,i  #aag? ,,congress  #b;d ,session  ,h4
 ,r4 #haeb  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,june #ba1 #bjbb ,mr4 
,pallone 7= himself1 ,mrs4 ,rodg]s (    
,wa%+ton1 ,ms4 ,s*ak[sky1 & ,mr4        
,bilirakis7 introduc$ ! foll[+ bill2 :i*
 0 ref]r$ to ! ,committee on ,en]gy &   
,comm]ce  ,a ,,bill  ,to provide        
consum]s ) f\ndational data privacy     
rights1 create /rong ov]sight me*anisms1
 & e/abli% mean+ful en=cem5t4  #a4 ,%ort
 title2 table ( cont5ts  7a7 ,%ort title
 ,?is ,act may be cit$ z ! ,am]ican     
,data ,privacy & ,protection ,act4  7b7 
,table ( cont5ts ,! table ( cont5ts (   
?is ,act is z foll[s3  ,sec4 #a4 ,%ort  
title2 table ( cont5ts4 ,sec4 #b4       
,def9itions4 ,title ,i--,duty ( loyalty 
,sec4 #aja4 ,data m9imization4 ,sec4    
#ajb4 ,loyalty duties4 ,sec4 #ajc4      
,privacy by design4 ,sec4 #ajd4 ,loyalty
 to individuals ) respect to pric+4     
,title ,,ii--,consum] data rights ,sec4 
#bja4 ,consum] aw>5ess4 ,sec4 #bjb4     
,transp>5cy4 ,sec4 #bjc4 ,individual    

data own]%ip & control4 ,sec4 #bjd4 ,"r 
to cons5t & object4 ,sec4 #bje4 ,data   
protections = *ildr5 & m9ors4 ,sec4     
#bjf4 ,?ird-p>ty collect+ entities4     
,sec4 #bjg4 ,civil rights & algori?ms4  
,sec4 #bjh4 ,data security & protection 
( cov]$ data4 ,sec4 #bji4 ,small bus9ess
 protections4 ,sec4 #baj4 ,unifi$       
opt-out me*anisms4 ,title               
,,iii--,corporate acc\ntability ,sec4   
#cja4 ,executive responsibility4 ,sec4  
#cjb4 ,s]vice provid]s & ?ird p>ties4   
,sec4 #cjc4 ,te*nical compliance        
programs4 ,sec4 #cjd4 ,commission       
approv$ compliance guidel9es4 ,sec4     
#cje4 ,digital cont5t =g]ies4 ,title    
,,iv--,en=cem5t1 applicability1 &       
miscellane\s ,sec4 #dja4 ,en=cem5t by ! 
,f$]al ,trade ,commission4 ,sec4 #djb4  
,en=cem5t by ,/ate attorneys g5]al4     
,sec4 #djc4 ,en=cem5t by individuals4   
,sec4 #djd4 ,relation%ip to ,f$]al &    
,/ate laws4 ,sec4 #dje4 ,sev]ability4   
,sec4 #djf4 ,,coppa4 ,sec4 #djg4        
,au?orization ( appropriations4 ,sec4   

#djh4 ,effective date4  #b4 ,def9itions 
,9 ?is ,act3 7#a7 ,affirmative express  
cons5t  7,a7 ,9 g5]al ,! t]m affirmative
 express cons5t means an affirmative act
 by an individual t cle>ly communicates 
! individual's freely giv51 specific1   
in=m$1 & unambigu\s au?orization = an   
act or practice1 9 response to a        
specific reque/ f a cov]$ entity t meets
 ! requirem5ts ( subp>agraph 7,b74  7,b7
 ,reque/ requirem5ts ,! requirem5ts (   
?is subp>agraph ) respect to a reque/ f 
a cov]$ entity to an individual are !   
foll[+3 7i7 ,! reque/ is provid$ to !   
individual 9 a cle> & conspicu\s /&alone
 disclosure made ?r\gh ! prim>y m$ium   
us$ to (f] ! cov]$ entity's product or  
s]vice4  7ii7 ,! reque/ includes a      
description ( ! act or practice = :i* ! 
individual's cons5t is s\ght &-- 7,i7   
cle>ly /ates ! specific categories (    
cov]$ data t ! cov]$ entity %all        
collect1 process1 & transf] = ea* act or
 practice2  7,,ii7 cle>ly di/+ui%es     
betwe5 any act or practice :i* is       

necess>y to fulfill a reque/ ( !        
individual & any act or practice :i* is 
= ano!r purpose2 &  7,,iii7 includes a  
prom95t head+ & is writt5 9             
easy-to-und]/& language t w\ld enable a 
reasonable individual to id5tify &      
und]/& ! process+ purpose = :i* cons5t  
is s\ght & ! cov]$ data to be collect$1 
process$1 or transf]r$ by ! cov]$ entity
 = su* process+ purpose4  7iii7 ,!      
reque/ cle>ly expla9s ! individual's    
applicable rights relat$ to cons5t4     
7iv7 ,! reque/ %all be made 9 a mann]   
readily accessible to & usable by       
individuals ) disabilities4  7v7 ,!     
reque/ %all be made available to !      
public 9 ea* language 9 :i* ! cov]$     
entity provides a product or s]vice =   
:i* au?orization is s\ght or 9 :i* !    
cov]$ entity c>ries out any activity    
relat$ to any product or s]vice = :i* ! 
cov]$ data ( ! individual may be        
collect$1 process$1 or transf]r$4  7,c7 
,express cons5t requir$ ,a cov]$ entity 
%all n inf] t an individual has provid$ 

affirmative express cons5t to an act or 
practice f ! inaction ( ! individual or 
! individual's cont9u$ use ( a s]vice or
 product provid$ by ! cov]$ entity4     
7,d7 ,pretextual cons5t prohibit$ ,a    
cov]$ entity %all n obta9 or attempt to 
obta9 ! affirmative express cons5t ( an 
individual ?r\gh-- 7i7 ! use ( any      
false1 fictiti\s1 fraudul5t1 or         
mat]ially mislead+ /atem5t or           
repres5tation2 or  7ii7 ! design1       
modification1 or manipulation ( any us] 
int]face ) ! purpose or sub/antial      
effect ( obscur+1 subv]t+1 or impair+ a 
reasonable individual's autonomy1       
decision mak+1 or *oice to provide su*  
cons5t or any cov]$ data4  7#b7         
,algori?m ,! t]m algori?m means a       
computational process t uses ma*9e      
le>n+1 natural language process+1       
artificial intellig5ce te*niques1 or o!r
 computational process+ te*niques (     
simil> or great] complexity t makes a   
decision or facilitate human decision   
mak+ ) respect to cov]$ data1 includ+ to

 det]m9e ! provision ( products or      
s]vices or to rank1 ord]1 promote1      
recomm5d1 amplify1 or simil>ly det]m9e !
 deliv]y or display ( in=mation to an   
individual4  7#c7 ,biometric in=mation  
7,a7 ,9 g5]al ,! t]m biometric in=mation
 means any cov]$ data g5]at$ f !        
te*nological process+ ( an individual's 
unique biological1 physical1 or         
physiological *>act]i/ics t is l9k$ or  
reasonably l9kable to an individual     
includ+-- 7i7 f+]pr9ts2  7ii7 voice     
pr9ts2  7iii7 iris or ret9a scans2  7iv7
 facial mapp+ or h& mapp+1 geometry1 or 
templates2 or  7v7 gait or p]sonally    
id5tify+ physical movem5ts4  7,b7       
,exclusion ,! t]m biometric in=mation   
does n include-- 7i7 a digital or       
physical photograph2  7ii7 an audio or  
video record+2 or  7iii7 data g5]at$ f a
 digital or physical photograph1 or an  
audio or video record+ t _c be us$ to   
id5tify an individual4  7#d7 ,collect2  
collection ,! t]ms collect & collection 
mean buy+1 r5t+1 ga!r+1 obta9+1 receiv+1

 access+1 or o!rwise acquir+ cov]$ data 
by any means4  7#e7 ,commission ,! t]m  
,commission means ! ,f$]al ,trade       
,commission4  7#f7 ,common br&+ ,! t]m  
common br&+ means a "n1 s]vice m>k1 or  
tradem>k t is %>$ by #b or m entities4  
7#g7 ,control ,! t]m control means1 )   
respect to an entity--  7,a7 own]%ip (1 
or ! p[] to vote1 m ?an #ej p]c5t ( !   
out/&+ %>es ( any class ( vot+ security 
( ! entity2  7,b7 control ov] ! election
 ( a majority ( ! directors ( ! entity  
7or ( individuals ex]cis+ simil>        
functions72 or  7,c7 ! p[] to ex]cise a 
controll+ influ5ce ov] ! managem5t ( !  
entity4  7#h7 ,cov]$ data  7,a7 ,9 g5]al
 ,! t]m cov]$ data means in=mation t    
id5tifies or is l9k$ or reasonably      
l9kable1 alone or 9 comb9ation ) o!r    
in=mation1 to an individual or a device 
t id5tifies or is l9k$ or reasonably    
l9kable to an individual1 & may include 
d]iv$ data & unique id5tifi]s4  7,b7    
,exclusions ,! t]m cov]$ data does n    
include-- 7i7 de-id5tifi$ data2  7ii7   

employee data2  7iii7 publicly available
 in=mation2 or  7iv7 inf]5ces made      
exclusively f multiple indep5d5t s\rces 
( publicly available in=mation t d n    
reveal s5sitive cov]$ data ) respect to 
an individual4  7,c7 ,employee data     
def9$ ,= purposes ( subp>agraph 7,b71 ! 
t]m employee data means--  7i7 in=mation
 relat+ to a job applicant collect$ by a
 cov]$ entity act+ z a prospective      
employ] ( su* job applicant 9 ! c\rse ( 
! application1 or hir+ process1 provid$ 
t su* in=mation is collect$1 process$1  
or transf]r$ by ! prospective employ]   
solely = purposes relat$ to ! employee's
 /atus z a curr5t or =m] job applicant (
 su* employ]2  7ii7 ! bus9ess contact   
in=mation ( an employee1 includ+ !      
employee's "n1 position or title1       
bus9ess telephone numb]1 bus9ess        
address1 or bus9ess email address t is  
provid$ to an employ] by an employee :o 
is act+ 9 a pr(essional capacity1       
provid$ t su* in=mation is collect$1    
process$1 or transf]r$ solely = purposes

 relat$ to su* employee's pr(essional   
activities2  7iii7 em]g5cy contact      
in=mation collect$ by an employ] t      
relates to an employee ( t employ]1     
provid$ t su* in=mation is collect$1    
process$1 or transf]r$ solely = !       
purpose ( hav+ an em]g5cy contact on    
file = ! employee2 or  7iv7 in=mation   
relat+ to an employee 7or a sp\se1      
dep5d5t1 o!r cov]$ family memb]1 or     
b5efici>y ( su* employee7 t is necess>y 
= ! employ] to collect1 process1 or     
transf] solely = ! purpose ( adm9i/]+   
b5efits to :i* su* employee 7or sp\se1  
dep5d5t1 o!r cov]$ family memb]1 or     
b5efici>y ( su* employee7 is entitl$ on 
! basis ( ! employee's position ) t     
employ]4  7#i7 ,cov]$ entity  7,a7 ,!   
t]m cov]$ entity-- 7i7 means any entity 
or any p]son1 o!r ?an an individual act+
 9 a non-comm]cial context1 t alone or  
jo9tly ) o!rs det]m9es ! purposes &     
means ( collect+1 process+1 or transf]r+
 cov]$ data &--  7,i7 is subject to !   
,f$]al ,trade ,commission ,act 7#ae     

,u4,s4,c4 #da et seq472  7,,ii7 is a    
common c>ri] subject to !               
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #aea et seq47 & all ,acts     
am5datory !re( & supplem5t>y !reto title
 ,,ii ( ! ,communications ,act ( #aicd  
7#dg ,u4,s4,c4 #bja-bca7 z curr5tly     
enact$ or subsequ5tly am5d$2 or  7,,iii7
 is an organization n organiz$ to c>ry  
on bus9ess = _! own pr(it or t ( _!     
memb]s2 &  7ii7 includes any entity or  
p]son t controls1 is controll$ by1 or is
 "u common control ) ano!r cov]$ entity4
  7,b7 ,exclusions ,! t]m cov]$ entity  
does n include-- 7i7 a gov]nm5tal entity
 su* z a body1 au?ority1 bo>d1 bureau1  
commission1 di/rict1 ag5cy1 or political
 subdivision ( ! ,f$]al1 ,/ate1 or local
 gov]nm5t2 or  7ii7 a p]son or an entity
 t is collect+1 process+1 or transf]r+  
cov]$ data on behalf ( or a ,f$]al1     
,/ate1 ,tribal1 t]ritorial1 or local    
gov]nm5t entity4  7#aj7 ,de-id5tifi$    
data ,! t]m de-id5tifi$ data means      
in=mation t does n id5tify & is n l9k$  

or reasonably l9kable to an individual  
or an individual's device1 reg>dless (  
:e!r ! in=mation is aggregat$1 provid$ t
 ! cov]$ entity--  7,a7 takes reasonable
 te*nical1 adm9i/rative1 & physical     
measures to ensure t ! in=mation _c1 at 
any po9t1 be us$ to re-id5tify any      
individual or device2  7,b7 publicly    
commits 9 a cle> & conspicu\s mann]--   
7i7 to process & transf] ! in=mation    
solely 9 a de-id5tifi$ =m )\t any       
reasonable means = re-id5tification2 &  
7ii7 to n attempt to re-id5tify !       
in=mation ) any individual or device2 & 
7,c7 contractually obligates any p]son  
or entity t receives ! in=mation f !    
cov]$ entity to comply ) all ( !        
provisions ( ?is p>agraph4  7#aa7 ,d]iv$
 data ,! t]m d]iv$ data means cov]$ data
 t is creat$ by ! d]ivation ( in=mation1
 data1 assumptions1 correlations1       
inf]5ces1 pr$ictions1 or conclusions f  
facts1 evid5ce1 or ano!r s\rce (        
in=mation or data ab\t an individual or 
an individual's device4  7#ab7 ,device  

,! t]m device means any electronic      
equipm5t capable ( transmitt+ or receiv+
 cov]$ data t is design$ = use by "o or 
m individuals4  7#ac7 ,employee ,! t]m  
employee means 7reg>dless ( :e!r su*    
employee is paid1 unpaid1 or employ$ on 
a tempor>y basis7 an employee1 director1
 (fic]1 /aff memb]1 an individual work+ 
z a contractor1 tra9ee1 volunte]1 or    
int]n ( an employ]4  7#ad7 ,executive   
ag5cy ,! ,executive ag5cy has ! mean+   
set =? 9 section #aje ( title #e1 ,unit$
 ,/ates ,code4  7#ae7 ,g5etic in=mation 
,! t]m g5etic in=mation means any cov]$ 
data1 reg>dless ( its =mat1 t conc]ns an
 individual's g5etic *>act]i/ics1       
includ+--  7,a7 raw sequ5ce data t      
results f ! sequ5c+ ( an individual's   
complete extract$ or a portion ( !      
extract$ deoxyribonucleic acid 7,,dna72 
or  7,b7 g5otypic & ph5otypic in=mation 
t results f analyz+ ! raw sequ5ce data4 
7#af7 ,individual ,! t]m individual     
means a natural p]son resid+ 9 ! ,unit$ 
,/ates4  7#ag7 ,l>ge data hold] ,! t]m  

l>ge data hold] means a cov]$ entity or 
s]vice provid] t1 9 ! mo/ rec5t cal5d>  
ye>--  7,a7 _h annual gross rev5ues (   
#bej1jjj1jjj or m2 &  7,b7 collect$1    
process$1 or transf]r$--  7i7 ! cov]$   
data ( m ?an #e1jjj1jjj individuals or  
devices t id5tify or are l9k$ or        
reasonably l9kable to #a or m           
individuals2 &  7ii7 ! s5sitive cov]$   
data ( m ?an #bjj1jjj individuals or    
devices t id5tify or are l9k$ or        
reasonably l9kable to #a or m           
individuals4  7,c7 ,exclusions ,! t]m   
l>ge data hold] does n include any      
in/ance :]e ! cov]$ entity or s]vice    
provid] w\ld qualify z a l>ge data hold]
 solely on acc\nt ( collect+1 or        
process+-- 7i7 p]sonal email addresses2 
7ii7 p]sonal telephone numb]s2 or  7iii7
 log-9 in=mation ( an individual or     
device to all[ ! individual or device to
 log 9 to an acc\nt adm9i/]$ by ! cov]$ 
entity or s]vice provid]4  7,d7 ,rev5ue 
,= purposes ( ?is det]m9+ :e!r any cov]$
 entity or s]vice provid] is a l>ge data

 hold]1 ! t]m rev5ue z x relates to any 
cov]$ entity or s]vice provid] t is n   
organiz$ to c>ry on bus9ess = its own   
pr(it or t ( its memb]s1 means ! gross  
receipts ! cov]$ entity or s]vice       
provid] receiv$ 9 :atev] =m f all s\rces
 )\t subtract+ any co/s or exp5ses1 &   
includes contributions1 gifts1 grants1  
dues or o!r assessm5ts1 income f        
inve/m5ts1 or proce$s f ! sale ( real or
 p]sonal prop]ty4  7#ah7 ,m>ket rese>*  
,! t]m m>ket rese>* means ! collection1 
process+1 or transf] ( cov]$ data z     
reasonably necess>y & proportionate to  
inve/igate ! m>ket = or m>ket+ (        
products1 s]vices1 or ideas1 :]e ! cov]$
 data is n--  7,a7 integrat$ into any   
product or s]vice2  7,b7 o!rwise us$ to 
contact any individual or individual's  
device2 or  7,c7 us$ to adv]tise or     
m>ket to any individual or individual's 
device4  7#ai7 ,mat]ial ,! t]m mat]ial  
means ) respect to an act1 practice1 or 
repres5tation ( a cov]$ entity 7includ+ 
a repres5tation made by ! cov]$ entity 9

 a privacy policy or simil> disclosure  
to individuals71 involv+ ! collection1  
process+1 or transf] ( cov]$ data t su* 
act1 practice1 or repres5tation is      
likely to affect an individual's        
decision or conduct reg>d+ a product or 
s]vice4  7#bj7 ,precise geolocation     
in=mation  7,a7 ,9 g5]al ,! t]m precise 
geolocation in=mation means in=mation t 
reveals ! pa/ or pres5t physical        
location ( an individual1 or device t   
id5tifies or is l9k$ or reasonably      
l9kable to #a or m individuals1 )       
suffici5t precision to id5tify /reet    
level location in=mation or an          
individual's location )9 a range (      
#a1jjj feet or less4  7,b7 ,exclusion ,!
 t]m precise geolocation in=mation does 
n mean geolocation in=mation id5tifiable
 solely f ! visual cont5t ( an image4   
7#ba7 ,process ,! t]m process means to  
conduct or direct any op]ation or set ( 
op]ations p]=m$ on cov]$ data includ+   
analyz+1 organiz+1 /ructur+1 reta9+1    
/or+1 us+1 or o!rwise h&l+ cov]$ data4  

7#bb7 ,process+ purpose ,! t]m process+ 
purpose means a reason = :i* a cov]$    
entity collects1 processes1 or transf]s 
cov]$ data t is specific & granul> en\gh
 = a reasonable individual to und]/& !  
mat]ial facts ( h[ & :y ! cov]$ entity  
collects1 processes1 or transf]s ! cov]$
 data4  7#bc7 ,publicly available       
in=mation  7,a7 ,9 g5]al ,! t]m publicly
 available in=mation means any in=mation
 t a cov]$ entity has a reasonable basis
 to believe has be5 lawfully made       
available to ! g5]al public f-- 7i7     
,f$]al1 ,/ate1 or local gov]nm5t records
 provid$ t ! cov]$ entity collects1     
processes1 & transf]s su* in=mation 9   
accordance ) any re/rictions or t]ms (  
use plac$ on ! in=mation by ! relevant  
gov]nm5t entity2  7ii7 widely di/ribut$ 
m$ia2  7iii7 a website or onl9e s]vice  
made available to all memb]s ( ! public1
 = free or = a fee1 includ+ :]e all     
memb]s ( ! public c log-9 to ! website  
or onl9e s]vice2  7iv7 a disclosure t   
has be5 made to ! g5]al public z requir$

 by ,f$]al1 ,/ate1 or local law2 or  7v7
 a visual obs]vation ( an individual's  
physical pres5ce 9 a public place by    
ano!r p]son1 n includ+ data collect$ by 
a device 9 ! individual's possession4   
7,b7 ,cl>ifications2 limitations  7i7   
,available to all memb]s ( ! public ,=  
purposes ( ?is p>agraph1 in=mation f a  
website or onl9e s]vice is n available  
to all memb]s ( ! public if ! individual
 :o made ! in=mation available via !    
website or onl9e s]vice has re/rict$ !  
in=mation to a specific audi5ce4  7ii7  
,o!r limitations ,! t]m publicly        
available in=mation does n include--    
7,i7 any obsc5e visual depiction 7z     
def9$ = purposes ( section #adfj ( title
 #ah1 ,unit$ ,/ates ,code72  7,,ii7     
inf]5ces made exclusively f multiple    
indep5d5t s\rces ( publicly available   
in=mation t d n reveal s5sitive cov]$   
data ) respect to an individual2        
7,,iii7 biometric in=mation2  7,,iv7    
publicly available in=mation t has be5  
comb9$ ) cov]$ data2  7,v7 g5etic       

in=mation2 or  7,,vi7 kn[n noncons5sual 
intimate images4  7#bd7 ,s5sitive cov]$ 
data  7,a7 ,9 g5]al ,! t]m s5sitive     
cov]$ data means ! foll[+ =ms ( cov]$   
data3 7i7 ,a gov]nm5t-issu$ id5tifi]1   
su* z a social security numb]1 passport 
numb]1 or driv]'s lic5se numb]1 t is n  
requir$ by law to be display$ 9 public4 
7ii7 ,any in=mation t describes or      
reveals ! pa/1 pres5t1 or future        
physical heal?1 m5tal heal?1 disability1
 diagnosis1 or heal?c>e condition or    
treatm5t ( an individual4  7iii7 ,a     
f9ancial acc\nt numb]1 debit c>d numb]1 
cr$it c>d numb]1 or in=mation ab\t      
income level or bank acc\nt balances4   
7iv7 ,biometric in=mation4  7v7 ,g5etic 
in=mation4  7vi7 ,precise geolocation   
in=mation4  7vii7 ,an individual's      
private communications su* z voicemails1
 emails1 texts1 direct messages1 or     
mail1 or in=mation id5tify+ ! p>ties to 
su* communications1 voice               
communications1 & any in=mation t p]ta9s
 to ! transmission ( su* communications1

 includ+ telephone numb]s call$1        
telephone numb]s f :i* calls 7 plac$1 ! 
"t calls 7 made1 call duration1 &       
location in=mation ( ! p>ties to ! call1
 unless ! cov]$ entity is ! s5d] or an  
int5d$ recipi5t ( ! communication4      
,communications are n private = purposes
 ( ?is p>agraph if su* communications   
are made f or to a device provid$ by an 
employ] to an employee ins(> z su*      
employ] provides conspicu\s notice t x  
may access su* communications4  7viii7  
,acc\nt or device log-9 cr$5tials1 or   
security or access codes = an acc\nt or 
device4  7ix7 ,in=mation id5tify+ !     
sexual ori5tation or sexual behavior (  
an individual 9 a mann] inconsi/5t ) !  
individual's reasonable expectation     
reg>d+ disclosure ( su* in=mation4  7x7 
,cal5d> in=mation1 address book         
in=mation1 phone or text logs1 photos1  
audio record+s1 or videos ma9ta9$ =     
private use by an individual1 reg>dless 
( :e!r su* in=mation is /or$ on !       
individual's device or 9 a sep>ate      

location on an individual's device1     
reg>dless ( :e!r su* in=mation is back$ 
up 9 a sep>ate location4  7xi7 ,a       
photograph1 film1 video record+1 or o!r 
simil> m$ium t %[s ! nak$ or            
und]g>m5t-clad private area ( an        
individual4  7xii7 ,in=mation t reveals 
! video cont5t or s]vices reque/$ or    
select$ by an individual f a provid] (  
broadca/ television s]vice1 cable       
s]vice1 satellite s]vice or /ream+ m$ia 
s]vice4  7xiii7 ,in=mation ab\t an      
individual :5 ! cov]$ entity kn[s t !   
individual is "u ! age ( #ag4  7xiv7    
,any o!r cov]$ data collect$1 process$1 
or transf]r$ = ! purpose ( id5tify+ !   
above data types4  7,b7 ,rulemak+ ,!    
,commission may comm5ce a rulemak+      
pursuant to section #eec ( title #e1    
,unit$ ,/ates ,code1 to include any     
additional category ( cov]$ data "u ?is 
def9ition t may require a simil> level (
 protection z ! data li/$ 9 clauses 7i7 
?r\gh 7xvi7 ( subp>agraph 7,a7 z a      
result ( any new me?od ( collect+1      

process+1 or transf]r+ cov]$ data4      
7#be7 ,s]vice provid] ,! t]m s]vice     
provid] means a p]son or entity t       
collects1 processes1 or transf]s cov]$  
data on behalf (1 & at ! direction (1 a 
cov]$ entity & :i* receives cov]$ data f
 or on behalf ( a cov]$ entity pursuant 
to a writt5 contract1 provid$ t !       
contract meets ! requirem5ts ( section  
#cjb4  7#bf7 ,s]vice provid] data ,! t]m
 s]vice provid] data means cov]$ data t 
is collect$ or process$ by or has be5   
transf]r$ to a s]vice provid] by a cov]$
 entity = ! purpose ( all[+ ! s]vice    
provid] to p]=m a s]vice or function on 
behalf (1 & at ! direction (1 su* cov]$ 
entity4  7#bg7 ,/ate ,! t]m ,/ate means 
any ( ! #ej ,/ates1 ! ,di/rict (        
,columbia1 ! ,commonweal? ( ,pu]to      
,rico1 ! ,virg9 ,isl&s1 ,guam1 ,am]ican 
,samoa1 ! ,nor!rn ,m>iana ,isl&s1 or !  
,tru/ ,t]ritory ( ! ,pacific ,isl&s4    
7#bh7 ,/ate privacy au?ority  7,a7 ,9   
g5]al ,! t]m ,/ate ,privacy ,au?ority   
means--  7i7 ! *ief consum] protection  

(fic] ( a ,/ate2 or  7ii7 a ,/ate       
consum] protection ag5cy ) exp]tise 9   
data protection4  7#bi7 ,sub/antial     
privacy risk ,! t]m sub/antial privacy  
risk means ! collection1 process+1 or   
transf] ( cov]$ data 9 a mann] t may    
result 9 any reasonably =eseeable       
mat]ial physical injury1 economic       
injury1 highly (f5sive intrusion into ! 
reasonable privacy expectations ( an    
individual "u ! circum/ances1 or        
discrim9ation on ! basis ( race1 color1 
religion1 national orig91 sex1 or       
disability4  7#cj7 ,t>get$ adv]tis+ ,!  
t]m t>get$ adv]tis+--  7,a7 means       
display+ to an individual or device     
id5tifi$ by a unique id5tifi] an onl9e  
adv]tisem5t or cont5t t is select$ bas$ 
on kn[n or pr$ict$ pref]5ces1           
*>act]i/ics1 or int]e/s associat$ ) !   
individual or a device id5tifi$ by a    
unique id5tifi]2 &  7,b7 does n         
include--  7i7 adv]tis+ or m>ket+ to an 
individual or an individual's device 9  
response to ! individual's specific     

reque/ = in=mation or fe$back2  7ii7    
contextual adv]tis+1 :i* is :5 an       
adv]tisem5t is display$ bas$ on ! cont5t
 or location 9 :i* ! adv]tisem5t appe>s 
& does n v>y bas$ on :o is view+ !      
adv]tisem5t2 or  7iii7 process+ cov]$   
data solely = measur+ or report+        
adv]tis+ or cont5t1 p]=mance1 rea*1 or  
frequ5cy1 includ+ indep5d5t measurem5t4 
7#ca7 ,?ird p>ty ,! t]m ?ird p>ty--     
7,a7 means any p]son or entity t-- 7i7  
collects1 processes1 or transf]s        
?ird-p>ty data2 &  7ii7 is n a s]vice   
provid] ) respect to su* data2 &  7,b7  
does n include a p]son or entity t      
collects cov]$ data f ano!r entity if ! 
#b entities are relat$ by common own]%ip
 or corporate control & %>e common br&+1
 unless "o ( ^? is a l>ge data hold] or 
^? entities are ea* relat$ to a l>ge    
data hold] ?r\gh common own]%ip or      
corporate control4  7#cb7 ,?ird-p>ty    
collect+ entity  7,a7 ,9 g5]al ,! t]m   
?ird-p>ty collect+ entity-- 7i7 means a 
cov]$ entity ^: pr9cipal s\rce ( rev5ue 

is d]iv$ f process+ or transf]r+ ! cov]$
 data t ! cov]$ entity did n collect    
directly f ! individuals l9k$ or l9kable
 to ! cov]$ data2 &  7ii7 does n include
 a cov]$ entity 9 s f> z su* entity     
processes employee data collect$ by &   
receiv$ f a ?ird p>ty conc]n+ any       
individual :o is an employee ( ! ?ird   
p>ty = ! sole purpose ( su* ?ird p>ty   
provid+ b5efits to ! employee4  7,b7    
,pr9cipal s\rce ( rev5ue def9$ ,=       
purposes ( ?is p>agraph1 pr9cipal s\rce 
( rev5ue means1 = ! prior #ab-mon?      
p]iod1 ei!r--  7i7 m ?an #ej p]c5t ( all
 rev5ue ( ! cov]$ entity2 or  7ii7      
obta9+ rev5ue f process+ or transf]r+ ! 
cov]$ data ( m ?an #e1jjj1jjj           
individuals t ! cov]$ entity did n      
collect directly f ! individuals to :i* 
! cov]$ data p]ta9s4  7,c7              
,non-application to s]vice provid]s ,an 
entity %all n be consid]$ to be a       
?ird-p>ty collect+ entity = purposes (  
?is ,act if ! entity is act+ z a s]vice 
provid] 7z def9$ 9 ?is section74  7#cc7 

,?ird-p>ty data ,! t]m ?ird-p>ty data   
means cov]$ data t has be5 transf]r$ to 
a ?ird p>ty by a cov]$ entity4  7#cd7   
,transf] ,! t]m transf] means to        
disclose1 release1 %>e1 dissem9ate1 make
 available1 or lic5se 9 writ+1          
electronically1 or by any o!r means4    
7#ce7 ,unique id5tifi] ,! t]m unique    
id5tifi] means an id5tifi] to ! ext5t t 
su* id5tifi] is reasonably l9kable to an
 individual or device t id5tifies or is 
l9k$ or reasonably l9kable to #a or m   
individuals1 includ+ a device id5tifi]1 
an ,int]net ,protocol address1 cookies1 
beacons1 pixel tags1 mobile ad          
id5tifi]s1 or simil> te*nology1 cu/om]  
numb]1 unique pseudonym1 or us] alias1  
telephone numb]s1 or o!r =ms ( p]si/5t  
or probabili/ic id5tifi]s t are l9k$ or 
reasonably l9kable to an individual or  
device4  7#cf7 ,widely di/ribut$ m$ia ,!
 t]m widely di/ribut$ m$ia means        
in=mation t is available to ! g5]al     
public1 includ+ in=mation f a telephone 
book or onl9e directory1 a television1  

int]net1 or radio program1 ! news m$ia1 
or an int]net site t is available to !  
g5]al public on an unre/rict$ basis1 b  
does n include an obsc5e visual         
depiction 7z def9$ 9 section #adfj (    
title #ah1 ,unit$ ,/ates ,code74  ,i    
,duty ( loyalty  #aja4 ,data m9imization
  7a7 ,9 g5]al ,a cov]$ entity %all n   
collect1 process1 or transf] cov]$ data 
unless ! collection1 process+1 or       
transf] is limit$ to :at is reasonably  
necess>y & proportionate to--  7#a7     
provide1 or ma9ta9 a specific product or
 s]vice reque/$ by ! individual to :om !
 data p]ta9s2  7#b7 deliv] a            
communication t is reasonably anticipat$
 by ! individual recipi5t )9 ! context (
 ! individual's int]actions ) ! cov]$   
entity2 or  7#c7 effect a purpose       
expressly p]mitt$ "u subsection 7b74    
7b7 ,p]missible purposes ,a cov]$ entity
 or s]vice provid] may collect1 process1
 or transf] cov]$ data = any ( ! foll[+ 
purposes provid$ t ! cov]$ entity or    
s]vice provid] c demon/rate t           

collection1 process+1 or transf]        
complies ) all o!r applicable laws n    
preempt$ 9 section #djd & provisions (  
?is ,act & is limit$ to :at is          
reasonably necess>y & proportionate to  
su* purpose3  7#a7 ,to initiate or      
complete a transaction or fulfill an    
ord] or s]vice specifically reque/$ by  
an individual1 includ+ any associat$    
r\t9e adm9i/rative activity su* z bill+1
 %ipp+1 deliv]y1 & acc\nt+1 includ+ !   
collection1 process+1 or transf]r+ ( !  
la/ f\r digits ( a cr$it c>d numb]4     
7#b7 ,) respect to cov]$ data previ\sly 
collect$ 9 accordance ) ?is ,act1       
not)/&+ ?is exception1 to process su*   
data z necess>y to p]=m sy/em ma9t5ance 
or diagno/ics1 to ma9ta9 a product or   
s]vice = :i* su* data 0 collect$1 to    
conduct int]nal rese>* or analytics1 to 
improve a product or s]vice = :i* su*   
data 0 collect$ & to p]=m inv5tory      
managem5t or reasonable network         
managem5t1 to protect aga9/ spam1 or to 
debug or repair errors t impair !       

functionality ( a s]vice or product =   
:i* su* data 0 collect$4  7#c7 ,to      
au!nticate us]s ( a product or s]vice4  
7#d7 ,to prev5t1 detect1 protect aga9/1 
or respond to a security incid5t1 or    
fulfill a product or s]vice w>ranty4 ,= 
purposes ( ?is p>agraph1 security is    
def9$ z network security z well z       
intrusion1 m$ical al]ts1 fire al>ms1 &  
access control security4  7#e7 ,to      
prev5t1 detect1 protect aga9/ or respond
 to fraud1 h>assm5t1 or illegal         
activity4 ,= ! purposes ( ?is p>agraph1 
illegal activity means a violation ( a  
,f$]al1 ,/ate1 or local law puni%able z 
a felony or misdemeanor t c directly h>m
 ano!r p]son4  7#f7 ,to comply ) a legal
 obligation impos$ by ,f$]al1 ,tribal1  
,local1 or ,/ate law1 or to e/abli%1    
ex]cise1 or def5d legal claims4  7#g7   
,to prev5t an individual1 or gr\ps (    
individuals1 f suff]+ h>m :]e ! cov]$   
entity or s]vice provid] believes 9 good
 fai? t ! individual1 or gr\ps (        
individuals1 is at risk ( dea?1 s]i\s   

physical injury1 or o!r s]i\s heal?     
risk4  7#h7 ,to effectuate a product    
recall pursuant to ,f$]al or ,/ate law4 
7#i7  7,a7 ,to conduct a public or      
pe]-review$ sci5tific1 hi/orical1 or    
/ati/ical rese>* project t-- 7i7 is 9 ! 
public int]e/2  7ii7 adh]es to all      
relevant laws gov]n+ su* rese>*2 &      
7iii7 adh]es to ! regulations = human   
subject rese>* e/abli%$ "u "p #df (     
title #de1 ,code ( ,f$]al ,regulations  
7or a successor regulations74  7,b7 ,!  
,commission %\ld set =? )9 #ah mon?s ( !
 enactm5t ( ?is ,act guidel9es to help  
cov]$ entities ensure ! privacy (       
affect$ us]s & ! security ( cov]$ data1 
p>ticul>ly z data is be+ transf]r$ to & 
/or$ by rese>*]s4  7#aj7 ,to deliv] a   
communication at ! direction ( an       
individual betwe5 ! communicat+         
individual & "o or m individuals or     
entities4  7#aa7 ,) respect to cov]$    
data previ\sly collect$ 9 accordance )  
?is ,act1 not)/&+ ?is exception1 to     
process su* data z necess>y to provide  

fir/ p>ty m>ket+ or adv]tis+ ( products 
or s]vices provid$ by ! cov]$ entity4   
7#ab7 ,o!rwise complies ) ! requirem5ts 
( ?is ,act1 includ+ section #bjd7;c71 to
 provide a t>get$ adv]tisem5t4  7c7     
,guidance ,! ,commission %all issue     
guidance reg>d+ :at is reasonably       
necess>y & proportionate to comply ) ?is
 section4 ,su* guidance %all take into  
consid]ation-- 7#a7 ! size (1 & !       
nature1 scope1 & complexity ( !         
activities engag$ 9 by ! cov]$ entity1  
includ+ :e!r ! cov]$ entity is a l>ge   
data hold]1 nonpr(it organization1 cov]$
 entities meet+ ! requirem5ts ( section 
#bji1 s]vice provid]1 ?ird p>ty1 or     
?ird-p>ty collect+ entity2  7#b7 !      
s5sitivity ( cov]$ data collect$1       
process$1 or transf]r$ by ! cov]$       
entity2  7#c7 ! volume ( cov]$ data     
collect$1 process$1 or transf]r$ by !   
cov]$ entity2 &  7#d7 ! numb] (         
individuals & devices to :i* ! cov]$    
data collect$1 process$1 or transf]r$ by
 ! cov]$ entity relates4  7d7 ,deceptive

 m>ket+ ( a product or s]vice ,a cov]$  
entity1 s]vice provid]1 or ?ird p>ty is 
prohibit$ f engag+ 9 deceptive adv]tis+ 
or m>ket+ ) respect to a product or     
s]vice provid$ to an individual4  #ajb4 
,loyalty duties  7a7 ,re/rict$ data     
practices ,not)/&+ section #aja & unless
 an exception applies1 ) respect to     
cov]$ data1 a cov]$ entity %all n-- 7#a7
 collect1 process1 or transf] a social  
security numb]1 except :5 necess>y to   
facilitate ext5sions ( cr$it1           
au!ntication1 ! paym5t & collection (   
taxes1 ! en=cem5t ( a contract betwe5   
p>ties1 or ! prev5tion1 inve/igation1 & 
prosecution ( fraud or illegal activity2
  7#b7 collect or process s5sitive cov]$
 data1 except :]e su* collection or     
process+ is /rictly necess>y to provide 
or ma9ta9 a specific product or s]vice  
reque/$ by ! individual to :om ! cov]$  
data p]ta9s1 or to effect a purpose     
enum]at$ 9 section #aja7;b77#a7 ?r\gh   
7#aj72  7#c7 transf] an individual's    
s5sitive cov]$ data to a ?ird p>ty1     

unless--  7,a7 ! transf] is made        
pursuant to ! affirmative express cons5t
 ( ! individual2  7,b7 ! transf] is     
necess>y to comply ) a legal obligation 
impos$ by ,f$]al1 ,/ate1 or local law1  
or to e/abli%1 ex]cise1 or def5d legal  
claims2  7,c7 ! transf] is necess>y to  
prev5t an individual f imm95t injury :]e
 ! cov]$ entity believes 9 good fai? t !
 individual is at risk ( dea? or s]i\s  
physical injury2  7,d7 ! transf] (      
biometric in=mation is necess>y to      
facilitate data security or             
au!ntication2  7,e7 ! transf] ( a       
password is necess>y to use a designat$ 
password manag] or is to a cov]$ entity 
= ! exclusive purpose ( id5tify+        
passwords t are be+ re-us$ across sites 
or acc\nts2 or  7,f7 ! transf] ( g5etic 
in=mation is necess>y to p]=m a m$ical  
diagnosis or m$ical treatm5t            
specifically reque/$ by an individual1  
or to conduct m$ical rese>* 9 accordance
 ) conditions ( section #aja7;b77#i72 or
  7#d7 collect1 process1 or transf] an  

individual's aggregat$ int]net se>* or  
br[s+ hi/ory1 except ) ! affirmative    
express cons5t ( ! individual or        
pursuant to "o ( ! p]missible purposes  
enum]at$ 9 section #aja7;b77#a7 ?r\gh   
7#aj74  #ajc4 ,privacy by design  7a7   
,policies1 practices1 & proc$ures ,a    
cov]$ entity & a s]vice provid] %all    
e/abli%1 implem5t1 & ma9ta9 reasonable  
policies1 practices1 & proc$ures reg>d+ 
! collection1 process+1 & transf] (     
cov]$ data to--  7#a7 consid] ,f$]al    
laws1 rules1 or regulations relat$ to   
cov]$ data ! cov]$ entity or s]vice     
provid] collects1 processes1 or         
transf]s2  7#b7 id5tify1 assess1 &      
mitigate privacy risks relat$ to        
individuals "u ! age ( #ag1 if          
applicable2  7#c7 mitigate privacy      
risks1 includ+ sub/antial privacy risks1
 relat$ to ! products & s]vices ( !     
cov]$ entity or ! s]vice provid]1       
includ+ _! design1 developm5t1 &        
implem5tation2 &  7#d7 implem5t         
reasonable tra9+ & safegu>ds )9 ! cov]$ 

entity & s]vice provid] to promote      
compliance ) all privacy laws applicable
 to cov]$ data ! cov]$ entity collects1 
processes1 or transf]s or cov]$ data !  
s]vice provid] collects1 processes1 or  
transf]s on behalf ( ! cov]$ entity &   
mitigate privacy risks1 includ+         
sub/antial privacy risks4  7b7 ,factors 
,to consid] ,! policies1 practices1 &   
proc$ures e/abli%$ by a cov]$ entity & a
 s]vice provid] "u subsection 7a71 %all 
correspond )-- 7#a7 ! size ( ! cov]$    
entity or ! s]vice provid] & ! nature1  
scope1 & complexity ( ! activities      
engag$ 9 by ! cov]$ entity1 includ+ :e!r
 ! cov]$ entity is a l>ge data hold]1   
nonpr(it organization1 cov]$ entities   
meet+ ! requirem5ts ( section #bji1 ?ird
 p>ty1 or ?ird-p>ty collect+ entity2    
7#b7 ! s5sitivity ( ! cov]$ data        
collect$1 process$1 or transf]r$ by !   
cov]$ entity or s]vice provid]2  7#c7 ! 
volume ( cov]$ data collect$1 process$1 
or transf]r$ by ! cov]$ entity or s]vice
 provid]2  7#d7 ! numb] ( individuals & 

devices to :i* ! cov]$ data collect$1   
process$1 or transf]r$ by ! cov]$ entity
 or s]vice provid] relates2 &  7#e7 !   
co/ ( implem5t+ su* policies1 practices1
 & proc$ures 9 relation to ! risks &    
nature ( ! cov]$ data4  7c7 ,commission 
guidance ,n lat] ?an #a ye> aft] ! date 
( enactm5t ( ?is ,act1 ! ,commission    
%all issue guidance z to :at con/itutes 
reasonable policies1 practices1 &       
proc$ures z requir$ by ?is section4 ,!  
,commission %all consid] unique         
circum/ances applicable to nonpr(it     
organizations & cov]$ entities meet+ !  
requirem5ts ( section #bji4  #ajd4      
,loyalty to individuals ) respect to    
pric+  7a7 ,conditional s]vice or pric+ 
prohibit$ ,a cov]$ entity %all n d5y or 
condition or effectively condition !    
provision ( a s]vice or product to an   
individual bas$ on ! individual's       
agreem5t to waive 7or refusal to waive7 
any requirem5ts "u ?is ,act or any      
regulations promulgat$ "u ?is ,act or   
t]m9ate a s]vice or o!rwise refuse to   

provide a s]vice or product to an       
individual z a consequ5ce ( !           
individual's refusal to provide su* a   
waiv]4  7b7 ,rules ( con/ruction ,no?+ 9
 subsection 7a7 %all be con/ru$ to--    
7#a7 prohibit ! relation ( ! price ( a  
s]vice or ! level ( s]vice provid$ to an
 individual to ! provision1 by !        
individual1 ( f9ancial in=mation t is   
necess>ily collect$ & process$ only = ! 
purpose ( initiat+1 r5d]+1 bill+ =1 or  
collect+ paym5t = a s]vice or product   
reque/$ by ! individual2  7#b7 prohibit 
a cov]$ entity f (f]+ a loyalty program 
t provides disc\nt$ or free products or 
s]vices1 or o!r consid]ation1 9 ex*ange 
= an individual's cont9u$ bus9ess ) !   
cov]$ entity1 provid$ t su* program     
o!rwise complies ) ! requirem5ts ( ?is  
,act & any regulations promulgat$ "u ?is
 ,act2  7#c7 require a cov]$ entity to  
provide a loyalty program t w\ld require
 ! cov]$ entity to collect1 process1 or 
transf] cov]$ data t x o!rwise w\ld n2  
7#d7 prohibit a cov]$ entity f (f]+ a   

f9ancial inc5tive or o!r consid]ation to
 an individual = p>ticipation 9 m>ket   
rese>*2 or  7#e7 prohibit a cov]$ entity
 f (f]+ diff]5t types ( pric+ or        
functionalities ) respect to a product  
or s]vice bas$ on an individual's       
ex]cise ( a "r 9 section #bjc7;a77#c74  
,,ii ,consum] data rights  #bja4        
,consum] aw>5ess  7a7 ,9 g5]al ,n lat]  
?an #ij days aft] ! date ( enactm5t (   
?is ,act1 ! ,commission %all publi%1 on 
! public website ( ! ,commission1 a web 
page t describes ea* provision1 "r1     
obligation1 & requirem5t ( ?is ,act1    
li/$ sep>ately = individuals & = cov]$  
entities & s]vice provid]s1 & ! rem$ies1
 exemptions1 & protections associat$ )  
?is ,act 9 pla9 & concise language & 9  
an easy-to-und]/& mann]4  7b7 ,updates  
,! ,commission %all update ! in=mation  
publi%$ "u subsection 7a7 on a qu>t]ly  
basis z necessitat$ by any *ange 9 law1 
regulation1 guidance1 or judicial       
decisions4  7c7 ,accessibility ,!       
,commission %all publi% mat]ials        

disclos$ pursuant to subsection 7a7 9 ! 
t5 languages ) ! mo/ us]s 9 ! ,unit$    
,/ates1 accord+ to ! mo/ rec5t ,u4,s4   
,c5sus4 ,! ,commission %all ensure !    
website is readily accessible to &      
usable by individuals ) disabilities4   
#bjb4 ,transp>5cy  7a7 ,9 g5]al ,ea*    
cov]$ entity & s]vice provid] %all make 
publicly available1 9 a cle>1           
conspicu\s1 n mislead+1 & readily       
accessible mann]1 a privacy policy t    
provides a detail$ & accurate           
repres5tation ( ! entity's data         
collection1 process+1 & transf]         
activities4  7b7 ,cont5t ( privacy      
policy ,! privacy policy requir$ "u     
subsection 7a7 %all include1 at a       
m9imum1 ! foll[+3 7#a7 ,! id5tity & !   
contact in=mation (--  7,a7 ! cov]$     
entity or s]vice provid] 7includ+ !     
cov]$ entity's or s]vice provid]'s po9ts
 ( contact1 g5]ic electronic mail       
addresses1 & phone numb]s ( ! cov]$     
entity1 z applicable = privacy & data   
security inquiries72 &  7,b7 any o!r    

entity )9 ! same corporate /ructure z1 &
 "u common br&+ )1 ! cov]$ entity or    
s]vice provid] to :i* cov]$ data is     
transf]r$ by ! cov]$ entity4  7#b7 ,!   
categories ( cov]$ data ! cov]$ entity  
or s]vice provid] collects or processes4
  7#c7 ,! process+ purposes = ea*       
category ( cov]$ data ! cov]$ entity or 
s]vice provid] collects or processes4   
7#d7 ,:e!r ! cov]$ entity or s]vice     
provid] transf]s cov]$ data &1 if s1 ea*
 category ( s]vice provid] & ?ird p>ty  
to :i* ! cov]$ entity or s]vice provid] 
transf]s cov]$ data1 ! "n ( ea*         
?ird-p>ty collect+ entity to :i* ! cov]$
 entity or s]vice provid] transf]s cov]$
 data1 & ! purposes = :i* su* data is   
transf]r$ to su* categories ( s]vice    
provid]s & ?ird p>ties or ?ird-p>ty     
collect+ entities1 except = transf]s to 
gov]nm5tal entities pursuant to a c\rt  
ord] or law t prohibits ! cov]$ entity f
 disclos+ su* transf]4  7#e7 ,! l5g? (  
"t ! cov]$ entity or s]vice provid]     
int5ds to reta9 ea* category ( cov]$    

data1 includ+ s5sitive cov]$ data1 or1  
if x is n possible to id5tify t "t      
frame1 ! crit]ia us$ to det]m9e ! l5g? (
 "t ! cov]$ entity int5ds to reta9      
categories ( cov]$ data4  7#f7 ,a       
prom95t description ( h[ an individual c
 ex]cise ! rights describ$ 9 ?is ,act4  
7#g7 ,a g5]al description ( ! cov]$     
entity's or s]vice provid]'s data       
security practices4  7#h7 ,! effective  
date ( ! privacy policy4  7#i7 ,:e!r or 
n any cov]$ data collect$ by ! cov]$    
entity or s]vice provid] is transf]r$   
to1 process$ 91 /or$ 9 or o!rwise       
accessible to ! ,p's ,republic ( ,*9a1  
,russia1 ,iran1 or ,nor? ,korea4  7c7   
,languages ,! privacy policy requir$ "u 
subsection 7a7 %all be made available to
 ! public 9 ea* language 9 :i* ! cov]$  
entity or s]vice provid]-- 7#a7 provides
 a product or s]vice t is subject to !  
privacy policy2 or  7#b7 c>ries out     
activities relat$ to su* product or     
s]vice4  7d7 ,accessibility ,! cov]$    
entity or s]vice provid] %all also      

provide ! disclosures "u ?is section 9 a
 mann] t is readily accessible to &     
usable by individuals ) disabilities4   
7e7 ,mat]ial *anges  7#a7 ,affirmative  
express cons5t ,if a cov]$ entity makes 
a mat]ial *ange to its privacy policy or
 practices1 ! cov]$ entity %all notify  
ea* individual affect$ by su* mat]ial   
*ange be=e implem5t+ ! mat]ial *ange )  
respect to any previ\sly collect$ cov]$ 
data &1 except z provid$ 9 section      
#aja7;b71 provide a reasonable          
opportunity = ea* individual to )draw   
cons5t to any fur!r mat]ially diff]5t   
collection1 process+1 or transf]r+ (    
cov]$ data "u ! *ang$ policy4  7#b7     
,notification ,! cov]$ entity %all take 
all reasonable measures to provide      
direct notification reg>d+ mat]ial      
*anges to ! privacy policy to ea*       
affect$ individual1 9 ea* language t !  
privacy policy is made available1 & tak+
 into acc\nt available te*nology & !    
nature ( ! relation%ip4  7#c7           
,cl>ification ,no?+ 9 ?is section %all  

be con/ru$ to affect ! requirem5ts =    
cov]$ entities "u section #ajb or #bjd4 
7#d7 ,log ( mat]ial *anges ,ea* l>ge    
data hold] %all reta9 copies ( previ\s  
v]sions ( its privacy policy = at lea/  
#aj ye>s & publi% !m on its website4 ,x 
%all make publicly available1 9 a cle>1 
conspicu\s1 & readily accessible mann]1 
a log describ+ ! data & nature ( ea*    
mat]ial *ange ov] ! pa/ #aj ye>s4 ,!    
descriptions %all be suffici5t = a      
reasonable individual to und]/& !       
mat]ial effect ( ea* mat]ial *ange4  7f7
 ,%ort-,=m notice to consum]s by l>ge   
data hold]s  7#a7 ,9 g5]al ,9 addition  
to ! privacy policy requir$ "u          
subsection 7a71 a l>ge data hold] mu/   
provide a %ort-=m notice ( its cov]$    
data practices 9 a mann] t is-- 7,a7    
concise1 cle>1 & conspicu\s2  7,b7      
readily accessible1 bas$ on ! way an    
individual int]acts ) ! l>ge data hold] 
& its products or s]vices & :at is      
reasonably anticipat$ )9 ! context ( !  
relation%ip2  7,c7 inclusive ( an       

ov]view ( individual rights &           
disclosures to reasonably draw att5tion 
to data practices t may reasonably be   
unexpect$ or t involve s5sitive cov]$   
data2 &  7,d7 no m ?an #ejj words 9     
l5g?4  7#b7 ,rulemak+ ,! ,commission    
%all issue a rule pursuant to section   
#eec ( title #e1 ,unit$ ,/ates ,code1   
e/abli%+ ! m9imum data disclosures      
necess>y = ! %ort-=m notice :i* %all n  
exce$ ! cont5t requirem5ts 9 subsection 
7b7 & %all include templates &_/or      
models ( %ort-=m notices4  #bjc4        
,individual data own]%ip & control  7a7 
,access to1 & correction1 deletion1 &   
portability (1 cov]$ data ,subject to   
subsections 7b7 & 7c71 a cov]$ entity   
%all provide an individual1 aft] receiv+
 a v]ifi$ reque/ f ! individual1 ) ! "r 
to-- 7#a7 access--  7,a7 ! cov]$ data1  
except cov]$ data 9 back-up or ar*ival  
sy/ems1 ( ! individual 9 a              
human-readable =mat t a reasonable      
individual c und]/& & d[nload f !       
int]net1 t is collect$1 process$1 or    

transf]r$ by ! cov]$ entity or any      
s]vice provid] ( ! cov]$ entity )9 ! #bd
 mon?s prec$+ ! reque/2  7,b7 ! "n ( any
 ?ird p>ty & ! categories ( any s]vice  
provid]s to :om ! cov]$ entity has      
transf]r$ = consid]ation ! cov]$ data ( 
! individual1 z well z ! categories (   
s\rces f :i* ! cov]$ data 0 collect$2 & 
7,c7 a description ( ! purpose = :i* !  
cov]$ entity transf]r$ ! cov]$ data ( ! 
individual to a ?ird p>ty or s]vice     
provid]2  7#b7 correct any v]ifiably    
mat]ial inaccuracy or mat]ially         
incomplete in=mation ) respect to !     
cov]$ data ( ! individual t is process$ 
by ! cov]$ entity & in/ruct ! cov]$     
entity to notify any ?ird p>ty1 or      
s]vice provid] to :i* ! cov]$ entity    
transf]r$ su* cov]$ data ( ! correct$   
in=mation2  7#c7 delete cov]$ data ( !  
individual t is process$ by ! cov]$     
entity & in/ruct ! cov]$ entity to      
notify any ?ird p>ty1 or s]vice provid] 
to :i* ! cov]$ entity transf]r$ su*     
cov]$ data ( ! individual's deletion    

reque/2 &  7#d7 to ! ext5t te*nically   
feasible1 export cov]$ data to !        
individual or directly to ano!r entity1 
except = d]iv$ data1 ( ! individual t is
 process$ by ! cov]$ entity )\t lic5s+  
re/rictions t limit su* transf]s1 9--   
7,a7 a human-readable =mat t a          
reasonable individual c und]/& & d[nload
 f ! int]net2 &  7,b7 a portable1       
/ructur$1 int]op]able1 & ma*9e-readable 
=mat4  7b7 ,individual autonomy ,a cov]$
 entity %all n condition1 effectively   
condition1 attempt to condition1 or     
attempt to effectively condition !      
ex]cise ( any individual rights "u ?is  
section ?r\gh-- 7#a7 ?r\gh ! use ( any  
false1 fictiti\s1 fraudul5t1 or         
mat]ially mislead+ /atem5t or           
repres5tation2 or  7#b7 ! design1       
modification1 or manipulation ( any us] 
int]face ) ! purpose or sub/antial      
effect ( obscur+1 subv]t+1 or impair+ a 
reasonable individual's autonomy1       
decision mak+1 or *oice to ex]cise any  
su* rights4  7c7 ,tim+  7#a7 ,subject to

 subsections 7d7 & 7e77#a7 ea* reque/   
%all be complet$ by any--  7,a7 l>ge    
data hold] )9 #de days ( v]ification (  
su* reque/ f an individual2  7,b7 cov]$ 
entity t is n consid]$ a l>ge data hold]
 or a cov]$ entity describ$ 9 section   
#bji )9 #fj days ( v]ification ( su*    
reque/ f an individual2 or  7,c7 cov]$  
entity z describ$ 9 section #bji )9 #ij 
days ( v]ification ( su* reque/ f an    
individual4  7#b7 ,a response p]iod set 
=? 9 ?is subsection may be ext5d$ once  
by #de additional days :5 reasonably    
necess>y1 consid]+ ! complexity & numb] 
( ! individual's reque/s1 s long z !    
cov]$ entity in=ms ! individual ( any   
su* ext5sion )9 ! initial #de-;day      
response p]iod1 toge!r ) ! reason = !   
ext5sion4  7d7 ,frequ5cy & co/ ( access 
,a cov]$ entity-- 7#a7 %all provide an  
individual ) ! opportunity to ex]cise   
ea* ( ! rights describ$ 9 subsection    
7a72 &  7#b7 ) respect to-- 7,a7 ! fir/ 
#b times t an individual ex]cises any "r
 describ$ 9 subsection 7a7 9 any        

#ab-mon? p]iod1 %all all[ ! individual  
to ex]cise su* "r free ( *>ge2 &  7,b7  
any "t beyond ! initial #b times        
describ$ 9 subp>agraph 7,a71 may all[ ! 
individual to ex]cise su* "r = a        
reasonable fee = ea* reque/4  7e7       
,v]ification & exceptions  7#a7 ,requir$
 exceptions ,a cov]$ entity %all n p]mit
 an individual to ex]cise a "r describ$ 
9 subsection 7a71 9 :ole or 9 "p1 if !  
cov]$ entity--  7,a7 _c reasonably v]ify
 t ! individual mak+ ! reque/ to ex]cise
 ! "r is ! individual ^: cov]$ data is !
 subject ( ! reque/ or an individual    
au?oriz$ to make su* a reque/ on !      
individual's behalf2  7,b7 reasonably   
believes t ! reque/ is made to int]f]e )
 a contract betwe5 ! cov]$ entity &     
ano!r individual2  7,c7 det]m9es t !    
ex]cise ( ! "r w\ld require access to or
 correction ( ano!r individual's        
s5sitive cov]$ data2 or  7,d7 reasonably
 believes t ! ex]cise ( ! "r w\ld       
require ! cov]$ entity to engage 9 an   
unfair or deceptive practice "u section 

#e ( ! ,f$]al ,trade ,commission ,act   
7#ae ,u4,s4,c4 #de74  7#b7 ,additional  
in=mation ,if a cov]$ entity _c         
reasonably v]ify t a reque/ to ex]cise a
 "r describ$ 9 subsection 7a7 is made by
 ! individual ^: cov]$ data is ! subject
 ( ! reque/ 7or an individual au?oriz$  
to make su* a reque/ on ! individual's  
behalf71 ! cov]$ entity-- 7,a7 may      
reque/ t ! individual mak+ ! reque/ to  
ex]cise ! "r provide any additional     
in=mation necess>y = ! sole purpose (   
v]ify+ ! id5tity ( ! individual2 &  7,b7
 %all n process or transf] su*          
additional in=mation = any o!r purpose4 
7#c7 ,p]missive exceptions  7,a7 ,9     
g5]al ,a cov]$ entity may decl9e to     
comply ) a reque/ to ex]cise a "r       
describ$ 9 subsection 7a71 9 :ole or 9  
"p1 t w\ld--  7i7 require ! cov]$ entity
 to reta9 any cov]$ data collect$ = a   
s+le1 "o-"t transaction1 if su* cov]$   
data is n process$ or transf]r$ by !    
cov]$ entity = any purpose o!r ?an      
complet+ su* transaction2  7ii7 be      

impossible or demon/rably impracticable 
to comply )1 & ! cov]$ entity %all      
provide a description to ! reque/or     
detail+ ! inability to comply ) !       
reque/2  7iii7 require ! cov]$ entity to
 attempt to re-id5tify de-id5tifi$ data2
  7iv7 result 9 ! release ( trade       
secrets1 or o!r privileg$1 or           
confid5tial bus9ess in=mation2  7v7     
require ! cov]$ entity to correct any   
cov]$ data t _c be reasonably v]ifi$ z  
be+ inaccurate or incomplete2  7vi7     
int]f]e ) law en=cem5t1 judicial        
proce$+s1 inve/igations1 or reasonable  
ef=ts to gu>d aga9/1 detect1 or         
inve/igate malici\s or unlawful         
activity1 or en=ce valid contracts2     
7vii7 violate ,f$]al or ,/ate law or !  
rights & fre$oms ( ano!r individual1    
includ+ "u ! ,con/itution ( ! ,unit$    
,/ates2  7viii7 prev5t a cov]$ entity f 
be+ able to ma9ta9 a confid5tial record 
( deletion reque/s1 ma9ta9$ solely = !  
purpose ( prev5t+ cov]$ data ( an       
individual :o has submitt$ a deletion   

reque/ & reque/s t ! cov]$ entity no    
long] collect1 process1 or transf] su*  
data2  7ix7 fall )9 an exception        
enum]at$ 9 ! regulations promulgat$ by !
 ,commission pursuant to p>agraph 7,d72 
or  7x7 ) respect to reque/s =          
deletion--  7,i7 unreasonably int]f]e ) 
! provision ( products or s]vices by !  
cov]$ entity to ano!r p]son x curr5tly  
s]ves2  7,,ii7 delete cov]$ data t      
relates to a public figure & = :i* !    
reque/+ individual has no reasonable    
expectation ( privacy2  7,,iii7 delete  
cov]$ data reasonably necess>y to p]=m a
 contract betwe5 ! cov]$ entity & !     
individual2  7,,iv7 delete cov]$ data t 
! cov]$ entity ne$s to reta9 9 ord] to  
comply ) pr(essional e?ical obligations2
 or  7,v7 delete cov]$ data t ! cov]$   
entity reasonably believes may be       
evid5ce ( unlawful activity or an abuse 
( ! cov]$ entity's products or s]vices4 
7,b7 ,p>tial compliance ,9 a circum/ance
 t w\ld all[ a d5ial pursuant to        
p>agraph 7,a71 a cov]$ entity %all      

p>tially comply ) ! rema9d] ( ! reque/  
if x is possible & n unduly burd5some to
 d s4  7,c7 ,numb] ( reque/s ,= purposes
 ( ?is p>agraph1 ! receipt ( a l>ge     
numb] ( v]ifi$ reque/s1 on its own1 %all
 n be consid]$ to r5d] compliance ) a   
reque/ demon/rably impossible4  7,d7    
,fur!r exceptions ,! ,commission may1 by
 regulation z describ$ 9 subsection 7f71
 e/abli% additional p]missive exceptions
 necess>y to protect ! rights (         
individuals1 alleviate undue burd5s on  
cov]$ entities1 prev5t unju/ or         
unreasonable outcomes f ! ex]cise (     
access1 correction1 deletion1 or        
portability rights1 or z o!rwise        
necess>y to fulfill ! purposes ( ?is    
section4 ,9 creat+ su* exceptions1 !    
,commission %\ld consid] any relevant   
*anges 9 te*nology1 means = protect+    
privacy & o!r rights1 & b5eficial uses (
 cov]$ data by cov]$ entities4  7f7     
,regulations ,)9 two ye>s ( ! date (    
enactm5t ( ?is ,act1 ! ,commission may  
promulgate regulations1 pursuant to     

section #eec ( title #e1 ,unit$ ,/ates  
,code 7#e ,u4,s4,c4 #eec71 z necess>y to
 e/abli% processes by :i* cov]$ entities
 are to comply ) ! provisions ( ?is     
section4 ,su* regulations %all take into
 consid]ation-- 7#a7 ! size (1 & !      
nature1 scope1 & complexity ( !         
activities engag$ 9 by ! cov]$ entity1  
includ+ :e!r ! cov]$ entity is a l>ge   
data hold]1 nonpr(it organization1 cov]$
 entities meet+ ! requirem5ts ( section 
#bji1 s]vice provid]1 ?ird p>ty1 or     
?ird-p>ty collect+ entity2  7#b7 !      
s5sitivity ( cov]$ data collect$1       
process$1 or transf]r$ by ! cov]$       
entity2  7#c7 ! volume ( cov]$ data     
collect$1 process$1 or transf]r$ by !   
cov]$ entity2 &  7#d7 ! numb] (         
individuals & devices to :i* ! cov]$    
data collect$1 process$1 or transf]r$ by
 ! cov]$ entity relates4  7g7           
,accessibility ,a cov]$ entity %all     
facilitate ! ability = individuals to   
make reque/s "u ?is section 9 any ( ! t5
 languages ) ! mo/ us]s 9 ! ,unit$      

,/ates1 accord+ to ! mo/ rec5t ,u4,s4   
,c5sus1 if ! cov]$ entity provides      
s]vice 9 su* language4 ,! me*anisms by  
:i* a cov]$ entity enables individuals  
to make reque/s "u ?is section %all be  
readily accessible & usable by )        
disabilities4  #bjd4 ,"r to cons5t &    
object  7a7 ,)drawal ( cons5t ,a cov]$  
entity %all provide an individual ) a   
cle> & conspicu\s1 easy-to-execute means
 to )draw any affirmative express cons5t
 previ\sly provid$ by ! individual t is 
z easy to execute by a reasonable       
individual z ! means to provide cons5t1 
) respect to ! process+ or transf] ( !  
cov]$ data ( ! individual4  7b7 ,"r ,to 
opt ,out ( cov]$ data transf]s  7#a7 ,9 
g5]al ,a cov]$ entity--  7,a7 %all n    
transf] ! cov]$ data ( an individual to 
a ?ird p>ty if ! individual objects to !
 transf]2 &  7,b7 %all all[ an          
individual to object to su* transf]     
?r\gh an opt-out me*anism1 z describ$ 9 
section #baj1 if applicable4  7#b7      
,exception ,an individual may n opt out 

( ! collection1 process+1 & transf] (   
cov]$ data made pursuant to ! exceptions
 9 sections #aja7;b77#a7 ?r\gh 7#aa7 (  
?is ,act4  7c7 ,"r ,to opt ,out ( t>get$
 adv]tis+ ,a cov]$ entity t engages 9   
t>get$ adv]tis+ %all--  7#a7 prior to   
engag+ 9 su* t>get$ adv]tis+ & at all   
times !reaft]1 provide an individual ) a
 cle> & conspicu\s means to opt out (   
t>get$ adv]tis+2  7#b7 abide by su*     
opt-out designations by an individual2 &
  7#c7 all[ an individual to prohibit   
su* t>get$ adv]tis+ ?r\gh an opt-out    
me*anism1 z describ$ 9 section #baj1 if 
applicable4  7d7 ,individual autonomy ,a
 cov]$ entity %all n condition1         
effectively condition1 attempt to       
condition1 or attempt to effectively    
condition ! ex]cise ( any individual    
rights "u ?is section ?r\gh--  7#a7     
?r\gh ! use ( any false1 fictiti\s1     
fraudul5t1 or mat]ially mislead+ /atem5t
 or repres5tation2 or  7#b7 ! design1   
modification1 or manipulation ( any us] 
int]face ) ! purpose or sub/antial      

effect ( obscur+1 subv]t+1 or impair+ a 
reasonable individual's autonomy1       
decision mak+1 or *oice to ex]cise any  
su* rights4  #bje4 ,data protections =  
*ildr5 & m9ors  7a7 ,prohibition on     
t>get$ adv]tis+ to *ildr5 & m9ors ,a    
cov]$ entity %all n engage 9 t>get$     
adv]tis+ to any individual "u ! age (   
#ag if ! cov]$ entity kn[s t !          
individual is "u ! age ( #ag4  7b7 ,data
 transf] requirem5ts relat$ to m9ors ,a 
cov]$ entity %all n transf] ! cov]$ data
 ( an individual to a ?ird p>ty )\t     
affirmative express cons5t f !          
individual or ! individual's p>5t or    
gu>dian if ! cov]$ entity kn[s t !      
individual "u ! age ( #ag4  7c7 ,k ,! k 
requirem5t 9 subsections 7a7 & 7b71 %all
 n be con/ru$ to require ! affirmative  
collection or process+ ( any data )     
respect to ! age ( an individual or a   
proxy !re(1 or to require t a cov]$     
entity implem5t an age gat+ regime4 ,r1 
! det]m9ation ( :e!r an individual is "u
 #ag %all be bas$ on ! cov]$ data       

collect$ directly f an individual or a  
proxy !re( t ! cov]$ entity w\ld o!rwise
 collect 9 ! normal c\rse ( bus9ess4    
7d7 ,y\? privacy & m>ket+ division  7#a7
 ,e/abli%m5t ,!re is e/abli%$ )9 !      
,commission a division to be kn[n z !   
,y\? ,privacy & ,m>ket+ ,division 79 ?is
 section ref]r$ to z ! ,division74  7#b7
 ,director ,! ,division %all be head$ by
 a ,director1 :o %all be appo9t$ by !   
,*air ( ! ,commission4  7#c7 ,duties ,! 
,division %all be responsible = assi/+ !
 ,commission 9 address+1 z x relates to 
?is ,act--  7,a7 ! privacy ( *ildr5 &   
m9ors2 &  7,b7 m>ket+ direct$ at *ildr5 
& m9ors4  7#d7 ,/aff ,! ,director ( !   
,division %all hire adequate /aff to    
c>ry out ! duties describ$ 9 p>agraph   
7#c71 includ+ by hir+ individuals :o are
 exp]ts 9 data protection1 digital      
adv]tis+1 data analytics1 & y\?         
developm5t4  7#e7 ,reports ,n lat] ?an  
#a ye> aft] ! date ( enactm5t ( ?is     
,act1 & annually !reaft]1 ! ,commission 
%all submit to ! ,committee on ,comm]ce1

 ,sci5ce1 & ,transportation ( ! ,s5ate &
 ! ,committee on ,en]gy & ,comm]ce ( !  
,h\se ( ,repres5tatives a report t      
includes--  7,a7 a description ( ! "w ( 
! ,division reg>d+ em]g+ conc]ns relat+ 
to y\? privacy & m>ket+ practices2 &    
7,b7 an assessm5t ( h[ effectively !    
,division has1 dur+ ! p]iod = :i* !     
report is submitt$1 assi/+ ! ,commission
 to address y\? privacy & m>ket+        
practices4  7#f7 ,publication ,n lat]   
?an #aj days aft] ! date on :i* a report
 is submitt$ "u p>agraph 7#e71 !        
,commission %all publi% ! report on its 
website4  7e7 ,report by ! inspector    
g5]al  7#a7 ,9 g5]al ,n lat] ?an #b ye>s
 aft] ! date ( enactm5t ( ?is ,act1 &   
bi5nially !reaft]1 ! ,inspector ,g5]al (
 ! ,commission %all submit to !         
,commission & to ! ,committee on        
,comm]ce1 ,sci5ce1 & ,transportation ( !
 ,s5ate & ! ,committee on ,en]gy &      
,comm]ce ( ! ,h\se ( ,repres5tatives a  
report reg>d+ ! safe h>bor provisions 9 
section #acjg ( ! ,*ildr5's ,onl9e      

,privacy ,protection ,act ( #aiih 7#ae  
,u4,s4,c4 #fejc71 :i* %all include--    
7,a7 an analysis ( :e!r ! safe h>bor    
provisions are-- 7i7 op]at+ fairly &    
effectively2 &  7ii7 effectively        
protect+ ! int]e/s ( *ildr5 & m9ors2 &  
7,b7 any proposal or recomm5dation =    
policy *anges t w\ld improve !          
effectiv5ess ( ! safe h>bor provisions4 
7#b7 ,publication ,n lat] ?an #aj days  
aft] ! date on :i* a report is submitt$ 
"u p>agraph 7#a71 ! ,commission %all    
publi% ! report on ! website ( !        
,commission4  #bjf4 ,?ird-p>ty collect+ 
entities  7a7 ,notice ,ea* ?ird-p>ty    
collect+ entity %all place a cle> &     
conspicu\s notice on ! website or mobile
 application ( ! ?ird-p>ty collect+     
entity 7if ! ?ird-p>ty collect+ entity  
ma9ta9s su* a website or mobile         
application7 t--  7#a7 notifies         
individuals t ! entity is a ?ird-p>ty   
collect+ entity us+ specific language t 
! ,commission %all develop ?r\gh        
rulemak+ "u section #eec ( title #e1    

,unit$ ,/ates ,code2 &  7#b7 includes a 
l9k to ! website e/abli%$ "u subsection 
7b77#c74  7b7 ,?ird-,p>ty collect+      
entity regi/ration  7#a7 ,9 g5]al ,n    
lat] ?an ,janu>y #ca ( ea* cal5d> ye> t 
foll[s a cal5d> ye> dur+ :i* a cov]$    
entity act$ z a ?ird-p>ty collect+      
entity & process$ cov]$ data p]ta9+ to m
 ?an #e1jjj individuals or devices t    
id5tify or are l9k$ or reasonably       
l9kable to an individual1 su* cov]$     
entity %all regi/] ) ! ,commission 9    
accordance ) ?is subsection4  7#b7      
,regi/ration requirem5ts ,9 regi/]+ ) ! 
,commission z requir$ "u p>agraph 7#a71 
a ?ird-p>ty collect+ entity %all d !    
foll[+3  7,a7 ,pay to ! ,commission a   
regi/ration fee ( #ajj4  7,b7 ,provide !
 ,commission ) ! foll[+ in=mation3  7i7 
,! legal "n & prim>y physical1 email1 & 
int]net addresses ( ! ?ird-p>ty collect+
 entity4  7ii7 ,a description ( !       
categories ( data ! ?ird-p>ty collect+  
entity processes & transf]s4  7iii7 ,!  
contact in=mation ( ! ?ird-p>ty collect+

 entity1 includ+ a contact p]son1       
telephone numb]1 an e-mail address1 a   
website1 & a physical mail+ address4    
7iv7 ,l9k to a website ?r\gh :i* an     
individual may easily ex]cise ! rights  
provid$ "u ?is subsection4  7#c7        
,?ird-p>ty collect+ entity regi/ry ,!   
,commission %all e/abli% & ma9ta9 on a  
website a se>*able1 publicly available1 
c5tral regi/ry ( ?ird-p>ty collect+     
entities t are regi/]$ ) ! ,commission  
"u ?is subsection t includes ! foll[+3  
7,a7 ,a li/+ ( all regi/]$ ?ird-p>ty    
collect+ entities & a se>* feature t    
all[s memb]s ( ! public to id5tify      
individual ?ird-p>ty collect+ entities4 
7,b7 ,= ea* regi/]$ ?ird-p>ty collect+  
entity1 ! in=mation describ$ 9 p>agraph 
7#b74  7,c7 ,a ,d ,n ,collect regi/ry   
l9k & me*anism by :i* an individual may1
 aft] ! ,commission has v]ifi$ ! id5tity
 ( ! individual or individual's p>5t or 
gu>dian1 :i* may include tok5ization1   
easily submit a reque/ to all regi/]$   
?ird-p>ty collect+ entities t are n     

consum] report+ ag5cies1 & to ! ext5t !y
 are n act+ z consum] report+ ag5cies1 z
 def9$ 9 section #fjc7;f7 ( ! ,fair     
,cr$it ,report+ ,act 7#ae ,u4,s4,c4     
#afha;a7f77 to--  7i7 delete all cov]$  
data relat$ to su* individual t !       
?ird-p>ty collect+ entity did n collect 
f ! individual directly or :5 act+ z a  
s]vice provid]2 &  7ii7 ensure t any    
?ird-p>ty collect+ entity no long]      
collects cov]$ data relat$ to su*       
individual )\t ! affirmative express    
cons5t ( su* individual1 except ins(> z 
su* cov]$ entity is act+ z a s]vice     
provid]4 ,ea* ?ird-p>ty collect+ entity 
t receives su* a reque/ f an individual 
%all delete all ! cov]$ data ( !        
individual n lat] ?an #cj days aft] !   
reque/ is receiv$ by ! ?ird-p>ty        
collect+ entity4  7c7 ,p5alties ,a      
?ird-p>ty collect+ entity t fails to    
regi/] or provide ! notice z requir$ "u 
?is section %all be liable =-- 7#a7 a   
civil p5alty ( #ej = ea* day x fails to 
regi/] or provide notice z requir$ "u   

?is subsection1 n to exce$ a total (    
#aj1jjj = any ye>2 &  7#b7 an am\nt     
equal to ! regi/ration fees due "u      
p>agraph 7#b7 ( subsection 7b7 = ea* ye>
 t x fail$ to regi/] z requir$ "u       
p>agraph 7#a7 ( su* subsection4  #bjg4  
,civil rights & algori?ms  7a7 ,civil   
rights protections  7#a7 ,9 g5]al ,a    
cov]$ entity or a s]vice provid] may n  
collect1 process1 or transf] cov]$ data 
9 a mann] t discrim9ates 9 or o!rwise   
makes unavailable ! equal enjoym5t (    
goods or s]vices on ! basis ( race1     
color1 religion1 national orig91 sex1 or
 disability4  7#b7 ,exceptions ,?is     
subsection %all n apply to-- 7,a7 !     
collection1 process+1 or transf] ( cov]$
 data = ! purpose (--  7i7 a cov]$      
entity's or a s]vice provid]'s self-te/+
 to prev5t or mitigate unlawful         
discrim9ation2 or  7ii7 div]sify+ an    
applicant1 p>ticipant1 or cu/om] pool2  
or  7,b7 any private club or gr\p n op5 
to ! public1 z describ$ 9 section       
#bja7;e7 ( ! ,civil ,rights ,act ( #aifd

 7#db ,u4,s4,c4 #bjjj;a7e774  7b7 ,,ftc 
en=cem5t assi/ance  7#a7 ,9 g5]al ,:5ev]
 ! ,commission obta9s in=mation t a     
cov]$ entity or s]vice provid] may h    
collect$1 process$1 or transf]r$ cov]$  
data 9 violation ( subsection 7a71 !    
,commission %all transmit su* in=mation 
z all[able "u ,f$]al law to any         
,executive ag5cy ) au?ority to initiate 
en=cem5t actions or proce$+s relat+ to  
su* violation4  7#b7 ,annual report ,n  
lat] ?an #c ye>s aft] ! date ( enactm5t 
( ?is ,act1 & annually !reaft]1 !       
,commission %all submit to ,congress a  
report t includes a summ>y (-- 7,a7 !   
types ( in=mation ! ,commission         
transmitt$ to ,f$]al ag5cies "u p>agraph
 7#a7 dur+ ! previ\s #a-ye> p]iod2 &    
7,b7 h[ su* in=mation relates to ,f$]al 
civil rights laws4  7#c7 ,te*nical      
assi/ance ,9 transmitt+ in=mation "u    
p>agraph 7#a71 ! ,commission may consult
 & coord9ate )1 & provide te*nical &    
inve/igative assi/ance1 z appropriate1  
to su* ,executive ag5cy4  7#d7          

,coop]ation ) o!r ag5cies ,! ,commission
 may implem5t ?is subsection by execut+ 
agreem5ts or memor&a ( und]/&+ ) !      
appropriate ,f$]al ag5cies4  7c7        
,algori?m impact & evaluation  7#a7     
,algori?m impact assessm5t  7,a7 ,impact
 assessm5t ,not)/&+ any o!r provision ( 
law1 n lat] ?an #b ye>s aft] ! date (   
enactm5t ( ?is ,act1 & annually !reaft]1
 a l>ge data hold] t uses an algori?m t 
may cause pot5tial h>m to an individual1
 & uses su* algori?m solely or 9 "p1 to 
collect1 process1 or transf] cov]$ data 
mu/ conduct an impact assessm5t ( su*   
algori?m 9 accordance ) subp>agraph     
7,b74  7,b7 ,impact assessm5t scope ,!  
impact assessm5t requir$ "u subp>agraph 
7,a7 %all provide ! foll[+3 7i7 ,a      
detail$ description ( ! design process &
 me?odologies ( ! algori?m4  7ii7 ,a    
/atem5t ( ! purpose1 propos$ uses1 &    
=eseeable capabilities outside ( !      
articulat$ propos$ use ( ! algori?m4    
7iii7 ,a detail$ description ( ! data   
us$ by ! algori?m1 includ+ ! specific   

categories ( data t w be process$ z     
input & any data us$ to tra9 ! model t !
 algori?m relies on4  7iv7 ,a           
description ( ! outputs produc$ by !    
algori?m4  7v7 ,an assessm5t ( !        
necessity & proportionality ( ! algori?m
 9 relation to its /at$ purpose1 includ+
 reasons = ! sup]iority ( ! algori?m ov]
 nonautomat$ decision-mak+ me?ods4  7vi7
 ,a detail$ description ( /eps ! l>ge   
data hold] has tak5 or w take to        
mitigate pot5tial h>ms to individuals1  
includ+ pot5tial h>ms relat$ to-- 7,i7  
any individual "u ! age ( #ag2  7,,ii7  
mak+ or facilitat+ adv]tis+ =1 or       
det]m9+ access to1 or re/rictions on !  
use ( h\s+1 education1 employm5t1       
heal?c>e1 insurance1 or cr$it           
opportunities2  7,,iii7 det]m9+ access  
to1 or re/rictions on ! use (1 any place
 ( public accommodation1 p>ticul>ly z   
su* h>ms relate to ! protect$           
*>act]i/ics ( individuals1 includ+ race1
 color1 religion1 national orig91 sex1  
or disability2 or  7,,iv7 disp>ate      

impact on ! basis ( individuals' race1  
color1 religion1 national orig91 sex1 or
 disability /atus4  7#b7 ,algori?m      
design evaluation ,not)/&+ any o!r      
provision ( law1 n lat] ?an #b ye>s aft]
 ! date ( enactm5t ( ?is ,act1 a cov]$  
entity or s]vice provid] t kn[+ly       
develops an algori?m1 solely or 9 "p1 to
 collect1 process1 or transf] cov]$ data
 or publicly available in=mation %all   
prior to deploy+ ! algori?m 9 int]/ate  
comm]ce evaluate ! design1 /ructure1 &  
inputs ( ! algori?m1 includ+ any tra9+  
data us$ to develop ! algori?m1 to r$uce
 ! risk ( ! pot5tial h>ms id5tifi$ "u   
p>agraph 7#a77;,b74  7#c7 ,o!r          
consid]ations  7,a7 ,focus ,9 comply+ ) 
p>agraph 7#a7 or 7#b71 a cov]$ entity & 
a s]vice provid] may focus ! impact     
assessm5t or evaluation on any algori?m1
 or portions ( an algori?m1 t may       
reasonably contribute to ! risk ( !     
pot5tial h>ms id5tifi$ "u p>agraph      
7#a77;,b74  7,b7 ,ext]nal1 indep5d5t    
auditor or rese>*] ,to ! ext5t possible1

 a cov]$ entity & a s]vice provid] %all 
utilize an ext]nal1 indep5d5t auditor or
 rese>*] to conduct an impact assessm5t 
"u p>agraph 7#a7 or an evaluation "u    
p>agraph 7#b74  7,c7 ,availability  7i7 
,9 g5]al ,a cov]$ entity & a s]vice     
provid]-- 7,i7 %all1 n lat] ?an #cj days
 aft] complet+ an impact assessm5t or   
evaluation1 submit ! impact assessm5t & 
evaluation conduct$ "u p>agraphs 7#a7 & 
7#b7 to ! ,commission2  7,,ii7 %all1 ^u 
reque/1 make su* impact assessm5t &     
evaluation available to ,congress2 &    
7,,iii7 may make a summ>y ( su* impact  
assessm5t & evaluation publicly         
available 9 a place t is easily         
accessible to individuals4  7ii7 ,trade 
secrets ,cov]$ entities & s]vice        
provid]s mu/ make all submissions "u ?is
 section to ! ,commission 9 unr$act$ =m1
 b a cov]$ entity & a s]vice provid] may
 r$act & segregate any trade secrets 7z 
def9$ 9 section #ahci ( title #ah1      
,unit$ ,/ates ,code7 f public disclosure
 "u ?is subp>agraph4  7,d7 ,en=cem5t ,! 

,commission may n use any in=mation     
obta9$ solely & exclusively ?r\gh a     
cov]$ entity or a s]vice provid]'s      
disclosure ( in=mation to ! ,commission 
9 compliance ) ?is section = any purpose
 o!r ?an en=c+ ?is ,act1 includ+ ! /udy 
& report provisions 9 p>agraph #f ( ?is 
section4 ,?is provision %all n preclude 
! ,commission f provid+ ?is in=mation to
 ,congress 9 response to a subpo5a or   
(ficial ,congressional reque/4  7#d7    
,guidance ,n lat] ?an #b ye>s aft] !    
date ( enactm5t ( ?is ,act1 !           
,commission %all1 9 consultation ) !    
,secret>y ( ,comm]ce1 or _! respective  
designees1 publi% guidance reg>d+       
compliance ) ?is section4  7#e7         
,rulemak+ & exemption ,! ,commission    
%all h au?ority "u section #eec ( title 
#e1 ,unit$ ,/ates ,code1 to promulgate  
regulations z necess>y to e/abli%       
processes by :i* a l>ge data hold]--    
7,a7 %all submit an impact assessm5t to 
! ,commission "u p>agraph               
7#c77;,c77i77,i72 &  7,b7 may exclude f 

?is subsection any algori?m t pres5ts l[
 or m9imal risk = pot5tial = h>ms to    
individuals 7z id5tifi$ "u p>agraph     
7#a77;,b774  7#f7 ,/udy & report  7,a7  
,/udy ,! ,commission1 9 consultation ) !
 ,secret>y ( ,comm]ce or ! ,secret>y's  
designee1 %all conduct a /udy1 to review
 any impact assessm5t or evaluation     
submitt$ "u ?is p>agraph4 ,su* /udy %all
 include an exam9ation (-- 7i7 be/      
practices = ! assessm5t & evaluation (  
algori?ms2 &  7ii7 me?ods to r$uce !    
risk ( h>m to individuals t may be      
relat$ to ! use ( algori?ms4  7,b7      
,report  7i7 ,initial report ,n lat] ?an
 #c ye>s aft] ! date ( enactm5t ( ?is   
,act1 ! ,commission1 9 consultation ) ! 
,secret>y ( ,comm]ce or ! ,secret>y's   
designee1 %all submit to ,congress a    
report conta9+ ! results ( ! /udy       
conduct$ "u subsection 7a71 toge!r )    
recomm5dations = su* legislation &      
adm9i/rative action z ! ,commission     
det]m9es appropriate4  7ii7 ,additional 
reports ,n lat] ?an #c ye>s aft]        

submission ( ! initial report "u clause 
7i71 & z ! ,commission det]m9es necess>y
 !reaft]1 ! ,commission %all submit to  
,congress an updat$ v]sion ( su* report4
  #bjh4 ,data security & protection (   
cov]$ data  7a7 ,e/abli%m5t ( data      
security practices  7#a7 ,9 g5]al ,a    
cov]$ entity or s]vice provid] %all     
e/abli%1 implem5t1 & ma9ta9 reasonable  
adm9i/rative1 te*nical1 & physical data 
security practices & proc$ures to       
protect & secure cov]$ data aga9/       
unau?oriz$ access & acquisition4  7#b7  
,consid]ations ,! reasonable            
adm9i/rative1 te*nical1 & physical data 
security practices requir$ "u p>agraph  
7#a7 %all be appropriate to-- 7,a7 !    
size & complexity ( ! cov]$ entity or   
s]vice provid]2  7,b7 ! nature & scope (
 ! cov]$ entity or ! s]vice provid]'s   
collect+1 process+1 or transf]r+ ( cov]$
 data2  7,c7 ! volume & nature ( ! cov]$
 data collect$1 process$1 or transf]r$  
by ! cov]$ entity or s]vice provid]2    
7,d7 ! s5sitivity ( ! cov]$ data        

collect$1 process$1 or transf]r$2  7,e7 
! curr5t /ate ( ! art 9 adm9i/rative1   
te*nical1 & physical safegu>ds =        
protect+ su* cov]$ data2 &  7,f7 ! co/ (
 available tools to improve security &  
r$uce vuln]abilities to unau?oriz$      
access & acquisition ( su* cov]$ data 9 
relation to ! risks & nature ( ! cov]$  
data4  7b7 ,specific requirem5ts ,! data
 security practices requir$ "u          
subsection 7a7 %all include1 at a       
m9imum1 ! foll[+ practices3  7#a7       
,assess vuln]abilities ,id5tify+ &      
assess+ any mat]ial int]nal & ext]nal   
risk to1 & vuln]ability 91 ! security ( 
ea* sy/em ma9ta9$ by ! cov]$ entity t   
collects1 processes1 or transf]s cov]$  
data1 or s]vice provid] t collects1     
processes1 or transf]s cov]$ data on    
behalf ( ! cov]$ entity1 includ+        
unau?oriz$ access to or risks to su*    
cov]$ data1 human vuln]abilities1 access
 rights1 & ! use ( s]vice provid]s4 ,)  
respect to l>ge data hold]s1 su*        
activities %all include a plan to       

receive & respond to unsolicit$ reports 
( vuln]abilities by any entity or       
individual4  7#b7 ,prev5tive &          
corrective action ,tak+ prev5tive &     
corrective action design$ to mitigate   
any reasonably =eseeable risks or       
vuln]abilities to cov]$ data id5tifi$ by
 ! cov]$ entity or s]vice provid]1      
consi/5t ) ! nature ( su* risk or       
vuln]ability1 :i* may include implem5t+ 
adm9i/rative1 te*nical1 or physical     
safegu>ds or *anges to data security    
practices or ! ar*itecture1 in/allation1
 or implem5tation ( network or op]at+   
s(tw>e1 among o!r actions4  7#c7        
,evaluation ( prev5tive & corrective    
action ,evaluat+ & mak+ reasonable      
adju/m5ts to ! safegu>ds describ$ 9     
p>agraph 7#b7 9 light ( any mat]ial     
*anges 9 te*nology1 int]nal or ext]nal  
?reats to cov]$ data1 & ! cov]$ entity  
or s]vice provid]'s own *ang+ bus9ess   
arrangem5ts or op]ations4  7#d7         
,in=mation ret5tion & disposal ,dispos+ 
( cov]$ data t is requir$ to be delet$  

by law or is no long] necess>y = !      
purpose = :i* ! data 0 collect$1        
process$1 or transf]r$1 unless an       
individual has provid$ affirmative      
express cons5t to su* ret5tion4 ,su*    
disposal %all include de/roy+1 p]man5tly
 eras+1 or o!rwise modify+ ! cov]$ data 
to make su* data p]man5tly unreadable or
 indeciph]able & unrecov]able to ensure 
ongo+ compliance ) ?is section4  7#e7   
,tra9+ ,tra9+ ea* employee ) access to  
cov]$ data on h[ to safegu>d cov]$ data 
& updat+ su* tra9+ z necess>y4  7#f7    
,designation ,designat+ an (fic]1       
employee1 or employees to ma9ta9 &      
implem5t su* practices4  7#g7 ,incid5t  
response ,implem5t+ proc$ures to detect1
 respond to1 or recov] f security       
incid5ts or brea*es4  7c7 ,regulations  
,! ,commission may promulgate 9         
accordance ) section #eec ( title #e1   
,unit$ ,/ates ,code1 te*nology-neutral  
regulations to e/abli% processes =      
comply+ ) ?is section4  7d7             
,applicability ( o!r in=mation security 

laws ,a cov]$ entity t is requir$ to    
comply ) title ,v ( !                   
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja et seq47 or ! ,heal? ,in=mation  
,te*nology = ,economic & ,cl9ical ,heal?
 ,act 7#db ,u4,s4,c4 #agica et seq471 & 
is 9 compliance ) ! in=mation security  
requirem5ts ( su* ,act z det]m9$ by !   
en=cem5t au?ority 9 su* ,act1 %all be   
deem$ to be 9 compliance ) ! requirem5ts
 ( ?is section ) respect to any data    
cov]$ by su* in=mation security         
requirem5ts4  #bji4 ,small bus9ess      
protections  7a7 ,9 g5]al  7#a7 ,any    
cov]$ entity or s]vice provid] t c      
e/abli% t x met ! requirem5ts describ$ 9
 p>agraph 7#b7 = ! p]iod ( ! #c prec$+  
cal5d> ye>s 7or = ! p]iod dur+ :i* !    
cov]$ entity has be5 9 exi/5ce if su*   
p]iod is less ?an #c ye>s7 %all--  7,a7 
be exempt f compliance ) sections       
#bjc7;a77#d71 #bjh7;b77#a7-7c71         
7#e7-7g71 & #cja7;c72 &  7,b7 at ! cov]$
 entity's sole discretion1 h ! option ( 
comply+ ) section #bjc7;a77#b7 by1 aft] 

receiv+ a v]ifi$ reque/ f an individual 
to correct cov]$ data ( ! individual "u 
su* section1 delet+ su* cov]$ data 9 its
 entirety in/ead ( mak+ ! reque/$       
correction4  7#b7 ,exemption requirem5ts
 ,! requirem5ts ( ?is p>agraph are1 )   
respect to a cov]$ entity or a s]vice   
provid] & a p]iod1 ! foll[+3 7,a7 ,!    
cov]$ entity or s]vice provid]'s av]age 
annual gross rev5ues dur+ ! p]iod did n 
exce$ #da1jjj1jjj4  7,b7 ,! cov]$ entity
 or s]vice provid]1 on av]age1 did n    
annually collect or process ! cov]$ data
 ( m ?an #bjj1jjj individuals dur+ !    
p]iod beyond ! purpose ( initiat+1      
r5d]+1 bill+ =1 f9aliz+1 complet+1 or   
o!rwise collect+ paym5t = a reque/$     
s]vice or product1 s long z all cov]$   
data = su* purpose is delet$ or         
de-id5tifi$ )9 #ij days4  7,c7 ,! cov]$ 
entity or s]vice provid] did n d]ive m  
?an #ej p]c5t ( its rev5ue f transf]r+  
cov]$ data dur+ any ye> 7or "p ( a ye>  
if ! cov]$ entity has be5 9 exi/5ce =   
less ?an #a ye>7 t occurs dur+ ! p]iod4 

7#c7 ,def9ition ,= purposes ( ?is       
section1 ! t]m rev5ue z x relates to any
 cov]$ entity t is n organiz$ to c>ry on
 bus9ess = its own pr(it or t ( _!      
memb]s1 means ! gross receipts ! cov]$  
entity receiv$ 9 :atev] =m f all s\rces 
)\t subtract+ any co/s or exp5ses1 &    
includes contributions1 gifts1 grants1  
dues or o!r assessm5ts1 income f        
inve/m5ts1 or proce$s f ! sale ( real or
 p]sonal prop]ty4  7#d7 ,j\rnalism ,no?+
 9 ?is ,act %all be con/ru$ to limit or 
dim9i% ,fir/ ,am5dm5t fre$oms to ga!r & 
publi% in=mation gu>ante$ "u !          
,con/itution4  #baj4 ,unifi$ opt-out    
me*anisms ,= ! rights e/abli%$ "u       
sections #bjd7;b7 & 7c71 & section      
#bjf7;c77#c77;,d7 n lat] ?an #ah mon?s  
aft] ! date ( enactm5t ( ?is ,act1 !    
,commission %all e/abli% "o or m        
acceptable privacy protective1 c5traliz$
 me*anisms1 includ+ global privacy      
signals su* z br[s] or device privacy   
sett+s1 = individuals to ex]cise all su*
 rights ?r\gh a s+le int]face = a cov]$ 

entity to utilize to all[ an individual 
to make su* opt out designations )      
respect to cov]$ data relat$ to su*     
individual4  ,,iii ,corporate           
acc\ntability  #cja4 ,executive         
responsibility  7a7 ,9 g5]al ,beg9n+ #a 
ye> aft] ! date ( enactm5t ( ?is ,act1  
an executive (fic] ( a l>ge data hold]  
%all annually c]tify1 9 good fai?1 to ! 
,commission1 9 a mann] specifi$ by !    
,commission by regulation "u section    
#eec ( title #e1 ,unit$ ,/ates ,code1 t 
! entity ma9ta9s--  7#a7 int]nal        
controls reasonably design$ to comply ) 
?is ,act2 &  7#b7 report+ /ructures to  
ensure t su* c]tify+ (fic]s are involv$ 
91 & are responsible =1 decisions t     
impact ! entity's compliance ) ?is ,act4
  7b7 ,requirem5ts ,a c]tification      
submitt$ "u subsection 7a7 %all be bas$ 
on a review ( ! effectiv5ess ( a l>ge   
data hold]'s int]nal controls & report+ 
/ructures t is conduct$ by ! c]tify+    
(fic]s n m ?an #ij days be=e !          
submission ( ! c]tification4  7c7       

,designation ( privacy & data security  
(fic]  7#a7 ,9 g5]al ,a cov]$ entity & a
 s]vice provid] %all designate--  7,a7  
#a or m qualifi$ employees z privacy    
(fic]s2 &  7,b7 #a or m qualifi$        
employees 79 addition to any employee   
designat$ "u subp>agraph 7,a77 z data   
security (fic]s4  7#b7 ,requirem5ts =   
(fic]s ,an employee :o is designat$ by a
 cov]$ entity or a s]vice provid] z a   
privacy (fic] or a data security (fic]  
%all1 at a m9imum-- 7,a7 implem5t a data
 privacy program & data security program
 to safegu>d ! privacy & security (     
cov]$ data 9 compliance ) ! requirem5ts 
( ?is ,act2 &  7,b7 facilitate ! cov]$  
entity or s]vice provid]'s ongo+        
compliance ) ?is ,act4  7#c7 ,additional
 requirem5ts = l>ge data hold]s ,a l>ge 
data hold] %all designate at lea/ #a ( !
 (fic]s describ$ 9 p>agraph 7#a7 ( ?is  
subsection to report directly to !      
highe/ (ficial at ! l>ge data hold] z a 
privacy protection (fic] :o %all1 9     
addition to ! requirem5ts 9 p>agraph    

7#b71 ei!r directly or ?r\gh a sup]vis$ 
designee or designees--  7,a7 e/abli%   
processes to p]iodically review & update
 ! privacy & security policies1         
practices1 & proc$ures ( ! l>ge data    
hold]1 z necess>y2  7,b7 conduct bi5nial
 & compreh5sive audits to ensure !      
policies1 practices1 & proc$ures ( !    
l>ge data hold] "w to ensure ! company  
is 9 compliance ) all applicable laws & 
ensure su* audits are accessible to !   
,commission ^u su* reque/2  7,c7 develop
 a program to educate & tra9 employees  
ab\t compliance requirem5ts2  7,d7      
ma9ta9 updat$1 accurate1 cle>1 &        
und]/&able records ( all privacy & data 
security practices und]tak5 by ! l>ge   
data hold]2 &  7,e7 s]ve z ! po9t (     
contact betwe5 ! l>ge data hold] &      
en=cem5t au?orities4  7d7 ,l>ge data    
hold] privacy impact assessm5ts  7#a7 ,9
 g5]al ,n lat] ?an #a ye> aft] ! date ( 
enactm5t ( ?is ,act or #a ye> aft] !    
date t a cov]$ entity or s]vice provid] 
fir/ meets ! def9ition ( l>ge data      

hold]1 :i*ev] is e>li]1 & bi5nially     
!reaft]1 ea* l>ge data hold] %all       
conduct a privacy impact assessm5t t    
weighs ! b5efits ( ! l>ge data hold]'s  
cov]$ data collect+1 process+1 & transf]
 practices aga9/ ! pot5tial adv]se      
consequ5ces ( su* practices to          
individual privacy4  7#b7 ,assessm5t    
requirem5ts ,a privacy impact assessm5t 
requir$ "u p>agraph 7#a7 %all be-- 7,a7 
reasonable & appropriate 9 scope giv5-- 
7i7 ! nature ( ! cov]$ data collect$1   
process$1 & transf]r$ by ! l>ge data    
hold]2  7ii7 ! volume ( ! cov]$ data    
collect$1 process$1 & transf]r$ by !    
l>ge data hold]2 &  7iii7 ! pot5tial    
risks pos$ to ! privacy ( individuals by
 ! collect+1 process+1 & transf] ( cov]$
 data by ! l>ge data hold]2  7,b7       
docum5t$ 9 writt5 =m & ma9ta9$ by ! l>ge
 data hold] unless r5d]$ out ( date by a
 subsequ5t assessm5t conduct$ "u        
p>agraph 7#a72 &  7,c7 approv$ by !     
privacy protection (fic] designat$ 9    
subsection 7c77#c7 ( ! l>ge data hold]4 

7#c7 ,additional factors to include 9   
assessm5t ,9 assess+ ! privacy risks1   
includ+ sub/antial privacy risks1 ! l>ge
 data hold] may include reviews ( !     
means by :i* te*nologies1 includ+       
block*a9 & di/ribut$ l$g] te*nologies & 
o!r em]g+ te*nologies1 are us$ to secure
 cov]$ data4  #cjb4 ,s]vice provid]s &  
?ird p>ties  7a7 ,s]vice provid]s ,a    
s]vice provid]-- 7#a7 %all only collect1
 process1 & transf] s]vice provid] data 
to ! ext5t /rictly necess>y &           
proportionate to provide a s]vice       
reque/$ by ! cov]$ entity4 ,?is p>agraph
 %all n require a s]vice provid] to     
collect or process cov]$ data if !      
s]vice provid] w\ld n o!rwise d s2  7#b7
 %all n collect1 process1 or transf]    
s]vice provid] data if ! s]vice provid] 
has actual k t ! cov]$ entity violat$   
?is ,act ) respect to su* data2  7#c7   
%all assi/ a cov]$ entity 9 fulfill+ !  
cov]$ entity's obligation to respond to 
individual rights reque/s pursuant to   
section #bjc1 by appropriate te*nical & 

organizational measures1 tak+ into      
acc\nt ! nature ( ! process+ & !        
in=mation reasonably available to !     
s]vice provid]2  7#d7 may engage ano!r  
s]vice provid] = purposes ( process+    
s]vice provid] data on behalf ( a cov]$ 
entity only aft] provid+ ! cov]$ entity 
t is direct+ ! s]vices or functions ( ! 
s]vice provid] ) respect to su* s]vice  
provid] data ) notice1 & pursuant to a  
writt5 contract t requires su* o!r      
s]vice provid] to satisfy ! obligations 
( ! s]vice provid] ) respect to su*     
s]vice provid] data2  7#e7 %all ^u !    
reasonable reque/ ( ! cov]$ entity1 make
 available to ! cov]$ entity in=mation  
necess>y to demon/rate ! s]vice         
provid]'s compliance ) ! obligations 9  
?is ,act1 :i* may include mak+ available
 a report ( an indep5d5t assessm5t      
arrang$ by ! s]vice provid] on t]ms     
agre$ to by ! p>ties & mak+ ! report    
requir$ "u section #bjg7;c77#b7 z       
applicable2  7#f7 %all1 at ! cov]$      
entity's direction1 delete or return all

 cov]$ data to ! cov]$ entity z reque/$ 
at ! end ( ! provision ( s]vices1 unless
 ret5tion ( ! cov]$ data is requir$ by  
law2  7#g7 %all n transf] s]vice provid]
 data to any p]son ) ! exception ( ano!r
 s]vice provid] )\t ! affirmative       
express cons5t1 obta9$ by ! cov]$ entity
 ) ! direct relation%ip to ! individual 
t is direct+ ! s]vices or functions ( ! 
s]vice provid] ) respect to ! s]vice    
provid] data1 ( ! individual to :om !   
s]vice provid] data is l9k$ or          
reasonably l9kable2  7#h7 %all develop1 
implem5t1 & ma9ta9 reasonable           
adm9i/rative1 te*nical1 & physical      
safegu>ds t are design$ to protect !    
security & confid5tiality ( cov]$ data x
 processes consi/5t ) section #bjh2 &   
7#i7 %all be exempt f ! requirem5ts (   
section #bjb7;d7 ) respect to s]vice    
provid] data b %all provide direct      
notification reg>d+ mat]ial *anges to   
its privacy policy to ea* cov]$ entity )
 :i* x provides s]vices or functions z a
 s]vice provid]1 9 ea* language t !     

privacy policy is made available4       
,compliance ) ?is provision does n      
alleviate any obligations ! s]vice      
provid] has to ! cov]$ entity to :i* x  
provides s]vices or functions z a s]vice
 provid]4  7b7 ,contracts betwe5 cov]$  
entities & s]vice provid]s ,a p]son or  
entity may act z a s]vice provid]       
pursuant to a writt5 contract betwe5 !  
cov]$ entity & ! s]vice provid]1 or a   
writt5 contract betwe5 "o s]vice provid]
 & a second s]vice provid] z p]mitt$ 9  
section #cjb7;a77#d71 provid$ t !       
contract-- 7#a7 gov]ns ! s]vice         
provid]'s data process+ proc$ures )     
respect to process+ or transf] p]=m$ on 
behalf ( ! cov]$ entity or s]vice       
provid]2  7#b7 cle>ly sets =?-- 7,a7    
in/ructions = process+ data2  7,b7 !    
nature & purpose ( process+2  7,c7 !    
type ( data subject to process+2  7,d7 !
 duration ( process+2 &  7,e7 ! rights &
 obligations ( bo? p>ties2  7#c7 does n 
relieve a cov]$ entity or a s]vice      
provid] ( an obligation "u ?is ,act2 &  

7#d7 prohibits--  7,a7 collect+1        
process+1 or transf]r+ cov]$ data 9     
contrav5tion to subsection 7a72 &  7,b7 
comb9+ s]vice provid] data ) cov]$ data 
:i* ! s]vice provid] receives f or on   
behalf ( ano!r p]son or p]sons or       
collects f its own int]action ) an      
individual4 ,! contract may1 subject to 
agreem5t ) ! s]vice provid]1 p]mit a    
cov]$ entity to monitor ! s]vice        
provid]'s compliance ) ! contract ?r\gh 
measures includ+1 b n limit$ to1 ongo+  
manual reviews & automat$ scans1 &      
regul> assessm5ts1 audits1 or o!r       
te*nical & op]ational te/+ at lea/ once 
e #ab mon?s4  7c7 ,relation%ip betwe5   
cov]$ entities & s]vice provid]s  7#a7  
,det]m9+ :e!r a p]son is act+ z a cov]$ 
entity or s]vice provid] ) respect to a 
specific process+ ( data is a fact-bas$ 
det]m9ation t dep5ds ^u ! context 9 :i* 
su* data is process$4  7#b7 ,a cov]$    
entity or s]vice provid] t transf]s     
cov]$ data to a s]vice provid]1 9       
compliance ) ! requirem5ts ( ?is ,act1  

is n liable = a violation ( ?is ,act by 
! s]vice provid] to :om su* cov]$ data 0
 transf]r$1 ?is ,act provid$ t1 at ! "t 
( transf]r+ su* cov]$ data1 ! cov]$     
entity or s]vice provid] did n "k or h  
reason to "k t ! s]vice provid] w\ld    
likely commit a violation ( ?is ,act4   
7#c7 ,a cov]$ entity or s]vice provid] t
 receives cov]$ data 9 compliance ) !   
requirem5ts ( ?is ,act is n 9 violation 
( ?is ,act z a result ( a violation by a
 cov]$ entity or s]vice provid] f :i* x 
receives su* cov]$ data4  7d7 ,?ird     
p>ties ,a ?ird p>ty--  7#a7 %all n      
process ?ird-p>ty data = a process+     
purpose o!r ?an1 9 ! case ( s5sitive    
cov]$ data1 ! process+ purpose = :i* !  
individual gave affirmative express     
cons5t &1 9 ! case ( non-s5sitive data1 
! process+ purpose = :i* ! cov]$ entity 
made a disclosure pursuant to section   
#bjd7;b77#d72  7#b7 = purposes (        
p>agraph 7#a71 may reasonably rely on   
repres5tations made by ! cov]$ entity t 
transf]r$ ! ?ird-p>ty data1 provid$ t ! 

?ird p>ty conducts reasonable due       
dilig5ce on ! repres5tations ( ! cov]$  
entity & f9ds ^? repres5tations to be   
cr$ible2 &  7#c7 %all be exempt f !     
requirem5ts ( section #bjd ) respect to 
?ird-p>ty data1 b %all o!rwise h ! same 
responsibilities & obligations z a cov]$
 entity ) respect to su* data "u all o!r
 provisions ( ?is ,act4  7e7 ,additional
 obligations on cov]$ entities  7#a7 ,9 
g5]al ,a cov]$ entity or s]vice provid] 
%all ex]cise reasonable due dilig5ce 9--
  7,a7 select+ a s]vice provid]2 &  7,b7
 decid+ to transf] cov]$ data to a ?ird 
p>ty4  7#b7 ,guidance ,n lat] ?an #b    
ye>s aft] ! date ( enactm5t ( ?is ,act1 
! ,commission %all publi% guidance      
reg>d+ compliance ) ?is subsection1 tak+
 into consid]ation ! burd5s on small- & 
m$ium-siz$ cov]$ entities4  #cjc4       
,te*nical compliance programs  7a7 ,9   
g5]al ,n lat] ?an #a ye> aft] ! date ( !
 enactm5t ( ?is ,act1 ! ,commission %all
 promulgate regulations "u section #eec 
( title #e1 ,unit$ ,/ates ,code1 to     

e/abli% a process = ! proposal &        
approval ( te*nical compliance programs 
"u ?is section specific to any          
te*nology1 product1 s]vice1 or me?od us$
 by a cov]$ entity to collect1 process1 
or transf] cov]$ data4  7b7 ,scope (    
programs ,! te*nical compliance programs
 e/abli%$ "u ?is section %all1 ) respect
 to a te*nology1 product1 s]vice1 or    
me?od us$ by a cov]$ entity to collect1 
process1 or transf] cov]$ data-- 7#a7   
e/abli% guidel9es = compliance ) ?is    
,act2  7#b7 meet or exce$ ! requirem5ts 
( ?is ,act2 &  7#c7 be made publicly    
available to any individual ^: cov]$    
data is collect$1 process$1 or transf]r$
 us+ su* te*nology1 product1 s]vice1 or 
me?od4  7c7 ,approval process  7#a7 ,9  
g5]al ,any reque/ = approval1 am5dm5t1  
or repeal ( a te*nical compliance       
program may be submitt$ to ! ,commission
 by any p]son1 includ+ a cov]$ entity1 a
 repres5tative ( a cov]$ entity1 an     
association ( cov]$ entities1 or a      
public int]e/ gr\p or organization4 ,)9 

#ij days1 ! ,commission %all publi% !   
reque/ & provide an opportunity = public
 comm5t on ! proposal4  7#b7 ,exp$it$   
response to reque/s ,beg9n+ #a ye> aft] 
! date ( enactm5t ( ?is ,act1 !         
,commission %all act ^u a reque/ = !    
proposal & approval ( a te*nical        
compliance program n lat] ?an #ahj days 
aft] ! fil+ ( ! reque/1 & %all set =?   
publicly 9 writ+ its conclusions ) reg>d
 to su* reque/4  7d7 ,"r ,to appeal     
,f9al action by ! ,commission on a      
reque/ = approval1 am5dm5t1 or repeal ( 
a te*nical compliance program1 or !     
failure to act )9 ! #ahj day p]iod aft] 
a reque/ = approval1 am5dm5t1 or repeal 
( a te*nical compliance program is made 
"u subsection 7c71 may be appeal$ to a  
,f$]al di/rict c\rt ( ! ,unit$ ,/ates ( 
appropriate jurisdiction z provid$ = 9  
section #gjb ( title #e1 ,unit$ ,/ates  
,code4  7e7 ,effect on en=cem5t  7#a7 ,9
 g5]al ,prior to comm5c+ an inve/igation
 or en=cem5t action aga9/ any cov]$     
entity "u ?is ,act1 ! ,commission &     

,/ate attorney g5]al %all consid] !     
cov]$ entity's hi/ory ( compliance ) any
 te*nical compliance program approv$ "u 
?is section & any action tak5 by ! cov]$
 entity to rem$y noncompliance ) su*    
program4 ,if su* en=cem5t action        
describ$ 9 ,sec4 #djc is comm5c$1 !     
cov]$ entity's hi/ory ( compliance ) any
 te*nical compliance program approv$ "u 
?is section & any action tak5 by ! cov]$
 entity to rem$y noncompliance ) su*    
program %all be tak5 into consid]ation  
:5 det]m9+ liability or a p5alty4 ,!    
cov]$ entity's hi/ory ( compliance ) any
 te*nical compliance program %all n     
affect any burd5 ( pro( or ! weight giv5
 to evid5ce 9 an en=cem5t or judicial   
proce$+4  7#b7 ,commission au?ority     
,approval ( a te*nical compliance       
program %all n limit ! au?ority ( !     
,commission1 includ+ ! ,commission's    
au?ority to comm5ce an inve/igation or  
en=cem5t action aga9/ any cov]$ entity  
"u ?is ,act or any o!r ,act4  7#c7 ,rule
 ( con/ruction ,no?+ 9 ?is subsection   

%all provide any individual1 class (    
individuals1 or p]son ) any "r to seek  
discov]y ( any non-public ,commission   
delib]ations or activities or impose any
 plead+ requirem5t on ! ,commission %\ld
 x br+ an en=cem5t action ( any k9d4    
#cjd4 ,commission approv$ compliance    
guidel9es  7a7 ,application = compliance
 guidel9e approval  7#a7 ,9 g5]al ,a    
cov]$ entity t is n a ?ird-p>ty collect+
 entity & meets ! requirem5ts ( section 
#bji1 or a gr\p ( su* cov]$ entities1   
may apply to ! ,commission = approval ( 
#a or m sets ( compliance guidel9es     
gov]n+ ! collection1 process+1 & transf]
 ( cov]$ data by ! cov]$ entity or gr\p 
( cov]$ entities4  7#b7 ,application    
requirem5ts ,su* application %all       
include--  7,a7 a description ( h[ !    
propos$ guidel9es w meet or exce$ !     
requirem5ts ( ?is ,act2  7,b7 a         
description ( ! entities or activities !
 propos$ set ( compliance guidel9es is  
design$ to cov]2  7,c7 a li/ ( ! cov]$  
entities t meet ! requirem5ts ( section 

#bji & are n ?ird-p>ty collect+         
entities1 if any are kn[n at ! "t (     
application1 t int5d to adh]e to !      
compliance guidel9es2 &  7,d7 a         
description ( h[ su* cov]$ entities w be
 indep5d5tly assess$ = adh]5ce to su*   
compliance guidel9es1 includ+ !         
indep5d5t organization n associat$ ) any
 ( ! cov]$ entities t may p>ticipate 9  
guidel9es t w adm9i/] su* guidel9es4    
7#c7 ,commission review  7,a7 ,initial  
approval  7i7 ,public comm5t p]iod ,)9  
#ij days aft] ! receipt ( propos$       
guidel9es submitt$ pursuant to p>agraph 
7#b71 ! ,commission %all publi% !       
proposal & provide an opportunity =     
public comm5t on su* compliance         
guidel9es4  7ii7 ,approval ,!           
,commission %all approve an application 
reg>d+ propos$ guidel9es "u p>agraph    
7#b7 if ! applicant demon/rates t !     
compliance guidel9es--  7,i7 meet or    
exce$ requirem5ts ( ?is ,act2  7,,ii7   
provide = ! regul> review & validation  
by an indep5d5t organization n associat$

 ) any ( ! cov]$ entities t may         
p>ticipate 9 ! guidel9es & t is approv$ 
by ! ,commission to conduct su* reviews 
( ! compliance guidel9es ( ! cov]$      
entity or entities to ensure t ! cov]$  
entity or entities cont9ue to meet or   
exce$ ! requirem5ts ( ?is ,act2 &       
7,,iii7 include a means ( en=cem5t if a 
cov]$ entity does n meet or exce$ !     
requirem5ts 9 ! guidel9es1 :i* may      
include ref]ral to ! ,commission =      
en=cem5t consi/5t ) section #dja or     
ref]ral to ! appropriate ,/ate attorney 
g5]al = en=cem5t consi/5t ) section     
#djb4  7iii7 ,timel9e ,)9 #a ye> (      
receiv+ an application reg>d+ propos$   
guidel9es "u p>agraph 7#b71 !           
,commission %all issue a det]m9ation    
approv+ or d5y+ ! application & provid+ 
its reasons = approv+ or d5y+ su*       
application4  7,b7 ,approval (          
modifications  7i7 ,9 g5]al ,if !       
indep5d5t organization adm9i/]+ a set ( 
guidel9es makes mat]ial *anges to       
guidel9es previ\sly approv$ by !        

,commission1 ! indep5d5t organization   
mu/ submit ! updat$ guidel9es to !      
,commission = approval4 ,z soon z       
feasible1 ! ,commission %all publi% !   
updat$ guidel9es & provide an           
opportunity = public comm5t4  7ii7      
,timel9e ,! ,commission %all approve or 
d5y any mat]ial *ange to ! guidel9es )9 
#ahj days aft] receipt ( ! submission = 
approval4  7b7 ,)drawal ( approval ,if  
at any "t ! ,commission det]m9es t !    
guidel9es previ\sly approv$ no long]    
meet ! requirem5ts ( ?is ,act or a      
regulation promulgat$ "u ?is ,act or t  
compliance ) ! approv$ guidel9es is     
insuffici5tly en=c$ by ! indep5d5t      
organization adm9i/]+ ! guidel9es1 !    
,commission %all notify ! cov]$ entities
 or gr\p ( su* entities & ! indep5d5t   
organization ( its det]m9ation to )draw 
approval ( su* guidel9es & ! basis = do+
 s4 ,^u receipt ( su* notice1 ! cov]$   
entity or gr\p ( su* entities & !       
indep5d5t organization may cure any     
alleg$ defici5cy ) ! guidel9es or !     

en=cem5t ( su* guidel9es )9 #ahj days & 
submit ! propos$ cure or cures to !     
,commission4 ,if ! ,commission det]m9es 
t su* cures elim9ate ! alleg$ defici5cy 
9 ! guidel9es1 !n ! ,commission may n   
)draw approval ( su* guidel9es on !     
basis ( su* det]m9ation4  7c7 ,deem$    
compliance ,a cov]$ entity t is eligible
 to p>ticipate "u subsection 7a77#a71 & 
p>ticipates1 9 guidel9es approv$ "u ?is 
section %all be deem$ 9 compliance ) !  
relevant provisions ( ?is ,act if x is 9
 compliance ) su* guidel9es4  #cje4     
,digital cont5t =g]ies  7a7 ,reports ,n 
lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is ,act1 & annually !reaft]1 !        
,secret>y ( ,comm]ce or ! ,secret>y's   
designee %all publi% a report reg>d+    
digital cont5t =g]ies4  7b7 ,requirem5ts
 ,ea* report "u subsection 7a7 %all     
include ! foll[+3  7#a7 ,a def9ition (  
digital cont5t =g]ies along ) accompany+
 explanatory mat]ials1 except t !       
def9ition develop$ pursuant to ?is      
section %all n sup]s$e any o!r provision

 ( law or be con/ru$ to limit ! au?ority
 ( any ,executive ag5cy relat$ to       
digital cont5t =g]ies4  7#b7 ,a         
description ( ! common s\rces ( digital 
cont5t =g]ies 9 ! ,unit$ ,/ates &       
comm]cial s\rces ( digital cont5t =g]y  
te*nologies4  7#c7 ,an assessm5t ( !    
uses1 applications1 & h>ms ( digital    
cont5t =g]ies4  7#d7 ,an analysis ( !   
me?ods & /&>ds available to id5tify     
digital cont5t =g]ies z well z a        
description ( ! comm]cial te*nological  
c\nt]-measures t are1 or c\ld be1 us$ to
 address conc]ns ) digital cont5t       
=g]ies1 :i* may include ! provision (   
w>n+s to view]s ( suspect cont5t4  7#e7 
,a description ( ! types ( digital      
cont5t =g]ies1 includ+ ^? us$ to commit 
fraud1 cause h>m1 or violate any        
provision ( law4  7#f7 ,any o!r         
in=mation det]m9$ appropriate by !      
,secret>y ( ,comm]ce or ! ,secret>y's   
designee4  ,,iv ,en=cem5t1              
applicability1 & miscellane\s  #dja4    
,en=cem5t by ! ,f$]al ,trade ,commission

  7a7 ,new bureau  7#a7 ,9 g5]al ,!     
,commission %all e/abli% )9 !           
,commission a new bureau1 ! ,bureau (   
,privacy1 :i* %all be comp>able 9       
/ructure1 size1 organization1 & au?ority
 to ! exi/+ ,bureaus )9 ! ,commission   
relat$ to consum] protection &          
competition4  7#b7 ,mission ,! mission (
 ! bureau e/abli%$ "u ?is subsection    
%all be to assi/ ! ,commission 9 ex]cis+
 ! ,commission's au?ority "u ?is ,act & 
relat$ au?orities4  7#c7 ,timel9e ,!    
bureau %all be e/abli%$1 /aff$1 & fully 
op]ational n lat] ?an #a ye> aft] ! date
 ( enactm5t ( ?is ,act4  7b7 ,(fice (   
bus9ess m5tor%ip ,! ,director ( !       
,bureau e/abli%$ "u subsection 7a7 %all 
e/abli% )9 ! ,bureau an ,(fice (        
,bus9ess ,m5tor%ip to provide guidance &
 education to cov]$ entities reg>d+     
compliance ) ?is ,act4 ,cov]$ entities  
may reque/ advice f ! ,commission or ?is
 (fice ) respect to a c\rse ( action :i*
 ! cov]$ entity proposes to pursue & :i*
 may relate to ! requirem5ts ( ?is ,act4

  7c7 ,en=cem5t by ! ,f$]al ,trade      
,commission  7#a7 ,unfair or deceptive  
acts or practices ,a violation ( ?is    
,act or a regulation promulgat$ "u ?is  
,act %all be treat$ z a violation ( a   
rule def9+ an unfair or deceptive act or
 practice prescrib$ "u section          
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b774  7#b7 ,p[]s ( !     
,commission  7,a7 ,9 g5]al ,except z    
provid$ 9 p>agraphs 7#c71 7#d71 & 7#e71 
! ,commission %all en=ce ?is ,act & !   
regulations promulgat$ "u ?is ,act 9 !  
same mann]1 by ! same means1 & ) ! same 
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act4  7,b7 ,privileges &     
immunities ,any p]son :o violates ?is   
,act or a regulation promulgat$ "u ?is  
,act %all be subject to ! p5alties &    
entitl$ to ! privileges & immunities    
provid$ 9 ! ,f$]al ,trade ,commission   

,act 7#ae ,u4,s4,c4 #da et seq474  7#c7 
,limit+ c]ta9 actions unrelat$ to ?is   
act ,if ! ,commission br+s a civil      
action "u ?is ,act alleg+ t an act or   
practice violates ?is ,act or a         
regulation promulgat$ "u ?is ,act1 !    
,commission may n seek a cease & desi/  
ord] aga9/ ! same def5dant "u section   
#e7;b7 ( ! ,f$]al ,trade ,commission    
,act 7#ae ,u4,s4,c4 #de7;b77 to /op t   
same act or practice on ! gr\nds t su*  
act or practice con/itutes an unfair or 
deceptive act or practice4  7#d7 ,common
 c>ri]s & nonpr(its ,not)/&+ any        
jurisdictional limitation ( !           
,commission ) respect to consum]        
protection or privacy1 ! ,commission    
%all en=ce ?is ,act & ! regulations     
promulgat$ "u ?is ,act1 9 ! same mann]  
provid$ 9 subsections 7#a71 7#b71 7#c71 
& 7#e7 ( ?is subsection1 ) respect to   
common c>ri]s subject to !              
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #aea et seq47 & ,all ,acts    
am5datory !re( & supplem5t>y !reto2 &   

organizations n organiz$ to c>ry on     
bus9ess = _! own pr(it or t ( _! memb]s4
  7#e7 ,data privacy & security victims 
relief fund  7,a7 ,e/abli%m5t ( victims 
relief fund ,!re is e/abli%$ 9 !        
,treasury ( ! ,unit$ ,/ates a sep>ate   
fund to be kn[n z ! ,privacy & ,security
 ,victims ,relief ,fund 7ref]r$ to 9 ?is
 p>agraph z ! ,victims ,relief ,fund74  
7,b7 ,deposits ,! am\nt ( any civil     
p5alty obta9$ aga9/ any cov]$ entity or 
s]vice provid] or any o!r relief ord]$  
to provide r$ress1 paym5ts or           
comp5sation1 or o!r monet>y relief to   
individuals t _c be locat$ or ! paym5t (
 :i* w\ld o!rwise n be practicable 9 any
 judicial or adm9i/rative action to     
en=ce ?is ,act or a regulation          
promulgat$ "u ?is ,act %all be deposit$ 
into ! ,victims ,relief ,fund4  7,c7    
,use ( fund am\nts  7i7 ,availability to
 ! ,commission ,not)/&+ section #ccjb ( 
title #ca1 ,unit$ ,/ates ,code1 am\nts 9
 ! ,victims ,relief ,fund %all be       
available to ! ,commission1 )\t fiscal  

ye> limitation1 to provide r$ress1      
paym5ts or comp5sation1 or o!r monet>y  
relief to individuals affect$ by an act 
or practice = :i* relief has be5 obta9$ 
"u ?is ,act4  7ii7 ,o!r p]missible uses 
,to ! ext5t t individuals _c be locat$  
or su* r$ress1 paym5ts or comp5sation1  
or o!r monet>y relief are o!rwise n     
practicable1 ! ,commission may use su*  
funds = ! purpose (-- 7,i7 fund+ !      
activities ( ! ,(fice ( ,bus9ess        
,m5tor%ip e/abli%$ "u subsection 7b72 or
  7,,ii7 engag+ 9 te*nological rese>* t 
! ,commission consid]s necess>y to en=ce
 or adm9i/] ?is ,act4  #djb4 ,en=cem5t  
by ,/ate attorneys g5]al  7a7 ,civil    
action ,9 any case 9 :i* ! attorney     
g5]al ( a ,/ate or ,/ate ,privacy       
,au?ority has reason to believe t an    
int]e/ ( ! resid5ts ( t ,/ate has be51  
may be1 or is adv]sely affect$ by !     
engagem5t ( any a cov]$ entity or s]vice
 provid] 9 an act or practice t has     
violat$ ?is ,act or a regulation        
promulgat$ "u ?is ,act1 ! attorney g5]al

 ( ! ,/ate1 or ,/ate ,privacy ,au?ority1
 may br+ a civil action 9 ! "n ( !      
,/ate1 or z p>5s patriae on behalf ( !  
resid5ts ( ! ,/ate4 ,any su* action %all
 be br\ght exclusively 9 an appropriate 
,f$]al di/rict c\rt ( ! ,unit$ ,/ates   
to--  7#a7 enjo9 t act or practice2     
7#b7 en=ce compliance ) ?is ,act or !   
regulation2  7#c7 obta9 damages1 civil  
p5alties1 re/itution1 or o!r comp5sation
 on behalf ( ! resid5ts ( ! ,/ate2 or   
7#d7 reasonable attorneys' fees & o!r   
litigation co/s reasonably incurr$4  7b7
 ,rights ( ! ,commission  7#a7 ,9 g5]al 
,except :]e n feasible1 ! attorney g5]al
 ( a ,/ate or ,/ate ,privacy ,au?ority  
%all notify ! ,commission 9 writ+ prior 
to initiat+ a civil action "u subsection
 7a74 ,su* notice %all include a copy ( 
! compla9t to be fil$ to initiate su*   
action4 ,^u receiv+ su* notice1 !       
,commission may int]v5e 9 su* action z (
 "r pursuant to ! ,f$]al ,rules ( ,civil
 ,proc$ure4  7#b7 ,notification timel9e 
,:]e x is n feasible = ! attorney g5]al 

( a ,/ate or ,/ate ,privacy ,au?ority to
 provide ! notification requir$ by      
p>agraph 7#a7 be=e initiat+ a civil     
action "u subsection 7a71 ! attorney    
g5]al ( a ,/ate or ,/ate ,privacy       
,au?ority %all notify ! ,commission     
imm$iately aft] initiat+ ! civil action4
  7c7 ,actions by ! ,commission ,9 any  
case 9 :i* a civil action is in/itut$ by
 or on behalf ( ! ,commission =         
violation ( ?is ,act or a regulation    
promulgat$ "u ?is ,act1 no attorney     
g5]al or ,/ate ,privacy ,au?ority may1  
dur+ ! p5d5cy ( su* action1 in/itute a  
civil action aga9/ any def5dant nam$ 9 !
 compla9t 9 ! action in/itut$ by or on  
behalf ( ! ,commission = violation ( ?is
 ,act or a regulation promulgat$ "u ?is 
,act t is alleg$ 9 su* compla9t1 if !   
,commission's compla9t alleges su*      
violations affect$ ! resid5ts ( !       
relevant ,/ate or individuals           
nationwide4 ,9 a case br\ght by !       
,commission t affects ! int]e/s ( a     
,/ate1 an attorney g5]al ( su* ,/ate or 

,/ate ,privacy ,au?ority may int]v5e z (
 "r pursuant to ! ,f$]al ,rules ( ,civil
 ,proc$ure4  7d7 ,rule ( con/ruction    
,no?+ 9 ?is section %all be con/ru$ to  
prev5t ! attorney g5]al ( a ,/ate or    
,/ate ,privacy ,au?ority f ex]cis+ !    
p[]s conf]r$ on ! attorney g5]al or     
,/ate ,privacy ,au?ority to conduct     
inve/igations1 to adm9i/] oa?s or       
affirmations1 or to compel ! att5dance (
 witnesses or ! production ( docum5t>y  
or o!r evid5ce4  7e7 ,pres]vation (     
,/ate p[]s ,except z provid$ 9          
subsection 7c71 no provision ( ?is      
section %all be con/ru$ z alt]+1 limit+1
 or affect+ ! au?ority ( a ,/ate        
attorney g5]al or ,/ate ,privacy        
,au?ority to-- 7#a7 br+ an action or o!r
 regulatory proce$+ aris+ solely "u !   
laws 9 effect 9 t ,/ate2 or  7#b7       
ex]cise ! p[]s conf]r$ on ! attorney    
g5]al or ,/ate ,privacy ,au?ority by !  
laws ( ! ,/ate1 includ+ ! ability to    
conduct inve/igations1 adm9i/] oa?s or  
affirmations1 or compel ! att5dance (   

witnesses or ! production ( docum5t>y or
 o!r evid5ce4  #djc4 ,en=cem5t by       
individuals  7a7 ,en=cem5t by           
individuals  7#a7 ,9 g5]al ,beg9n+ #d   
ye>s aft] ! date on :i* ?is ,act takes  
effect1 any individual :o suff]s an     
injury t c\ld be address$ by ! relief   
p]mitt$ 9 p>agraph 7#b7 = a violation ( 
?is ,act or a regulation promulgat$ "u  
?is ,act by a cov]$ entity may br+ a    
civil action aga9/ su* entity 9 any     
,f$]al c\rt ( compet5t jurisdiction4    
7#b7 ,relief ,9 a civil action br\ght "u
 p>agraph 7#a7 9 :i* ! pla9tiff         
prevails1 ! c\rt may aw>d ! pla9tiff--  
7,a7 an am\nt equal to ! sum ( any      
actual damages su/a9$2  7,b7 injunctive 
relief2 &  7,c7 reasonable attorney's   
fees & litigation co/s4  7#c7 ,rights ( 
! ,commission & ,/ate attorneys g5]al   
7,a7 ,9 g5]al ,prior to an individual   
br++ a civil action "u p>agraph 7#a71   
su* individual mu/ fir/ notify !        
,commission & ! attorney g5]al ( ! ,/ate
 ( ! individuals resid5ce 9 writ+ outl9+

 _! desire to comm5ce a civil action4   
,^u receiv+ su* notice1 ! ,commission & 
,/ate attorney g5]al %all make a        
det]m9ation1 n lat] ?an #fj days aft]   
receiv+ su* notice1 z to :e!r !y w      
indep5d5tly seek to int]v5e 9 su*       
action1 & ^u int]v5+-- 7i7 be he>d on   
all matt]s aris+ 9 su* action2 &  7ii7  
file petitions = appeal ( a decision 9  
su* action4  7,b7 ,bad fai? ,any writt5 
communication reque/+ a monet>y paym5t t
 is s5t to a cov]$ entity %all be       
consid]$ to h be5 s5t 9 bad fai? & %all 
be unlawful z def9$ 9 ?is ,act1 if !    
writt5 communication 0 s5t3  7i7 ,prior 
to ! date t is #fj days aft] ei!r a     
,/ate attorney g5]al or ! ,commission   
has receiv$ ! notice requir$ "u         
subp>agraph 7,a74  7ii7 ,aft] !         
,commission or attorney g5]al ( a ,/ate 
made ! det]m9ation to indep5d5tly seek  
civil actions aga9/ su* entity z outl9$ 
9 subp>agraph 7,a74  7#d7 ,,ftc /udy    
,beg9n+ on ! date t is #e ye>s aft] !   
date ( enactm5t ( ?is ,act1 !           

,commission's ,bureau ( ,economics %all 
conduct an annual /udy to det]m9e !     
economic impacts 9 ! ,unit$ ,/ates (    
dem& lett]s & ! scope ( ! rights ( an   
individual to br+ =? civil actions aga9/
 cov]$ entities4 ,su* /udy %all include1
 b n be limit$ to include ! foll[+3 7,a7
 ,! impact on increas+ insurance rates 9
 ! ,unit$ ,/ates4  7,b7 ,! impact on !  
ability ( cov]$ entities to (f] new     
products or s]vices4  7,c7 ,! impact on 
! creation & gr[? ( />tup companies1    
includ+ te* />tup companies4  7,d7 ,any 
em]g+ risks & long-t]m tr5ds 9 relevant 
m>ketplaces1 supply *a9s1 & labor       
availability4  7#e7 ,report to ,congress
 ,n lat] ?an #a ye> aft] ! fir/ day on  
:i* individuals are able to br+ civil   
actions "u ?is subsection1 & annually   
!reaft]1 ! ,commission %all submit to ! 
,committee on ,en]gy & ,comm]ce ( !     
,h\se ( ,repres5tatives & ! ,committee  
on ,comm]ce1 ,sci5ce1 & ,transportation 
( ! ,s5ate a report t conta9s ! results 
( ! /udy conduct$ "u p>agraph 7#d74  7b7

 ,pre-,dispute arbitration agreem5ts &  
pre-,dispute jo9t-,action waiv]s relat$ 
to individuals "u ! age ( #ah  7#a7     
,arbitration ,except z provid$ 9 section
 #cjc7;d71 & not)/&+ any o!r provision (
 law1 no agreem5t = pre-dispute         
arbitration ) respect to an individual  
"u ! age ( #ah may limit any ( ! rights 
provid$ 9 ?is ,act4  7#b7 ,jo9t-action  
waiv]s ,not)/&+ any o!r provision ( law1
 no agreem5t = pre-dispute jo9t-action  
waiv] ) respect to an individual "u !   
age ( #ah may limit any ( ! rights      
provid$ 9 ?is ,act4  7#c7 ,def9itions ,=
 purposes ( ?is subsection3 7,a7        
,pre-dispute arbitration agreem5t ,! t]m
 pre-dispute arbitration agreem5t means 
any agreem5t to arbitrate a dispute t   
has n aris5 at ! "t ( ! mak+ ( !        
agreem5t4  7,b7 ,pre-dispute jo9t-action
 waiv] ,! t]m pre-dispute jo9t-action   
waiv] means an agreem5t1 :e!r or n "p ( 
a pre-dispute arbitration agreem5t1 t   
w\ld prohibit or waive ! "r ( #a ( !    
p>ties to ! agreem5t to p>ticipate 9 a  

jo9t1 class1 or collective action 9 a   
judicial1 arbitral1 adm9i/rative1 or o!r
 =um1 conc]n+ a dispute t has n yet     
aris5 at ! "t ( ! mak+ ( ! agreem5t4    
7c7 ,"r ,to cure  7#a7 ,notice ,subject 
to p>agraph 7#c71 any action "u ?is     
section may be br\ght by an individual  
if1 prior to initiat+ su* action aga9/ a
 cov]$ entity = injunctive relief or    
aga9/ a cov]$ entity t meets !          
requirem5ts ( section #baj7;c7 = any =m 
( relief ! individual provides to !     
cov]$ entity #de days' writt5 notice    
id5tify+ ! specific provisions ( ?is    
,act ! individual alleges h be5 or are  
be+ violat$4  7#b7 ,effect ( cure ,9 !  
ev5t a cure is possible1 if )9 ! #de    
days ! cov]$ entity cures ! notic$      
violation & provides ! individual an    
express writt5 /atem5t t ! violation has
 be5 cur$ & t no fur!r violations %all  
occur1 an action = injunctive relief may
 be reasonably dismiss$4  7d7 ,dem&     
lett] ,if an individual or a class (    
individuals s5ds correspond5ce to a     

cov]$ entity alleg+ a violation ( !     
provisions ( ?is ,act & reque/+ a       
monet>y paym5t1 su* correspond5ce %all  
include ! foll[+ language3 ,please visit
 ! website ( ! ,f$]al ,trade ,commission
 to und]/& y\r rights pursuant to ?is   
lett] foll[$ by a hyp]l9k to ! web page 
( ! ,commission requir$ "u section #bja4
 ,if su* correspond5ce does n include   
su* language & hyp]l9k1 ! individual or 
jo9t class ( individuals %all =feit _!  
rights "u ?is section4  7e7             
,applicability ,?is section %all only   
apply to any claim alleg+ a violation ( 
section #ajb1 #ajd1 #bjb1 #bjc1 #bjd1   
#bje7;a71 #bje7;b71 #bjf7;c77#c77;,d71  
#bjg7;a71 #bjh7;a71 or #cjb = :i* relief
 describ$ 9 subsection 7a77#b7 may be   
grant$4  #djd4 ,relation%ip to ,f$]al & 
,/ate laws  7a7 ,f$]al law pres]vation  
7#a7 ,9 g5]al ,no?+ 9 ?is ,act or a     
regulation promulgat$ "u ?is ,act %all  
be con/ru$ to limit--  7,a7 ! au?ority (
 ! ,commission1 or any o!r ,executive   
ag5cy1 "u any o!r provision ( law2  7,b7

 any requirem5t = a common c>ri] subject
 to section #fd4bjaa ( title #dg1 ,code 
( ,f$]al ,regulations1 reg>d+ in=mation 
security brea*es2 or  7,c7 any o!r      
provision ( ,f$]al law unless           
specifically au?oriz$ by ?is ,act4  7#b7
 ,applicability ( o!r privacy           
requirem5ts ,a cov]$ entity t is requir$
 to comply ) title ,v ( !               
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja et seq471 ! ,heal? ,in=mation    
,te*nology = ,economic & ,cl9ical ,heal?
 ,act 7#db ,u4,s4,c4 #agica et seq471 "p
 ,c ( title ,,xi ( ! ,social ,security  
,act 7#db ,u4,s4,c4 #acbj;d et seq471 ! 
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afha et seq471 ! ,family     
,educational ,rights & ,privacy ,act    
7#bj ,u4,s4,c4 #abcb;g2 "p #ii ( title  
#cd1 ,code ( ,f$]al ,regulations71 or ! 
regulations promulgat$ pursuant to      
section #bfd7;c7 ( ! ,heal? ,insurance  
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 &
 is 9 compliance ) ! data privacy       

requirem5ts ( su* regulations1 "p1      
title1 or ,act 7z applicable71 %all be  
deem$ to be 9 compliance ) ! relat$     
requirem5ts ( ?is title1 except =       
section #bjh1 ) respect to data subject 
to ! requirem5ts ( su* regulations1 "p1 
title1 or ,act4 ,n lat] ?an #a ye> aft] 
! date ( enactm5t ( ?is ,act1 !         
,commission %all issue guidance describ+
 ! implem5tation ( ?is p>agraph4  7#c7  
,applicability ( o!r data security      
requirem5ts ,a cov]$ entity t is requir$
 to comply ) title ,v ( !               
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja et seq471 ! ,heal? ,in=mation    
,te*nology = ,economic & ,cl9ical ,heal?
 ,act 7#db ,u4,s4,c4 #agica et seq471 "p
 ,c ( title ,,xi ( ! ,social ,security  
,act 7#db ,u4,s4,c4 #acbj;d et seq471 or
 ! regulations promulgat$ pursuant to   
section #bfd7;c7 ( ! ,heal? ,insurance  
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 &
 is 9 compliance ) ! in=mation security 
requirem5ts ( su* regulations1 "p1      

title1 or ,act 7z applicable71 %all be  
deem$ to be 9 compliance ) ! requirem5ts
 ( section #bjh ) respect to data       
subject to ! requirem5ts ( su*          
regulations1 "p1 title1 or ,act4 ,n lat]
 ?an #a ye> aft] ! date ( enactm5t ( ?is
 ,act1 ! ,commission %all issue guidance
 describ+ ! implem5tation ( ?is         
p>agraph4  7b7 ,preemption ( ,/ate laws 
7#a7 ,9 g5]al ,no ,/ate or political    
subdivision ( a ,/ate may adopt1 ma9ta91
 en=ce1 or cont9ue 9 effect any law1    
regulation1 rule1 /&>d1 requirem5t1 or  
o!r provision hav+ ! =ce & effect ( law 
( any ,/ate1 or political subdivision ( 
a ,/ate1 cov]$ by ! provisions ( ?is    
,act1 or a rule1 regulation1 or         
requirem5t promulgat$ "u ?is ,act4  7#b7
 ,/ate law pres]vation ,p>agraph 7#a7   
%all n be con/ru$ to preempt1 displace1 
or supplant ! foll[+ ,/ate laws1 rules1 
regulations1 or requirem5ts3 7,a7       
,consum] protection laws ( g5]al        
applicability su* z laws regulat+       
deceptive1 unfair1 or unconscionable    

practices4  7,b7 ,civil rights laws4    
7,c7 ,laws t gov]n ! privacy rights or  
o!r protections ( employees1 employee   
in=mation1 /ud5ts1 or /ud5t in=mation4  
7,d7 ,laws t address notification       
requirem5ts 9 ! ev5t ( a data brea*4    
7,e7 ,contract or tort law4  7,f7       
,crim9al laws gov]n+ fraud1 !ft1 includ+
 id5tity !ft1 unau?oriz$ access to      
in=mation or electronic devices1 or     
unau?oriz$ use ( in=mation1 malici\s    
behavior1 or simil> provisions1 or laws 
( crim9al proc$ure4  7,g7 ,crim9al or   
civil laws reg>d+ cyb]/alk+1 cyb]bully+1
 noncons5sual pornography1 or sexual    
h>assm5t4  7,h7 ,public safety or sector
 specific laws unrelat$ to privacy or   
security4  7,i7 ,laws t address public  
records1 crim9al ju/ice in=mation       
sy/ems1 arre/ records1 mug %ots1        
conviction records1 or non-conviction   
records4  7,j7 ,laws t address bank+    
records1 f9ancial records1 tax records1 
,social ,security numb]s1 cr$it c>ds1   
cr$it report+ & inve/igations1 cr$it    

repair1 cr$it cl9ics1 or *eck-ca%+      
s]vices4  7,k7 ,laws t solely address   
facial recognition or facial recognition
 te*nologies1 electronic surveillance1  
wiretapp+1 or telephone monitor+4  7,l7 
,! ,biometric ,in=mation ,privacy ,act  
7#gdj ,,icls #ad et seq47 & ! ,g5etic   
,in=mation ,privacy ,act 7#daj ,,ilcs et
 seq474  7,m7 ,laws to address          
unsolicit$ email messages1 telephone    
solicitation1 or call] ,,id4  7,n7 ,laws
 t address heal? in=mation1 m$ical      
in=mation1 m$ical records1 ,,hiv /atus1 
or ,,hiv te/+4  7,o7 ,laws t address !  
confid5tiality ( libr>y records4  7,p7  
,section #agih4aej ( ! ,cali=nia ,civil 
,code 7z am5d$ on ,novemb] #c1 #bjbj1 by
 initiative ,proposition #bd1 section   
#af74  7#c7 ,nonapplication ( ,,fcc     
privacy laws & regulations to cov]$     
entities ,not)/&+ any o!r provision (   
law1 sections #bbb1 #cch7;i71 & #fca ( !
 ,communications ,act ( #aicd1 z am5d$  
7#dg ,u4,s4,c4 #bbb1 #cch7;i71 & #eea71 
& any regulation promulgat$ by ! ,f$]al 

,communications ,commission "u su*      
sections1 %all n apply to any cov]$     
entity ) respect to ! collect+1         
process+1 or transf]r+ ( cov]$ data "u  
?is ,act4  7c7 ,pres]vation ( common law
 or /atutory causes ( action = civil    
relief ,no?+ 9 ?is ,act1 nor any        
am5dm5t1 /&>d1 rule1 requirem5t1        
assessm5t1 law1 or regulation promulgat$
 "u ?is ,act1 %all be con/ru$ to        
preempt1 displace1 or supplant any      
,f$]al or ,/ate common law rights or    
rem$ies1 or any /atute creat+ a rem$y = 
civil relief1 includ+ any cause ( action
 = p]sonal injury1 wrongful dea?1       
prop]ty damage1 or o!r f9ancial1        
physical1 reputational1 or psy*ological 
injury bas$ 9 neglig5ce1 /rict          
liability1 products liability1 failure  
to w>n1 an objectively (f5sive intrusion
 into ! private affairs or conc]ns ( !  
individual1 or any o!r legal !ory (     
liability "u any ,f$]al or ,/ate common 
law1 or any ,/ate /atutory law1 except t
 ! fact ( a violation ( ?is ,act %all n 

be plead$ z an elem5t ( any su* cause ( 
action4  #dje4 ,sev]ability ,if any     
provision ( ?is ,act1 or ! application  
!re( to any p]son or circum/ance1 is    
held invalid1 ! rema9d] ( ?is ,act & !  
application ( su* provision to o!r      
p]sons n simil>ly situat$ or to o!r     
circum/ances %all n be affect$ by !     
invalidation4  #djf4 ,,coppa  7a7 ,9    
g5]al ,no?+ 9 ?is ,act %all be con/ru$  
to relieve or *ange any obligations t a 
cov]$ entity or ano!r p]son may h "u !  
,*ildr5's ,onl9e ,privacy ,protection   
,act ( #aiih 7#ae ,u4,s4,c4 #feja et    
seq474  7b7 ,updat$ regulations ,n lat] 
?an #ahj days aft] ! enactm5t ( ?is     
,act1 ! ,commission %all am5d its rules 
issu$ pursuant to ! ,*ildr5's ,onl9e    
,privacy ,protection ,act ( #aiih 7#ae  
,u4,s4,c4 #feja et seq47 to make ref]5ce
 to ! additional requirem5ts plac$ on   
cov]$ entities "u ?is ,act1 9 addition  
to ^? already enact$ "u ! ,*ildr5's     
,onl9e ,privacy ,protection ,act ( #aiih
 t may already apply to "s ( su* cov]$  

entities4  #djg4 ,au?orization (        
appropriations ,!re are au?oriz$ to be  
appropriat$ to ! ,commission su* sums z 
necess>y to c>ry out ?is ,act4  #djh4   
,effective date ,except z o!rwise       
provid$1 ?is ,act %all take effect on ! 
date t is #ahj days aft] ! date (       
enactm5t ( ?is ,act4