advertising to a known minor. Prohibits transfer of data of a known minor without consent. - Creates a Do Not Collect registry link. Prohibits collecting, processing, or transferring data in a way that discriminates against certain protected classes. Requires an impact assessment. Exempts small businesses from certain obligations. Establishes unified opt-out mechanisms. - Creates corporate responsibility through executive certification. Requires a report of digital content forgeries. Establishes a bureau of privacy. Creates a private right of action.