,i #aah? ,,congress #b;d ,session ,h4 ,r4 #hhah ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,june #be1 #bjbd,mrs4 ,rodg]s ( ,wa%+ton 7= h]self1 ,mr4 ,pallone1 ,mr4 ,bilirakis1 & ,ms4 ,s*ak[sky7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce ,a ,,bill ,to provide ,am]icans ) f\ndational data privacy rights1 create /rong ov]sight me*anisms1 & e/abli% mean+ful en=cem5t1 & = o!r purposes4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,am]ican ,privacy ,rights ,act ( #bjbd4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4,title ,i--,am]ican ,privacy ,rights,sec4 #aja4 ,def9itions4,sec4 #ajb4 ,data m9imization4,sec4 #ajc4 ,privacy by design4,sec4 #ajd4 ,transp>5cy4,sec4 #aje4 ,individual control ov] cov]$ data4,sec4 #ajf4 ,opt-out rights & univ]sal me*anisms4,sec4 #ajg4 ,int]f]5ce ) consum] rights4,sec4 #ajh4 ,prohibition on d5ial ( s]vice & waiv] ( rights4,sec4 #aji4 ,data security & protection ( cov]$ data4,sec4 #aaj4 ,executive responsibility4,sec4 #aaa4 ,s]vice provid]s & ?ird p>ties4,sec4 #aab4 ,data brok]s4,sec4 #aac4 ,commission-approv$ compliance guidel9es4,sec4 #aad4 ,privacy-enhanc+ te*nology pilot program4,sec4 #aae4 ,en=cem5t by ,f$]al ,trade ,commission4,sec4 #aaf4 ,en=cem5t by ,/ates4,sec4 #aag4 ,en=cem5t by p]sons4,sec4 #aah4 ,relation to o!r laws4,sec4 #aai4 ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih4,sec4 #abj4 ,data protections = cov]$ m9ors4,sec4 #aba4 ,t]m9ation ( ,,ftc rulemak+ on comm]cial surveillance & data security4,sec4 #abb4 ,sev]ability4,sec4 #abc4 ,innovation rulemak+s4,sec4 #abd4 ,effective date4,title ,,ii--,*ildr5's ,onl9e ,privacy ,protection ,act #b4j,sec4 #bja4 ,%ort title4,sec4 #bjb4 ,onl9e collection1 use1 disclosure1 & deletion ( p]sonal in=mation ( *ildr54,sec4 #bjc4 ,/udy & reports on mobile & onl9e application ov]sight & en=cem5t4,sec4 #bjd4 ,sev]ability4 ,i ,am]ican ,privacy ,rights #aja4 ,def9itions ,9 ?is title3 7#a7 ,affirmative express cons5t 7,a7 ,9 g5]al ,! t]m affirmative express cons5t means an affirmative act by an individual t-- 7i7 cle>ly communicates ! au?orization ( ! individual = an act or practice2 & 7ii7 is provid$ 9 response to a specific reque/ f a cov]$ entity1 or a s]vice provid] on behalf ( a cov]$ entity1 t meets ! requirem5ts ( subp>agraph 7,b74 7,b7 ,reque/ requirem5ts ,! requirem5ts ( ?is subp>agraph ) respect to a reque/ are ! foll[+3 7i7 ,! reque/ is provid$ to ! individual 9 a cle> & conspicu\s /&alone disclosure4 7ii7 ,! reque/ includes a description ( ea* act or practice = :i* ! cons5t ( ! individual is s\ght &-- 7,i7 cle>ly di/+ui%es betwe5 an act or practice t is necess>y1 proportionate1 & limit$ to fulfill a reque/ ( ! individual & an act or practice t is = ano!r purpose2 7,,ii7 cle>ly /ates ! specific categories ( cov]$ data t ! cov]$ entity %all collect1 process1 reta91 or transf] "u ea* su* act or practice2 & 7,,iii7 is writt5 9 easy-to-und]/& language & includes a prom95t head+ t w\ld enable a reasonable individual to id5tify & und]/& ea* su* act or practice4 7iii7 ,! reque/ cle>ly expla9s ! applicable rights ( ! individual relat$ to cons5t4 7iv7 ,! reque/ is made 9 a mann] reasonably accessible to & usable by individuals liv+ ) disabilities4 7v7 ,! reque/ is made available to ! individual 9 ! language 9 :i* ! cov]$ entity provides a product or s]vice = :i* au?orization is s\ght4 7vi7 ,! option to refuse cons5t is at lea/ z prom95t z ! option to provide cons5t1 & ! option to refuse cons5t takes no m ?an #a additional /ep z comp>$ to ! numb] ( /eps necess>y to provide cons5t4 7vii7 ,) respect to affirmative express cons5t s\ght = ! collection1 process+1 ret5tion1 or transf] ( biometric in=mation or g5etic in=mation1 ! reque/ includes ! l5g? ( "t ! cov]$ entity or s]vice provid] int5ds to reta9 ! biometric in=mation or g5etic in=mation or1 if x is n possible to id5tify ! l5g? ( "t1 ! crit]ia us$ to det]m9e ! l5g? ( "t ! cov]$ entity or s]vice provid] int5ds to reta9 ! biometric in=mation or g5etic in=mation4 7,c7 ,express cons5t requir$ ,affirmative express cons5t to an act or practice may n be inf]r$ f ! inaction ( an individual or ! cont9u$ use by an individual ( a s]vice or product provid$ by an entity4 7,d7 ,)drawal ( affirmative express cons5t 7i7 ,9 g5]al ,a cov]$ entity %all provide an individual ) a means to )draw affirmative express cons5t previ\sly provid$ by ! individual4 7ii7 ,requirem5ts ,! means to )draw affirmative express cons5t describ$ 9 clause 7i7 %all be-- 7,i7 cle> & conspicu\s2 & 7,,ii7 z easy = a reasonable individual to use z ! me*anism by :i* ! individual provid$ affirmative express cons5t4 7,e7 ,*ildr5 & te5s ,if a cov]$ entity has k t-- 7i7 an individual is a *ild1 only a p>5t ( ! *ild may provide affirmative express cons5t on behalf ( ! *ild2 or 7ii7 an individual is a te51 a p>5t or ! te5 may provide affirmative express cons5t on behalf ( ! te54 7#b7 ,biometric in=mation 7,a7 ,9 g5]al ,! t]m biometric in=mation means any cov]$ data t all[s or confirms ! unique id5tification or v]ification ( an individual & is g5]at$ f ! measurem5t or process+ ( unique biological1 physical1 or physiological *>act]i/ics1 includ+-- 7i7 f+]pr9ts2 7ii7 voice pr9ts2 7iii7 iris or ret9a imag]y scans2 7iv7 facial or h& mapp+1 geometry1 or templates2 & 7v7 gait4 7,b7 ,exclusion ,! t]m biometric in=mation does n include-- 7i7 a digital or physical photograph2 7ii7 an audio or video record+2 or 7iii7 data d]iv$ f a digital or physical photograph or an audio or video record+ t _c be us$ to id5tify or au!nticate a specific individual4 7#c7 ,*ild ,! t]m *ild means an individual "u ! age ( #ac4 7#d7 ,cle> & conspicu\s ,! t]m cle> & conspicu\s means1 ) respect to a disclosure1 t ! disclosure is difficult to miss & easily und]/&able by ord9>y consum]s4 7#e7 ,co>se geolocation in=mation ,! t]m co>se geolocation in=mation means in=mation t reveals ! pres5t physical location ( an individual or device id5tifi$ by a unique p]si/5t id5tifi] at ! ,,zip ,code attribution level 7except1 if a geographic area attribut$ to a ,,zip ,code is equal to or less ?an ! area ( a circle ) a radius ( #a1hej feet or less1 at a level great] ?an a geographic area equal to ! area ( a circle ) a radius ( #a1hej feet74 7#f7 ,collect ,! t]m collect means1 ) respect to cov]$ data1 to buy1 r5t1 ga!r1 obta91 receive1 access1 or o!rwise acquire ! cov]$ data by any means4 7#g7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#h7 ,common br&+ ,! t]m common br&+ means a "n1 s]vice m>k1 or tradem>k t is %>$ by #b or m entities4 7#i7 ,connect$ device ,! t]m connect$ device means a device t is capable ( connect+ to ! int]net4 7#aj7 ,contextual adv]tis+ ,! t]m contextual adv]tis+ means display+ or pres5t+ an adv]tisem5t t-- 7,a7 does n v>y bas$ on ! id5tity ( ! individual recipi5t2 & 7,b7 is bas$ solely on-- 7i7 ! cont5t ( a webpage or onl9e s]vice2 7ii7 a specific reque/ ( ! individual = in=mation or fe$back2 or 7iii7 co>se geolocation in=mation4 7#aa7 ,control ,! t]m control means1 ) respect to an entity-- 7,a7 own]%ip (1 or ! p[] to vote1 m ?an #ej p]c5t ( ! out/&+ %>es ( any class ( vot+ security ( ! entity2 7,b7 control ov] ! election ( a majority ( ! directors ( ! entity 7or ( individuals ex]cis+ simil> functions72 or 7,c7 ! p[] to ex]cise a controll+ influ5ce ov] ! managem5t ( ! entity4 7#ab7 ,cov]$ data 7,a7 ,9 g5]al ,! t]m cov]$ data means in=mation t id5tifies or is l9k$ or reasonably l9kable1 alone or 9 comb9ation ) o!r in=mation1 to an individual or a device t id5tifies or is l9k$ or reasonably l9kable to #a or m individuals4 7,b7 ,exclusions ,! t]m cov]$ data does n include-- 7i7 de-id5tifi$ data2 7ii7 employee in=mation2 7iii7 publicly available in=mation2 7iv7 inf]5ces made exclusively f multiple indep5d5t s\rces ( publicly available in=mation1 if su* inf]5ces-- 7,i7 d n reveal in=mation ab\t an individual t meets ! def9ition ( ! t]m s5sitive cov]$ data ) respect to ! individual2 & 7,,ii7 are n comb9$ ) cov]$ data2 7v7 in=mation 9 ! collection ( a libr>y1 ar*ive1 or museum1 if-- 7,i7 ! collection is-- 7aa7 op5 to ! public or r\t9ely made available to rese>*]s :o are n affiliat$ ) ! libr>y1 ar*ive1 or museum2 & 7bb7 compos$ ( lawfully acquir$ mat]ials ) respect to :i* all lic5s+ conditions are met2 & 7,,ii7 ! libr>y1 ar*ive1 or museum has-- 7aa7 a public s]vice mission2 & 7bb7 tra9$ /aff or volunte]s to provide pr(essional s]vices normally associat$ ) libr>ies1 ar*ives1 or museums2 or 7vi7 on-device data4 7#ac7 ,cov]$ entity 7,a7 ,9 g5]al ,! t]m cov]$ entity means any entity t1 alone or jo9tly ) o!rs1 det]m9es ! purposes & means ( collect+1 process+1 reta9+1 or transf]r+ cov]$ data &-- 7i7 is subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq472 7ii7 is a common c>ri] subject to title ,,ii ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bja et seq472 or 7iii7 is an organization n organiz$ to c>ry on bus9ess = its own pr(it or t ( its memb]s4 7,b7 ,inclusion ,! t]m cov]$ entity includes any entity t controls1 is controll$ by1 or is "u common control ) ano!r cov]$ entity4 7,c7 ,exclusions ,! t]m cov]$ entity does n include-- 7i7 a ,f$]al1 ,/ate1 ,tribal1 or local gov]nm5t entity1 su* z a body1 au?ority1 bo>d1 bureau1 commission1 di/rict1 ag5cy1 or o!r political subdivision ( ! ,f$]al ,gov]nm5t or a ,/ate1 ,tribal1 or local gov]nm5t2 7ii7 an entity t is collect+1 process+1 reta9+1 or transf]r+ cov]$ data on behalf ( a ,f$]al1 ,/ate1 ,tribal1 or local gov]nm5t entity1 to ! ext5t t su* entity is act+ z a s]vice provid] to ! gov]nm5t entity2 7iii7 a small bus9ess2 7iv7 an individual act+ at _! own direction & 9 a non-comm]cial context2 7v7 ! ,national ,c5t] = ,miss+ & ,exploit$ ,*ildr52 or 7vi7 except ) respect to requirem5ts "u section #aji1 a nonpr(it organization ^: prim>y mission is to prev5t1 inve/igate1 or det] fraud1 to tra9 anti-fraud pr(essionals1 or to educate ! public ab\t fraud1 includ+ insurance fraud1 securities fraud1 & f9ancial fraud1 to ! ext5t ! organization collects1 processes1 reta9s1 or transf]s cov]$ data 9 fur!rance ( su* prim>y mission4 7,d7 ,nonapplication to s]vice provid]s ,an entity may n be consid]$ to be a cov]$ entity = ! purposes ( ?is title1 ins(> z ! entity is act+ z a s]vice provid]4 7#ad7 ,cov]$ high-impact social m$ia company 7,a7 ,9 g5]al ,! t]m cov]$ high-impact social m$ia company means a cov]$ entity t provides any int]net-accessible plat=m t-- 7i7 g5]ates #c1jjj1jjj1jjj or m 9 global annual rev5ue1 includ+ ! rev5ue g5]at$ by any affiliate ( su* cov]$ entity2 7ii7 has #cjj1jjj1jjj or m global mon?ly active us]s = n few] ?an #c ( ! prec$+ #ab mon?s2 & 7iii7 con/itutes an onl9e product or s]vice t is prim>ily us$ by us]s to access or %>e us]-g5]at$ cont5t4 7,b7 ,treatm5t ( c]ta9 s]vices & applications ,a s]vice or application may n be consid]$ to con/itute an onl9e product or s]vice describ$ 9 subp>agraph 7,a77iii7 solely on ! basis ( provid+ any ( ! foll[+3 7i7 ,email4 7ii7 ,c>e] or pr(essional developm5t network+ opportunities4 7iii7 ,reviews ( products1 s]vices1 ev5ts1 or de/9ations4 7iv7 ,a plat=m = use 9 a public or private s*ool "u ! direction ( ! s*ool4 7v7 ,file collaboration4 7vi7 ,cl\d /orage4 7vii7 ,clos$ video or audio communications s]vices4 7viii7 ,a wireless messag+ s]vice1 includ+ su* a s]vice provid$ ?r\gh %ort messag+ s]vice or multim$ia messag+ s]vice protocols1 t is n a compon5t (1 or l9k$ to1 a plat=m ( a cov]$ high-impact social m$ia company1 if ! pr$om9ant or exclusive function is direct messag+ consi/+ ( ! transmission ( text1 photos1 or videos t are s5t by electronic means1 & if messages are transmitt$ f ! s5d] to a recipi5t & are n po/$ )9 a plat=m ( a cov]$ high-impact social m$ia company or publicly4 7#ae7 ,cov]$ m9or ,! t]m cov]$ m9or means an individual "u ! age ( #ag4 7#af7 ,d>k patt]ns ,! t]m d>k patt]ns means a us] int]face design$ or manipulat$ ) ! sub/antial effect ( subv]t+ or impair+ us] autonomy1 decision-mak+1 or *oice4 7#ag7 ,data brok] 7,a7 ,9 g5]al ,! t]m data brok] means a cov]$ entity ^: pr9cipal s\rce ( rev5ue is d]iv$ f process+ or transf]r+ cov]$ data t ! cov]$ entity did n collect directly f ! individuals l9k$ or l9kable to ! cov]$ data4 7,b7 ,pr9cipal s\rce ( rev5ue ,= purposes ( ?is p>agraph1 ! t]m pr9cipal s\rce ( rev5ue means1 = ! prior #ab-mon? p]iod-- 7i7 rev5ue t con/itutes great] ?an #ej p]c5t ( all rev5ue ( ! cov]$ entity dur+ su* p]iod2 or 7ii7 rev5ue obta9$ f process+ & transf]r+ ! cov]$ data ( m ?an #e1jjj1jjj individuals t ! cov]$ entity did n collect directly f ! individuals l9k$ or l9kable to ! cov]$ data4 7,c7 ,non-application to s]vice provid]s ,! t]m data brok] does n include an entity to ! ext5t t su* entity is act+ z a s]vice provid]4 7#ah7 ,de-id5tifi$ data 7,a7 ,9 g5]al ,! t]m de-id5tifi$ data means in=mation t _c reasonably be us$ to inf] or d]ive ! id5tity ( an individual1 & does n id5tify & is n l9k$ or reasonably l9kable to an individual or a device t id5tifies or is l9k$ or reasonably l9kable to an individual1 reg>dless ( :e!r ! in=mation is aggregat$1 if ! relevant cov]$ entity or s]vice provid]-- 7i7 takes reasonable physical1 adm9i/rative1 & te*nical measures to ensure t ! in=mation _c1 at any po9t1 be us$ to re-id5tify any individual or device t id5tifies or is l9k$ or reasonably l9kable to an individual2 7ii7 publicly commits 9 a cle> & conspicu\s mann] to-- 7,i7 process1 reta91 or transf] ! in=mation solely 9 a de-id5tifi$ =m )\t any reasonable means = re-id5tification2 & 7,,ii7 n attempt to re-id5tify ! in=mation ) any individual or device t id5tifies or is l9k$ or reasonably l9kable to an individual1 except z necess>y1 limit$1 & proportionate to te/ ! effectiv5ess ( ! measures describ$ 9 clause 7i72 & 7iii7 contractually obligates any entity t receives ! in=mation f ! cov]$ entity or s]vice provid] to-- 7,i7 comply ) clauses 7i7 & 7ii7 ) respect to ! in=mation2 & 7,,ii7 require t su* contractual obligations be includ$ contractually 9 all subsequ5t in/ances 9 :i* ! in=mation may be receiv$4 7,b7 ,heal? in=mation ,! t]m de-id5tifi$ data includes heal? in=mation 7z def9$ 9 section #aaga ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d77 t has be5 de-id5tifi$ 9 accordance ) section #afd4ead7;b7 ( title #de1 ,code ( ,f$]al ,regulations1 except t if su* in=mation is subsequ5tly provid$ to an entity t is n an entity subject to p>ts #afj & #afd ( su* title #de1 su* entity %all comply ) clauses 7ii7 & 7iii7 ( subp>agraph 7,a7 = ! in=mation to be consid]$ de-id5tifi$ "u ?is title4 7#ai7 ,d]iv$ data ,! t]m d]iv$ data means cov]$ data t is creat$ by ! d]ivation ( in=mation1 data1 assumptions1 correlations1 inf]5ces1 pr$ictions1 or conclusions f facts1 evid5ce1 or ano!r s\rce ( in=mation4 7#bj7 ,device ,! t]m device means any electronic equipm5t capable ( collect+1 process+1 reta9+1 or transf]r+ cov]$ data t is us$ by #a or m individuals1 includ+ a connect$ device or a portable connect$ device4 7#ba7 ,direct mail t>get$ adv]tis+ ,! t]m direct mail t>get$ adv]tis+ means adv]tis+ or m>ket+ us+ ?ird-p>ty data ?r\gh a direct communication ) an individual via direct mail4 7#bb7 ,disability ,! t]m disability has ! mean+ giv5 su* t]m 9 section #c ( ! ,am]icans ) ,disabilities ,act ( #aiij 7#db ,u4,s4,c4 #abajb74 7#bc7 ,email t>get$ adv]tis+ ,! t]m email t>get$ adv]tis+ means adv]tis+ or m>ket+ us+ ?ird-p>ty data ?r\gh a direct communication ) an individual via email4 7#bd7 ,employee ,! t]m employee means an individual :o is an employee1 director1 (fic]1 /aff memb]1 paid int]n1 individual work+ z an indep5d5t contractor 7:o is n a s]vice provid]71 volunte]1 or unpaid int]n ( an employ]1 reg>dless ( :e!r su* individual is paid1 unpaid1 or engag$ on a tempor>y basis4 7#be7 ,employee in=mation ,! t]m employee in=mation means in=mation1 includ+ biometric in=mation or g5etic in=mation-- 7,a7 ab\t an individual relat$ to ! c\rse ( employm5t or application = employm5t ( ! individual 7includ+ on a contract or tempor>y basis71 if su* in=mation is collect$1 reta9$1 process$1 or transf]r$ by ! employ] or ! s]vice provid] ( ! employ] solely = purposes necess>y = ! employm5t or application ( ! individual2 7,b7 t is em]g5cy contact in=mation = an individual :o is an employee or job applicant ( an employ]1 if su* in=mation is collect$1 reta9$1 process$1 or transf]r$ by ! employ] or ! s]vice provid] ( ! employ] solely = ! purpose ( hav+ an em]g5cy contact = su* individual on file2 or 7,c7 ab\t an individual :o is an employee or =m] employee ( an employ]1 or a relative1 dep5d5t1 or b5efici>y ( ! employee or =m] employee1 & collect$1 reta9$1 process$1 or transf]r$ = ! purpose ( adm9i/]+ b5efits1 includ+ enrollm5t & dis5rollm5t = b5efits1 to :i* ! employee1 =m] employee1 relative1 dep5d5t1 or b5efici>y is entitl$ on ! basis ( ! employm5t ( ! employee or =m] employee ) ! employ]1 if su* in=mation is collect$1 reta9$1 process$1 or transf]r$ by ! employ] or ! s]vice provid] ( ! employ] solely = ! purpose ( adm9i/]+ su* b5efits4 7#bf7 ,entity ,! t]m entity means an individual1 a tru/1 a p>tn]%ip1 an association1 an organization1 a company1 & a corporation4 7#bg7 ,executive ag5cy ,! t]m ,executive ag5cy has ! mean+ giv5 su* t]m 9 section #aje ( title #e1 ,unit$ ,/ates ,code4 7#bh7 ,f$]at$ nonpr(it organization ,! t]m f$]at$ nonpr(it organization means a network or sy/em ( #b or m entities1 describ$ 9 section #eja7;c77#c7 ( ! ,int]nal ,rev5ue ,code ( #aihf & exempt f taxation "u section #eja7;a7 ( su* ,code1 t %>e common br&+4 7#bi7 ,fir/ p>ty ,! t]m fir/ p>ty-- 7,a7 means a consum]-fac+ cov]$ entity ) :i* a consum] int5ds & expects to int]act2 & 7,b7 includes any entities ) :i* ! cov]$ entity %>es common br&+4 7#cj7 ,fir/-p>ty adv]tis+ 7,a7 ,9 g5]al ,! t]m fir/-p>ty adv]tis+ means adv]tis+ or m>ket+ by a fir/ p>ty us+ ! fir/-p>ty data ( ! fir/ p>ty & n o!r =ms ( cov]$ data & c>ri$ out-- 7i7 ?r\gh direct communications ) an individual1 su* z direct mail1 email 7subject to ! ,,c-,,spam ,act ( #bjjc 7#ae ,u4,s4,c4 #ggja et seq47 & ! regulations promulgat$ "u su* ,act71 or text message communications 7subject to section #bbg ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbg7 & ! regulations promulgat$ "u su* section72 or 7ii7 entirely-- 7,i7 9 a physical location op]at$ by ! fir/ p>ty2 7,,ii7 9 ! case ( a fir/ p>ty t is n a cov]$ high-impact social m$ia company1 on a website1 onl9e s]vice1 onl9e application1 or mobile application op]at$ by ! fir/ p>ty1 ?r\gh display or pres5tation ( an onl9e adv]tisem5t t promotes a product or s]vice 7:e!r (f]$ by ! fir/ p>ty or n (f]$ by ! fir/ p>ty7 to an individual or device id5tifi$ by a unique p]si/5t id5tifi]1 or gr\p ( individuals or devices id5tifi$ by unique p]si/5t id5tifi]s2 or 7,,iii7 9 ! case ( a fir/ p>ty t is a cov]$ high-impact social m$ia company1 on a website1 onl9e s]vice1 onl9e application1 or mobile application op]at$ by ! fir/ p>ty1 ?r\gh display or pres5tation ( an onl9e adv]tisem5t t promotes a product or s]vice (f]$ by ! fir/ p>ty to an individual or device id5tifi$ by a unique p]si/5t id5tifi]1 or gr\p ( individuals or devices id5tifi$ by unique p]si/5t id5tifi]s4 7,b7 ,exclusion ,! t]m fir/-p>ty adv]tis+ does n include contextual adv]tis+4 7#ca7 ,fir/-p>ty data ,! t]m fir/-p>ty data means cov]$ data collect$ directly f an individual by a fir/ p>ty1 includ+ bas$ on a visit by ! individual to or use by ! individual ( a physical location1 website1 onl9e s]vice1 onl9e application1 or mobile application op]at$ by ! fir/ p>ty4 7#cb7 ,g5etic in=mation ,! t]m g5etic in=mation means any cov]$ data1 reg>dless ( =mat1 t conc]ns ! g5etic *>act]i/ics ( an id5tifi$ or id5tifiable individual1 includ+-- 7,a7 raw sequ5ce data t results f ! sequ5c+ ( ! complete1 or a portion (1 extract$ deoxyribonucleic acid 7,,dna7 ( an individual2 or 7,b7 g5otypic & ph5otypic in=mation t results f analyz+ raw sequ5ce data describ$ 9 subp>agraph 7,a74 7#cc7 ,heal? in=mation ,! t]m heal? in=mation means in=mation t describes or reveals ! pa/1 pres5t1 or future physical heal?1 m5tal heal?1 disability1 diagnosis1 or heal? condition1 /atus1 or treatm5t ( an individual1 includ+ ! precise geolocation in=mation ( su* treatm5t4 7#cd7 ,individual ,! t]m individual means a natural p]son resid+ 9 ! ,unit$ ,/ates4 7#ce7 ,k 7,a7 ,9 g5]al ,! t]m k means1 ) respect to :e!r an individual is a *ild1 te51 or cov]$ m9or1 actual k or k fairly impli$ on ! basis ( objective circum/ances4 7,b7 ,rule ( con/ruction ,= purposes ( en=c+ ?is title or a regulation promulgat$ "u ?is title1 a det]m9ation z to :e!r a cov]$ entity has k fairly impli$ on ! basis ( objective circum/ances t an individual is a *ild1 te51 or cov]$ m9or %all rely on compet5t & reliable evid5ce1 tak+ into acc\nt ! totality ( ! circum/ances1 includ+ :e!r a reasonable & prud5t p]son "u ! circum/ances w\ld h kn[n t ! individual is a *ild1 te51 or cov]$ m9or4 ,no?+ 9 ?is title1 includ+ a det]m9ation describ$ 9 ! prec$+ s5t5ce1 may be con/ru$ to require a cov]$ entity to-- 7i7 affirmatively collect any cov]$ data ) respect to ! age ( a *ild1 te51 or cov]$ m9or t ! cov]$ entity is n already collect+ 9 ! normal c\rse ( bus9ess2 or 7ii7 implem5t an age gat+ or age v]ification functionality4 7,c7 ,commission guidance 7i7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all issue guidance to provide in=mation1 includ+ be/ practices & examples1 = cov]$ entities to use 9 und]/&+ :e!r a cov]$ entity has k fairly impli$ on ! basis ( objective circum/ances t an individual is a *ild1 te51 or cov]$ m9or4 7ii7 ,limitation ,no guidance issu$ by ! ,commission "u clause 7i7 conf]s any rights on any p]son1 ,/ate1 or locality1 or op]ates to b9d ! ,commission or any p]son1 ,/ate1 or locality to ! approa* recomm5d$ 9 su* guidance4 ,any en=cem5t action br\ght pursuant to ?is title by ! ,commission1 or by ! attorney g5]al ( a ,/ate1 ! *ief consum] protection (fic] ( a ,/ate1 or an (fic] or (fice ( a ,/ate au?oriz$ to en=ce privacy or data security laws applicable to cov]$ entities or s]vice provid]s1 %all allege a specific violation ( a provision ( ?is title1 & ! ,commission or ! attorney g5]al1 *ief consum] protection (fic]1 or o!r au?oriz$ (fic] or (fice ( ! ,/ate1 z applicable1 may n base an en=cem5t action on1 or z applicable execute a cons5t ord] bas$ on1 practices t are alleg$ to be inconsi/5t ) any su* guidance1 unless ! practices alleg$ly violate ?is title4 7#cf7 ,l>ge data hold] 7,a7 ,9 g5]al ,! t]m l>ge data hold] means a cov]$ entity or s]vice provid] t1 9 ! mo/ rec5t cal5d> ye>1 _h an annual gross rev5ue ( n less ?an #bej1jjj1jjj &1 subject to subp>agraph 7,b71 collect$1 process$1 reta9$1 or transf]r$-- 7i7 ! cov]$ data (-- 7,i7 m ?an #e1jjj1jjj individuals2 7,,ii7 m ?an #ae1jjj1jjj portable connect$ devices t id5tify or are l9k$ or reasonably l9kable to #a or m individuals2 or 7,,iii7 m ?an #ce1jjj1jjj connect$ devices t id5tify or are l9k$ or reasonable l9kable to #a or m individuals2 or 7ii7 ! s5sitive cov]$ data (-- 7,i7 m ?an #bjj1jjj individuals2 7,,ii7 m ?an #cjj1jjj portable connect$ devices t id5tify or are l9k$ or reasonable l9kable to #a or m individuals2 or 7,,iii7 m ?an #gjj1jjj connect$ devices t id5tify or are l9k$ or reasonably l9kable to #a or m individuals4 7,b7 ,exclusions ,= ! purposes ( subp>agraph 7,a71 a cov]$ entity or s]vice provid] may n be consid]$ a l>ge data hold] solely on ! basis ( collect+1 process+1 reta9+1 or transf]r+ to a s]vice provid]-- 7i7 p]sonal mail+ or email addresses2 7ii7 p]sonal telephone numb]s2 7iii7 log-9 in=mation ( an individual or device to all[ ! individual or device to log 9 to an acc\nt adm9i/]$ by ! cov]$ entity2 or 7iv7 9 ! case ( a cov]$ entity t is a sell] ( goods or s]vices 7o!r ?an an entity t facilitates paym5t1 su* z a bank1 cr$it c>d processor1 mobile paym5t sy/em1 or paym5t plat=m71 cr$it1 debit1 or mobile paym5t in=mation necess>y & us$ to initiate1 r5d]1 bill =1 f9alize1 complete1 or o!rwise facilitate paym5ts = su* goods or s]vices4 7,c7 ,def9ition ( annual gross rev5ue ,= ! purposes ( subp>agraph 7,a71 ! t]m annual gross rev5ue1 ) respect to a cov]$ entity or s]vice provid]-- 7i7 means ! gross receipts ! cov]$ entity or s]vice provid] receiv$1 9 :atev] =m f all s\rces1 )\t subtract+ any co/s or exp5ses2 & 7ii7 includes contributions1 gifts1 grants1 dues or o!r assessm5ts1 income f inve/m5ts1 & proce$s f ! sale ( real or p]sonal prop]ty4 7#cg7 ,m>ket rese>* ,! t]m m>ket rese>* means ! collection1 process+1 ret5tion1 or transf] ( cov]$ data1 ) affirmative express cons5t1 t is necess>y1 proportionate1 & limit$ to measure & analyze ! m>ket or m>ket tr5ds ( products1 s]vices1 adv]tis+1 or ideas1 if ! cov]$ data is n-- 7,a7 integrat$ into any product or s]vice2 7,b7 o!rwise us$ to contact any individual or device ( an individual2 or 7,c7 us$ = t>get$ adv]tis+ or to o!rwise m>ket to any individual or device ( an individual4 7#ch7 ,mat]ial *ange ,! t]m mat]ial *ange means1 ) respect to treatm5t ( cov]$ data1 a *ange by an entity t w\ld likely affect ! decision ( an individual to engage ) & provide cov]$ data to ! entity1 includ+ provid+ affirmative express cons5t =1 or opt+ out (1 ! collection1 process+1 ret5tion1 or transf] ( cov]$ data p]ta9+ to su* individual4 7#ci7 ,mobile application ,! t]m mobile application-- 7,a7 means a s(tw>e program t runs on ! op]at+ sy/em (-- 7i7 a cellul> telephone2 7ii7 a tablet comput]2 or 7iii7 a simil> portable comput+ device t transmits data ov] a wireless connection2 & 7,b7 includes a s]vice or application (f]$ via a connect$ device4 7#dj7 ,on-device data 7,a7 ,9 g5]al ,! t]m on-device data means data collect$1 reta9$1 & process$ solely on ! device ( an individual4 7,b7 ,limitation ,data collect$1 reta9$1 & process$ solely on ! device ( an individual may be consid]$ on-device data only if-- 7i7 su* data is n transf]r$ by a cov]$ entity or s]vice provid]2 7ii7 ! relevant cov]$ entity cle>ly & conspicu\sly provides ! device own] ) controls t all[ ! own] to access1 correct1 delete1 & export su* data consi/5t ) ! rights provid$ ) respect to cov]$ data pursuant to section #aje2 7iii7 ! relevant cov]$ entity provides easy-to-und]/& in/ructions on h[ ! device own] c access su* controls2 & 7iv7 ! relevant cov]$ entity e/abli%es1 implem5ts1 & ma9ta9s reasonable data security practices1 consi/5t ) section #aji1 to protect-- 7,i7 ! confid5tiality1 integrity1 & availability ( ! on-device data2 & 7,,ii7 on device data aga9/ unau?oriz$ access4 7#da7 ,onl9e activity pr(ile ,! t]m onl9e activity pr(ile means cov]$ data t id5tifies ! onl9e activities ( an individual 7or a device l9k$ or reasonably l9kable to an individual7 ov] "t & across ?ird-p>ty websites1 onl9e s]vices1 onl9e applications1 or mobile applications t d n %>e common br&+ & t is collect$1 process$1 reta9$1 or transf]r$ = ! purpose ( evaluat+1 analyz+1 or pr$ict+ ! behaviors or *>act]i/ics ( an individual4 7#db7 ,onl9e application ,! t]m onl9e application-- 7,a7 means an int]net-connect$ s(tw>e program2 & 7,b7 includes a s]vice or application (f]$ via a connect$ device4 7#dc7 ,p>5t ,! t]m p>5t means a legal gu>dian4 7#dd7 ,portable connect$ device ,! t]m portable connect$ device means a portable device t is capable ( connect+ to ! int]net ov] a wireless connection1 includ+ a sm>tphone1 tablet comput]1 laptop comput]1 sm>twat*1 or simil> portable device4 7#de7 ,precise geolocation in=mation 7,a7 ,9 g5]al ,! t]m precise geolocation in=mation means in=mation t reveals ! pa/ or pres5t physical location ( an individual or device ) suffici5t precision to id5tify ! location ( su* individual or device )9 a geographic area t is equal to or less ?an ! area ( a circle ) a radius ( #a1hej feet or less4 7,b7 ,exclusions ,! t]m precise geolocation in=mation does n include in=mation d]iv$ solely f-- 7i7 a digital or physical photograph2 7ii7 an audio or visual record+2 or 7iii7 metadata associat$ ) a digital or physical photograph or an audio or visual record+ t _c be l9k$ to an individual4 7#df7 ,process ,! t]m process means1 ) respect to cov]$ data1 any op]ation or set ( op]ations p]=m$ on ! cov]$ data1 includ+ analyz+1 organiz+1 /ructur+1 us+1 modify+1 or o!rwise h&l+ ! cov]$ data4 7#dg7 ,publicly available in=mation 7,a7 ,9 g5]al ,! t]m publicly available in=mation means any in=mation t a cov]$ entity has a reasonable basis to believe has be5 lawfully made available to ! g5]al public by-- 7i7 ,f$]al1 ,/ate1 or local gov]nm5t records1 if ! cov]$ entity collects1 processes1 reta9s1 & transf]s su* in=mation 9 accordance ) any re/rictions or t]ms ( use plac$ on ! in=mation by ! relevant gov]nm5t entity2 7ii7 widely di/ribut$ m$ia2 7iii7 a website or onl9e s]vice made available to all memb]s ( ! public1 = free or = a fee1 includ+ :]e all memb]s ( ! public c log 9 to ! website or onl9e s]vice2 or 7iv7 a disclosure to ! g5]al public t is requir$ to be made by ,f$]al1 ,/ate1 or local law4 7,b7 ,cl>ifications2 limitations 7i7 ,available to all memb]s ( ! public ,= purposes ( ?is p>agraph1 in=mation f a website or onl9e s]vice is n available to all memb]s ( ! public if ! individual to :om ! in=mation p]ta9s has re/rict$ ! in=mation to a specific audi5ce or ma9ta9$ a default sett+ t re/ricts ! in=mation to a specific audi5ce4 7ii7 ,bus9ess contact in=mation ,! t]m publicly available in=mation includes bus9ess contact in=mation ( an individual act+ 9 a bus9ess or pr(essional context t is made available on a website or onl9e s]vice made available to all memb]s ( ! public1 includ+ ! "n1 position or title1 bus9ess telephone numb]1 bus9ess email address1 or bus9ess address ( ! individual4 7iii7 ,o!r limitations ,! t]m publicly available in=mation does n include-- 7,i7 any obsc5e visual depiction 7z su* t]m is us$ 9 section #adfj ( title #ah1 ,unit$ ,/ates ,code72 7,,ii7 d]iv$ data f publicly available in=mation t reveals in=mation ab\t an individual t meets ! def9ition ( ! t]m s5sitive cov]$ data2 7,,iii7 biometric in=mation2 7,,iv7 g5etic in=mation1 unless made publicly available by ! individual to :om ! in=mation p]ta9s by a means describ$ 9 clause 7ii7 or 7iii7 ( subp>agraph 7,a72 7,v7 cov]$ data t is creat$ ?r\gh ! comb9ation ( cov]$ data ) publicly available in=mation2 7,,vi7 intimate images1 au!ntic or comput]-g5]at$1 kn[n to be noncons5sual2 or 7,,vii7 s5sitive cov]$ data made available by a data brok]4 7#dh7 ,reta9 ,! t]m reta9 means1 ) respect to cov]$ data1 to /ore1 ma9ta91 save1 or o!rwise keep su* data1 reg>dless ( =mat4 7#di7 ,s5sitive cov]$ data 7,a7 ,9 g5]al ,! t]m s5sitive cov]$ data means ! foll[+ =ms ( cov]$ data3 7i7 ,a gov]nm5t-issu$ id5tifi]1 includ+ a ,social ,security numb]1 passport numb]1 or driv]'s lic5se numb]1 t is n requir$ by law to be display$ 9 public4 7ii7 ,any in=mation t describes or reveals ! pa/1 pres5t1 or future physical heal?1 m5tal heal?1 disability1 diagnosis1 or heal? condition1 /atus1 or treatm5t ( an individual4 7iii7 ,g5etic in=mation4 7iv7 ,a f9ancial acc\nt numb]1 debit c>d numb]1 cr$it c>d numb]1 or any requir$ security or access code1 password1 or cr$5tials all[+ access to any su* acc\nt or c>d1 except t ! la/ f\r digits ( an acc\nt numb]1 debit c>d numb]1 or cr$it c>d numb] may n be consid]$ s5sitive cov]$ data4 7v7 ,biometric in=mation4 7vi7 ,precise geolocation in=mation4 7vii7 ,! private communications ( an individual 7su* z voicemails1 or o!r voice or video communications1 emails1 texts1 direct messages1 or mail7 or in=mation id5tify+ ! p>ties to su* communications1 in=mation conta9$ 9 telephone bills1 & any in=mation t p]ta9s to ! transmission ( private voice or video communications1 includ+ numb]s call$1 numb]s f :i* calls 7 plac$1 ! "t calls 7 made1 call duration1 & location in=mation ( ! p>ties to ! call1 unless ! relevant cov]$ entity or s]vice provid] is an int5d$ recipi5t ( ! communication4 7viii7 ,un5crypt$ or unr$act$ acc\nt or device log-9 cr$5tials4 7ix7 ,in=mation reveal+ ! sexual behavior ( an individual 9 a mann] inconsi/5t ) ! reasonable expectation ( ! individual reg>d+ disclosure ( su* in=mation4 7x7 ,cal5d> in=mation1 address book in=mation1 phone1 text1 or electronic logs1 photographs1 audio record+s1 or videos int5d$ = private use4 7xi7 ,a photograph1 film1 video record+1 or o!r simil> m$ium t %[s ! nak$ or und]g>m5t-clad private area ( an individual4 7xii7 ,in=mation reveal+ ! ext5t or cont5t ( ! access1 view+1 or o!r use by an individual ( any video programm+ 7z def9$ 9 section #gac7;h77#b7 ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #fac7;h77#b7771 includ+ programm+ provid$ by a provid] ( broadca/ television s]vice1 cable s]vice1 satellite s]vice1 or /ream+ m$ia s]vice1 b only ) reg>d to ! transf] ( su* in=mation to a ?ird p>ty 7exclud+ any su* in=mation us$ solely = transf]s = indep5d5t video measurem5t74 7xiii7 ,in=mation collect$ by a cov]$ entity t is n a provid] ( a s]vice describ$ 9 clause 7xii7 t reveals ! video cont5t reque/$ or select$ by an individual 7exclud+ any su* in=mation us$ solely = transf]s = indep5d5t video measurem5t74 7xiv7 ,in=mation reveal+ ! race1 e?nicity1 national orig91 religion1 or sex ( an individual 9 a mann] inconsi/5t ) ! reasonable expectation ( ! individual reg>d+ disclosure ( su* in=mation4 7xv7 ,an onl9e activity pr(ile4 7xvi7 ,in=mation ab\t a cov]$ m9or4 7xvii7 ,in=mation t reveals ! /atus ( an individual z a memb] ( ! ,arm$ ,=ces4 7xviii7 ,neural data4 7xix7 ,any o!r cov]$ data collect$1 process$1 reta9$1 or transf]r$ = ! purpose ( id5tify+ a type ( in=mation describ$ 9 any ( clauses 7i7 ?r\gh 7xviii74 7,b7 ,?ird p>ty ,= ! purposes ( subp>agraph 7,a77xii71 ! t]m ?ird p>ty does n include an entity t-- 7i7 is relat$ by common own]%ip or corporate control to ! provid] ( broadca/ television s]vice or /ream+ m$ia s]vice2 & 7ii7 provides video programm+ z describ$ 9 su* subp>agraph4 7#ej7 ,s]vice provid] 7,a7 ,9 g5]al ,! t]m s]vice provid] means an entity t collects1 processes1 reta9s1 or transf]s cov]$ data = ! purpose ( p]=m+ #a or m s]vices or functions on behalf (1 & at ! direction (-- 7i7 a cov]$ entity or ano!r s]vice provid]2 or 7ii7 a ,f$]al1 ,/ate1 ,tribal1 or local gov]nm5t entity4 7,b7 ,rule ( con/ruction 7i7 ,9 g5]al ,an entity is a cov]$ entity & n a s]vice provid] ) respect to a specific collect+1 process+1 reta9+1 or transf]r+ ( cov]$ data1 if ! entity1 alone or jo9tly ) o!rs1 det]m9es ! purposes & means ( ! specific collect+1 process+1 reta9+1 or transf]r+ ( data4 7ii7 ,in/ructions ,an entity t is n limit$ 9 its collect+1 process+1 reta9+1 or transf]r+ ( cov]$ data pursuant to ! in/ructions ( a cov]$ entity1 ano!r s]vice provid]1 or a ,f$]al1 ,/ate1 ,tribal1 or local gov]nm5t entity1 or t fails to adh]e to su* in/ructions1 is a cov]$ entity & n a s]vice provid] ) respect to a specific collect+1 process+1 reta9+1 or transf]r+ ( su* data4 ,if a s]vice provid] beg9s1 alone or jo9tly ) o!rs1 det]m9+ ! purposes & means ( collect+1 process+1 reta9+1 or transf]r+ cov]$ data1 ! entity is a cov]$ entity ) respect to su* data4 7iii7 ,context requir$ ,:e!r an entity is a cov]$ entity or a s]vice provid] dep5ds on ! facts surr\nd+ h[1 & ! context 9 :i*1 data is collect$1 process$1 reta9$1 or transf]r$4 7#ea7 ,small bus9ess 7,a7 ,9 g5]al ,! t]m small bus9ess means an entity 7includ+ any affiliate ( ! entity7-- 7i7 t has av]age annual gross rev5ues = ! p]iod ( ! #c prec$+ cal5d> ye>s 7or = ! p]iod dur+ :i* ! entity has be5 9 exi/5ce1 if su* p]iod is less ?an #c cal5d> ye>s7 n exce$+ #dj1jjj1jjj1 index$ to ! ,produc] ,price ,index report$ by ! ,bureau ( ,labor ,/ati/ics2 7ii7 t1 on av]age = ! p]iod describ$ 9 clause 7i71 did n annually collect1 process1 reta91 or transf] ! cov]$ data ( m ?an #bjj1jjj individuals = any purpose o!r ?an initiat+1 r5d]+1 bill+ =1 f9aliz+1 complet+1 or o!rwise collect+ paym5t = a reque/$ s]vice or product2 & 7iii7 t did n1 dur+ ! p]iod describ$ 9 clause 7i71 transf] cov]$ data to a ?ird p>ty 9 ex*ange = rev5ue or any?+ ( value1 except = purposes ( initiat+1 r5d]+1 bill+ =1 f9aliz+1 complet+1 or o!rwise collect+ paym5t = a reque/$ s]vice or product or facilitat+ web analytics t are n us$ to create an onl9e activity pr(ile4 7,b7 ,nonpr(it rev5ue ,= purposes ( subp>agraph 7,a77i71 ! t]m rev5ue1 z su* t]m relates to any entity t is n organiz$ to c>ry on bus9ess = its own pr(it or t ( its memb]s1 means ! gross receipts ! entity receiv$1 9 :atev] =m f all s\rces1 )\t subtract+ any co/s or exp5ses1 & includes contributions1 gifts1 grants 7except = grants f ! ,f$]al ,gov]nm5t71 dues or o!r assessm5ts1 income f inve/m5ts1 or proce$s f ! sale ( real or p]sonal prop]ty4 7#eb7 ,/ate ,! t]m ,/ate means ea* ( ! #ej ,/ates1 ! ,di/rict ( ,columbia1 ! ,commonweal? ( ,pu]to ,rico1 ! ,virg9 ,isl&s ( ! ,unit$ ,/ates1 ,guam1 ,am]ican ,samoa1 & ! ,commonweal? ( ! ,nor!rn ,m>iana ,isl&s4 7#ec7 ,sub/antial privacy h>m ,! t]m sub/antial privacy h>m means-- 7,a7 any alleg$ f9ancial h>m ( n less ?an #aj1jjj2 or 7,b7 any alleg$ physical or m5tal h>m to an individual t involves-- 7i7 treatm5t by a lic5s$1 cr$5tial$1 or o!rwise bona fide heal? c>e provid]1 hospital1 community heal? c5t]1 cl9ic1 hospice1 or resid5tial or outpati5t facility = m$ical1 m5tal heal?1 or addiction c>e2 or 7ii7 physical injury1 highly (f5sive intrusion into ! privacy expectations ( a reasonable individual "u ! circum/ances1 or discrim9ation on ! basis ( race1 color1 religion1 national orig91 sex1 or disability4 7#ed7 ,t>get$ adv]tis+ ,! t]m t>get$ adv]tis+-- 7,a7 means display+ or pres5t+ an onl9e adv]tisem5t to an individual or to a device id5tifi$ by a unique p]si/5t id5tifi] 7or to a gr\p ( individuals or devices id5tifi$ by unique p]si/5t id5tifi]s71 if ! adv]tisem5t is select$ bas$1 9 :ole or 9 "p1 on kn[n or pr$ict$ pref]5ces or int]e/s associat$ ) ! individual or device2 7,b7 includes-- 7i7 an onl9e adv]tisem5t by a cov]$ high-impact social m$ia company = a product or s]vice t is n a product or s]vice (f]$ by ! cov]$ high-impact social m$ia company2 & 7ii7 an onl9e adv]tisem5t = a product or s]vice bas$ on ! previ\s int]action ( an individual or a device id5tifi$ by a unique p]si/5t id5tifi] ) su* product or s]vice on a website or onl9e s]vice t does n %>e common br&+ or affiliation ) ! website or onl9e s]vice display+ or pres5t+ ! adv]tisem5t2 & 7,c7 excludes contextual adv]tis+ & fir/-p>ty adv]tis+4 7#ee7 ,te5 ,! t]m te5 means an individual #ac ye>s ( age or old]1 b "u ! age ( #ag4 7#ef7 ,?ird p>ty ,! t]m ?ird p>ty-- 7,a7 means any entity t-- 7i7 receives cov]$ data f ano!r entity t is n ! individual to :om ! data p]ta9s2 & 7ii7 is n a s]vice provid] ) respect to su* data2 & 7,b7 does n include an entity t collects cov]$ data f ano!r entity if ! #b entities are-- 7i7 relat$ by common own]%ip or corporate control2 or 7ii7 nonpr(it entities t are "p ( ! same f$]at$ nonpr(it organization4 7#eg7 ,?ird-p>ty data ,! t]m ?ird-p>ty data means cov]$ data t has be5 transf]r$ to a ?ird p>ty4 7#eh7 ,transf] ,! t]m transf] means1 ) respect to cov]$ data1 to disclose1 release1 %>e1 dissem9ate1 make available1 sell1 r5t1 or lic5se ! cov]$ data 7orally1 9 writ+1 electronically1 or by any o!r means7 = consid]ation ( any k9d or = a comm]cial purpose4 7#ei7 ,unique p]si/5t id5tifi] 7,a7 ,9 g5]al ,! t]m unique p]si/5t id5tifi] means a te*nologically creat$ id5tifi] to ! ext5t t su* id5tifi] is reasonably l9kable to an individual or a device t id5tifies or is l9k$ or reasonably l9kable to #a or m individuals1 includ+ device id5tifi]s1 ,int]net ,protocol addresses1 cookies1 beacons1 pixel tags1 mobile ad id5tifi]s or simil> te*nology cu/om] numb]s1 unique pseudonyms1 us] aliases1 telephone numb]s1 or o!r =ms ( p]si/5t or probabili/ic id5tifi]s t are l9k$ or reasonably l9kable to #a or m individuals or devices4 7,b7 ,exclusion ,! t]m unique p]si/5t id5tifi] does n include an id5tifi] assign$ by a cov]$ entity = ! sole purpose ( giv+ effect to ! ex]cise ( affirmative express cons5t or opt out by an individual ) respect to ! collect+1 process+1 reta9+1 & transf] ( cov]$ data or o!rwise limit+ ! collect+1 process+1 reta9+1 or transf] ( cov]$ data4 7#fj7 ,widely di/ribut$ m$ia 7,a7 ,9 g5]al ,! t]m widely di/ribut$ m$ia means in=mation t is available to ! g5]al public1 includ+ in=mation f a telephone book or onl9e directory1 a television1 int]net1 or radio program1 ! news m$ia1 or an int]net site t is available to ! g5]al public on an unre/rict$ basis4 7,b7 ,exclusion ,! t]m widely di/ribut$ m$ia does n include an obsc5e visual depiction 7z su* t]m is us$ 9 section #adfj ( title #ah1 ,unit$ ,/ates ,code74 #ajb4 ,data m9imization 7a7 ,9 g5]al ,a cov]$ entity may n collect1 process1 reta91 or transf] cov]$ data ( an individual or direct a s]vice provid] to collect1 process1 reta91 or transf] cov]$ data ( an individual beyond :at is necess>y1 proportionate1 & limit$-- 7#a7 to provide or ma9ta9-- 7,a7 a specific product or s]vice reque/$ by ! individual to :om ! data p]ta9s1 includ+ any associat$ r\t9e adm9i/rative1 op]ational1 or acc\nt-s]vic+ activity1 su* z bill+1 %ipp+1 deliv]y1 /orage1 or acc\nt+2 or 7,b7 a communication1 t is n an adv]tisem5t1 by ! cov]$ entity to ! individual reasonably anticipat$ )9 ! context ( ! relation%ip2 or 7#b7 = a purpose expressly p]mitt$ "u subsection 7d74 7b7 ,additional protections = s5sitive cov]$ data ,subject to subsection 7a71 a cov]$ entity may n transf] s5sitive cov]$ data to a ?ird p>ty or direct a s]vice provid] to transf] s5sitive cov]$ data to a ?ird p>ty )\t ! affirmative express cons5t ( ! individual to :om su* data p]ta9s1 unless = a purpose p]mitt$ by p>agraph 7#b71 7#c71 7#d71 7#e71 7#f71 7#h71 7#i71 7#aa71 7#ab71 or 7#ac7 ( subsection 7d74 7c7 ,additional protections = biometric in=mation & g5etic in=mation 7#a7 ,collection ,subject to subsection 7a71 a cov]$ entity may n collect biometric in=mation or g5etic in=mation or direct a s]vice provid] to collect biometric in=mation or g5etic in=mation )\t ! affirmative express cons5t ( ! individual to :om su* in=mation p]ta9s4 7#b7 ,process+ ,subject to subsection 7a71 a cov]$ entity may n process biometric in=mation or g5etic in=mation or direct a s]vice provid] to process biometric in=mation or g5etic in=mation )\t ! affirmative express cons5t ( ! individual to :om su* in=mation p]ta9s1 unless = a purpose p]mitt$ by p>agraph 7#b71 7#c71 or 7#d7 ( subsection 7d74 7#c7 ,ret5tion ,subject to subsection 7a71 a cov]$ entity may n reta9 biometric in=mation or direct a s]vice provid] to reta9 biometric in=mation beyond ! po9t at :i* ! purpose = :i* an individual provid$ affirmative express cons5t "u p>agraph 7#a7 has be5 satisfi$ or beyond ! date t is #c ye>s aft] ! date ( ! la/ int]action ( ! individual ) ! cov]$ entity or s]vice provid]1 :i*ev] occurs fir/1 unless = a purpose p]mitt$ "u p>agraph 7#b71 7#c71 or 7#d7 ( subsection 7d74 7#d7 ,transf] 7,a7 ,affirmative express cons5t requir$ ,subject to subsection 7a71 a cov]$ entity may n transf] biometric in=mation or g5etic in=mation to a ?ird p>ty or direct a s]vice provid] to transf] biometric in=mation or g5etic in=mation to a ?ird p>ty )\t ! affirmative express cons5t ( ! individual to :om su* in=mation p]ta9s1 unless = a purpose p]mitt$ by p>agraph 7#b71 7#c71 or 7#d7 ( subsection 7d74 7,b7 ,no transf] = paym5t or o!r valuable consid]ation ,a cov]$ entity may n transf] biometric in=mation or g5etic in=mation to a ?ird p>ty1 or direct a s]vice provid] to transf] biometric in=mation or g5etic in=mation to a ?ird p>ty1 = paym5t or o!r valuable consid]ation 7reg>dless ( ! purpose ( ! transf]1 includ+ a purpose describ$ 9 subp>agraph 7,a774 7d7 ,p]mitt$ purposes ,subject to ! requirem5ts 9 subsections 7b7 & 7c71 a cov]$ entity may collect1 process1 reta91 or transf] or direct a s]vice provid] to collect1 process1 reta91 or transf] cov]$ data = ! foll[+ purposes1 if ! cov]$ entity or s]vice provid] c demon/rate t ! collection1 process+1 ret5tion1 or transf] is necess>y1 proportionate1 & limit$ to su* purpose3 7#a7 ,to protect data security z describ$ 9 section #aji1 protect aga9/ spam1 or protect & ma9ta9 networks & sy/ems1 includ+ ?r\gh diagno/ics1 debugg+1 & repairs4 7#b7 ,to comply ) a legal obligation impos$ by a ,f$]al1 ,/ate1 ,tribal1 or local law t is n preempt$ by ?is title4 7#c7 ,to inve/igate1 e/abli%1 prep>e =1 ex]cise1 or def5d cognizable legal claims ( ! cov]$ entity or s]vice provid]4 7#d7 ,to transf] cov]$ data to a ,f$]al1 ,/ate1 ,tribal1 or local law en=cem5t ag5cy pursuant to a lawful w>rant1 adm9i/rative subpo5a1 or o!r =m ( lawful process4 7#e7 ,to effectuate a product recall pursuant to ,f$]al or ,/ate law1 or to fulfill a w>ranty4 7#f7 ,to conduct m>ket rese>*4 7#g7 ,) respect to cov]$ data previ\sly collect$ 9 accordance ) ?is title1 to process ! cov]$ data su* t ! cov]$ data becomes de-id5tifi$ data1 includ+ 9 ord] to-- 7,a7 develop or enhance a product or s]vice ( ! cov]$ entity or s]vice provid]2 7,b7 conduct rese>* or analytics to improve a product or s]vice ( ! cov]$ entity or s]vice provid]2 7,c7 conduct rese>* to inve/igate1 e/abli%1 or improve ! effectiv5ess or safety ( m$ical products1 includ+ drugs1 biologics1 & m$ical devices2 7,d7 enable ! effective deliv]y & adm9i/ration ( heal? c>e products & treatm5ts to pati5ts1 9 compliance ) ,f$]al regulations2 or 7,e7 monitor ! safety & efficacy ( heal? c>e products & s]vices adm9i/]$ to pati5ts1 9 compliance ) ,f$]al regulations4 7#h7 ,to transf] assets to a ?ird p>ty 9 ! context ( a m]g]1 acquisition1 bankruptcy1 or simil> transaction1 ) respect to :i* ! ?ird p>ty assumes control1 9 :ole or 9 "p1 ( ! assets ( ! cov]$ entity1 b only if ! cov]$ entity1 9 a reasonable "t prior to su* transf]1 provides ea* affect$ individual )-- 7,a7 a notice describ+ su* transf]1 includ+ ! "n ( ! entity or entities receiv+ ! cov]$ data ( ! individual & ! privacy policies ( su* entity or entities z describ$ 9 section #ajd2 & 7,b7 a reasonable opportunity to-- 7i7 )draw any previ\sly provid$ cons5t 9 accordance ) ! requirem5ts ( affirmative express cons5t "u ?is title relat$ to ! cov]$ data ( ! individual2 & 7ii7 reque/ ! deletion ( ! cov]$ data ( ! individual1 z describ$ 9 section #aje4 7#i7 ,) respect to a cov]$ entity or s]vice provid] t is a telecommunications c>ri] or a provid] ( a mobile s]vice1 int]connect$ ,vo,i,p s]vice1 or non-int]connect$ ,vo,i,p s]vice 7z su* t]ms are def9$ 9 section #c ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aec771 to provide call location in=mation 9 a mann] describ$ 9 subp>agraph 7,a7 or 7,c7 ( section #bbb7;d77#d7 ( su* ,act 7#dg ,u4,s4,c4 #bbb7;d77#d774 7#aj7 ,to prev5t1 detect1 protect aga9/1 inve/igate1 or respond to fraud1 exclud+ ! transf] ( cov]$ data = paym5t or o!r valuable consid]ation to a gov]nm5t entity4 7#aa7 ,to prev5t1 detect1 protect aga9/1 inve/igate1 or respond to an ongo+ or imm95t security incid5t relat+ to network security or physical security1 includ+ an intrusion or trespass1 m$ical al]t or reque/ = a m$ical response1 fire al>m or reque/ = a fire response1 or access control4 7#ab7 ,to prev5t1 detect1 protect aga9/1 inve/igate1 or respond to an imm95t or ongo+ public safety incid5t 7su* z a mass casualty ev5t1 natural disa/]1 or national security incid5t71 exclud+ ! transf] ( cov]$ data = paym5t or o!r valuable consid]ation to a gov]nm5t entity4 7#ac7 ,except ) respect to heal? in=mation1 to prev5t1 detect1 protect aga9/1 inve/igate1 or respond to crim9al activity or h>assm5t1 exclud+ ! transf] ( cov]$ data = paym5t or o!r valuable consid]ation to a gov]nm5t entity4 7#ad7 ,except ) respect to s5sitive cov]$ data1 & only ) respect to cov]$ data previ\sly collect$ 9 accordance ) ?is title1 to process or transf] su* data to provide fir/-p>ty adv]tis+ or contextual adv]tis+ or to measure & report on m>ket+ p]=mance or m$ia p]=mance by ! cov]$ entity1 includ+ process+ or transf]r+ cov]$ data = measurem5t & report+ ( frequ5cy1 attribution1 & p]=mance1 includ+ by indep5d5t entities1 except t ?is p>agraph does n p]mit ! process+ or transf] ( cov]$ data = fir/-p>ty adv]tis+ to a cov]$ m9or z prohibit$ by section #abj4 7#ae7 ,except ) respect to s5sitive cov]$ data1 & only ) respect to cov]$ data previ\sly collect$ 9 accordance ) ?is title1 to process or transf] su* data to provide t>get$ adv]tis+1 direct mail t>get$ adv]tis+1 or email t>get$ adv]tis+ 7subject to ! ,,c-,,spam ,act ( #bjjc 7#ae ,u4,s4,c4 #ggja et seq47 & ! regulations promulgat$ "u su* ,act7 or to measure & report on m>ket+ p]=mance or m$ia p]=mance1 includ+ process+ or transf]r+ cov]$ data = measurem5t & report+ ( frequ5cy1 attribution1 & p]=mance1 includ+ by indep5d5t entities1 except t ?is p>agraph does n p]mit ! process+ or transf] ( cov]$ data = t>get$ adv]tis+ to an individual :o has opt$ out ( t>get$ adv]tis+ pursuant to section #ajf or to a cov]$ m9or z prohibit$ by section #abj4 7#af7 ,to conduct a public or pe]-review$ sci5tific1 hi/orical1 or /ati/ical rese>* project t-- 7,a7 is 9 ! public int]e/2 7,b7 adh]es to all relevant laws & regulations gov]n+ su* rese>*1 includ+ regulations = ! protection ( human subjects1 if applicable2 7,c7 limits transf]s to ?ird p>ties ( s5sitive cov]$ data to only ^? transf]s necess>y1 proportionate1 & limit$ to c>ry out ! rese>*2 & 7,d7 prohibits ! transf] ( cov]$ data to a data brok]4 7#ag7 ,to conduct m$ical rese>* 9 compliance ) "p #df ( title #de1 ,code ( ,f$]al ,regulations1 or p>ts #ej & #ef ( title #ba1 ,code ( ,f$]al ,regulations4 7e7 ,guidance ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all issue guidance reg>d+ :at is necess>y1 proportionate1 & limit$ to comply ) ?is section4 7f7 ,j\rnalism ,no?+ 9 ?is title may be con/ru$ to limit or dim9i% j\rnalism1 includ+ ga!r+1 prep>+1 collect+1 photograph+1 record+1 writ+1 edit+1 report+1 or inve/igat+ news or in=mation t conc]ns local1 national1 or int]national ev5ts or o!r matt]s ( public int]e/ = dissem9ation to ! public4 #ajc4 ,privacy by design 7a7 ,9 g5]al ,ea* cov]$ entity & s]vice provid] %all e/abli%1 implem5t1 & ma9ta9 reasonable policies1 practices1 & proc$ures t reflect ! role ( ! cov]$ entity or s]vice provid] 9 ! collection1 process+1 ret5tion1 & transf]r+ ( cov]$ data4 7b7 ,requirem5ts ,! policies1 practices1 & proc$ures requir$ by subsection 7a7 %all-- 7#a7 id5tify1 assess1 & mitigate privacy risks relat$ to cov]$ m9ors 7includ+1 if applicable1 9 a mann] t consid]s ! developm5tal ne$s ( diff]5t age ranges ( cov]$ m9ors71 individuals liv+ ) disabilities1 & individuals ov] ! age ( #fe2 7#b7 mitigate privacy risks relat$ to ! products & s]vices ( ! cov]$ entity or s]vice provid]1 includ+ 9 ! design1 developm5t1 & implem5tation ( su* products & s]vices1 tak+ into acc\nt ! role ( ! cov]$ entity or s]vice provid] & ! in=mation available to ! cov]$ entity or s]vice provid]2 & 7#c7 implem5t reasonable int]nal tra9+ & safegu>ds to promote compliance ) ?is title & to mitigate privacy risks1 tak+ into acc\nt ! role ( ! cov]$ entity or s]vice provid] & ! in=mation available to ! cov]$ entity or s]vice provid]4 7c7 ,factors to consid] ,! policies1 practices1 & proc$ures e/abli%$ by a cov]$ entity or s]vice provid] "u subsection 7a7 %all align )1 z applicable-- 7#a7 ! nature1 scope1 & complexity ( ! activities engag$ 9 by ! cov]$ entity or s]vice provid]1 includ+ :e!r ! cov]$ entity or s]vice provid] is a l>ge data hold]1 nonpr(it organization1 or data brok]1 tak+ into acc\nt ! role ( ! cov]$ entity or s]vice provid] & ! in=mation available to ! cov]$ entity or s]vice provid]2 7#b7 ! s5sitivity ( ! cov]$ data collect$1 process$1 reta9$1 or transf]r$ by ! cov]$ entity or s]vice provid]2 7#c7 ! volume ( cov]$ data collect$1 process$1 reta9$1 or transf]r$ by ! cov]$ entity or s]vice provid]2 7#d7 ! numb] ( individuals & devices to :i* ! cov]$ data collect$1 process$1 reta9$1 or transf]r$ by ! cov]$ entity or s]vice provid] relates2 7#e7 /ate-(-!-art adm9i/rative1 te*nological1 & organizational measures t1 by default1 s]ve ! purpose ( protect+ ! privacy & security ( cov]$ data z requir$ by ?is title2 & 7#f7 ! co/ ( implem5t+ su* policies1 practices1 & proc$ures 9 relation to ! risks & nature ( ! cov]$ data involv$4 7d7 ,commission guidance ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all issue guidance ) respect to :at con/itutes reasonable policies1 practices1 & proc$ures z requir$ by subsection 7a74 ,9 issu+ su* guidance1 ! ,commission %all consid] unique circum/ances applicable to nonpr(it organizations1 s]vice provid]s1 & data brok]s4 #ajd4 ,transp>5cy 7a7 ,9 g5]al ,ea* cov]$ entity & s]vice provid] %all make publicly available a cle> & conspicu\s1 n mislead+1 & easy-to-read privacy policy t provides a detail$ & accurate repres5tation ( ! data collection1 process+1 ret5tion1 & transf] activities ( ! cov]$ entity or s]vice provid]4 7b7 ,cont5t ( privacy policy ,! privacy policy requir$ "u subsection 7a7 %all include1 at a m9imum1 ! foll[+3 7#a7 ,! id5tity & ! contact in=mation (-- 7,a7 ! cov]$ entity or s]vice provid] to :i* ! privacy policy applies1 includ+ a po9t ( contact & a monitor$ email address or o!r monitor$ onl9e contact me*anism1 z applicable1 specific to data privacy & data security inquiries2 & 7,b7 any affiliate )9 ! same corporate /ructure z ! cov]$ entity or s]vice provid]1 to :i* ! cov]$ entity or s]vice provid] may transf] data1 t-- 7i7 is n "u common br&+ ) ! cov]$ entity or s]vice provid]2 or 7ii7 has diff]5t contact in=mation ?an ! cov]$ entity or s]vice provid]4 7#b7 ,) respect to ! collection1 process+1 & ret5tion ( cov]$ data-- 7,a7 ! categories ( cov]$ data ! cov]$ entity or s]vice provid] collects1 processes1 or reta9s2 & 7,b7 ! process+ purposes = ea* su* category ( cov]$ data4 7#c7 ,:e!r ! cov]$ entity or s]vice provid] transf]s cov]$ data &1 if s-- 7,a7 ea* category ( s]vice provid] or ?ird p>ty to :i* ! cov]$ entity or s]vice provid] transf]s cov]$ data2 7,b7 ! "n ( ea* data brok] to :i* ! cov]$ entity or s]vice provid] transf]s cov]$ data2 & 7,c7 ! purposes = :i* su* data is transf]r$4 7#d7 ,! l5g? ( "t ! cov]$ entity or s]vice provid] int5ds to reta9 ea* category ( cov]$ data or1 if x is n possible to id5tify ! l5g? ( "t1 ! crit]ia us$ to det]m9e ! l5g? ( "t ! cov]$ entity or s]vice provid] int5ds to reta9 ea* category ( cov]$ data4 7#e7 ,a prom95t description ( h[ an individual may ex]cise ! rights1 z applicable1 ( ! individual "u ?is title4 7#f7 ,a description ( h[ ! cov]$ entity treats data collect$ f cov]$ m9ors diff]5tly ?an data collect$ f o!r individuals1 if ! cov]$ entity has k t ! cov]$ entity has collect$ data f cov]$ m9ors4 7#g7 ,a g5]al description ( ! data security practices ( ! cov]$ entity or s]vice provid]4 7#h7 ,! effective date ( ! privacy policy4 7#i7 ,:e!r any cov]$ data collect$ by ! cov]$ entity or s]vice provid] is transf]r$ to1 process$ 91 reta9$ 91 or o!rwise accessible to a =eign adv]s>y 7z det]m9$ by ! ,secret>y ( ,comm]ce & specifi$ 9 section #g4d ( title #ae1 ,code ( ,f$]al ,regulations 7or any successor regulation774 7c7 ,languages ,a privacy policy requir$ "u subsection 7a7 %all be made available to ! public-- 7#a7 9 ! #aj mo/-us$ languages 9 :i* a cov]$ entity or s]vice provid] provides products or s]vices or c>ries out activities relat$ to su* products or s]vices2 or 7#b7 if ! cov]$ entity or s]vice provid] provides products or s]vices 9 few] ?an #aj languages1 9 ! languages 9 :i* ! cov]$ entity or s]vice provid] provides products or s]vices or c>ries out activities relat$ to su* products or s]vices4 7d7 ,accessibility ,a cov]$ entity or s]vice provid] %all provide ! disclosures requir$ "u ?is section 9 a mann] t is reasonably accessible to & usable by individuals liv+ ) disabilities4 7e7 ,mat]ial *anges 7#a7 ,notice & opt out ,a cov]$ entity t makes a mat]ial *ange to ! privacy policy or practices ( ! cov]$ entity %all-- 7,a7 provide to ea* affect$ individual1 9 a cle> & conspicu\s mann]-- 7i7 advance notice ( su* mat]ial *ange2 & 7ii7 a means to opt out ( ! collection1 process+1 ret5tion1 or transf] ( any cov]$ data ( su* individual pursuant to su* mat]ial *ange2 & 7,b7 ) respect to ! cov]$ data ( any individual :o opts out us+ ! means describ$ 9 subp>agraph 7,a77ii71 discont9ue ! collection1 process+1 ret5tion1 or transf] ( su* cov]$ data1 unless su* collection1 process+1 ret5tion1 or transf] is necess>y1 proportionate1 & limit$ to provide or ma9ta9 a product or s]vice specifically reque/$ by ! individual4 7#b7 ,direct notification ,a cov]$ entity %all take all reasonable electronic measures to provide direct notification1 if possible1 to ea* affect$ individual reg>d+ mat]ial *anges to ! privacy policy ( ! cov]$ entity1 & su* notification %all be provid$ 9 ea* language 9 :i* ! privacy policy is made available1 tak+ into acc\nt available te*nology & ! nature ( ! relation%ip betwe5 ! cov]$ entity & ! individual4 7#c7 ,cl>ification ,except z provid$ 9 p>agraph 7#a77;,b71 no?+ 9 ?is subsection may be con/ru$ to affect ! requirem5ts = cov]$ entities "u sections #ajb1 #aje1 & #ajf4 7f7 ,transp>5cy requirem5ts = l>ge data hold]s 7#a7 ,ret5tion ( privacy policies2 log ( mat]ial *anges 7,a7 ,9 g5]al ,beg9n+ on ! date t is #ahj days aft] ! date ( ! enactm5t ( ?is ,act1 ea* l>ge data hold] %all-- 7i7 reta9 & publi% on ! website ( ! l>ge data hold] a copy ( ea* v]sion ( ! privacy policy ( ! l>ge data hold] requir$ "u subsection 7a7 = n less ?an #aj ye>s2 & 7ii7 make publicly available on ! website ( ! l>ge data hold]1 9 a cle> & conspicu\s mann]1 a log t describes ! date & nature ( ea* mat]ial *ange to ! privacy policy ( ! l>ge data hold] dur+ ! prec$+ #aj-ye> p]iod 9 a mann] t is suffici5t = a reasonable individual to und]/& ! effect ( ea* mat]ial *ange4 7,b7 ,exclusion ,?is p>agraph does n apply to mat]ial *anges to previ\s v]sions ( ! privacy policy ( a l>ge data hold] t prec$e ! date t is #ahj days aft] ! date ( ! enactm5t ( ?is ,act4 7#b7 ,%ort =m notice to consum]s 7,a7 ,9 g5]al ,9 addition to ! privacy policy requir$ "u subsection 7a71 a l>ge data hold] %all provide a %ort-=m notice ( ! cov]$ data practices ( ! l>ge data hold] 9 a mann] t-- 7i7 is concise2 7ii7 is cle> & conspicu\s2 7iii7 is readily accessible to an individual1 bas$ on ! mann] 9 :i* ! individual int]acts ) ! l>ge data hold] & ! products or s]vices ( ! l>ge data hold] & :at is reasonably anticipat$ )9 ! context ( ! relation%ip betwe5 ! individual & ! l>ge data hold]2 7iv7 includes an ov]view ( individual rights & disclosures to reasonably draw att5tion to data practices t may be unexpect$ or t involve s5sitive cov]$ data2 & 7v7 is n m ?an #ejj words 9 l5g? 9 ! ,engli% language or1 if 9 a language o!r ?an ,engli%1 n m ?an #eej words 9 l5g?4 7,b7 ,guidance ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all issue guidance e/abli%+ ! m9imum disclosures necess>y = ! %ort-=m notice describ$ 9 ?is p>agraph & %all include templates or models = su* notice4 #aje4 ,individual control ov] cov]$ data 7a7 ,access to1 & correction1 deletion1 & portability (1 cov]$ data ,aft] receiv+ a v]ifi$ reque/ f an individual1 includ+ a p>5t act+ on behalf ( a *ild ( ! p>5t1 a cov]$ entity %all provide ! individual ) ! "r to-- 7#a7 access-- 7,a7 9 a =mat t c be naturally read by a human1 ! cov]$ data ( ! individual or *ild 7z applicable7 7or an accurate repres5tation ( ! cov]$ data ( ! individual or *ild 7z applicable71 if ! cov]$ data is no long] 9 ! possession ( ! cov]$ entity or a s]vice provid] act+ on behalf ( ! cov]$ entity7 t is collect$1 process$1 or reta9$ by ! cov]$ entity or any s]vice provid] ( ! cov]$ entity2 7,b7 ! "n ( any ?ird p>ty or s]vice provid] to :om ! cov]$ entity has transf]r$ ! cov]$ data1 z well z ! categories ( s\rces f :i* ! cov]$ data 0 collect$2 & 7,c7 a description ( ! purpose = :i* ! cov]$ entity transf]r$ any cov]$ data ( ! individual or *ild 7z applicable7 to a ?ird p>ty or s]vice provid]2 7#b7 correct any inaccuracy or incomplete in=mation ) respect to ! cov]$ data ( ! individual or *ild 7z applicable7 t is collect$1 process$1 or reta9$ by ! cov]$ entity &1 = cov]$ data t has be5 transf]r$1 reque/ ! cov]$ entity to notify any ?ird p>ty or s]vice provid] to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! correct$ in=mation1 includ+ s t s]vice provid]s may provide ! assi/ance requir$ by section #aaa7;a77#a77;,c72 7#c7 delete cov]$ data ( ! individual or *ild 7z applicable7 t is reta9$ by ! cov]$ entity &1 = cov]$ data t has be5 transf]r$1 reque/ t ! cov]$ entity notify any ?ird p>ty or s]vice provid] to :i* ! cov]$ entity transf]r$ su* cov]$ data ( ! deletion reque/1 includ+ s t s]vice provid]s may provide ! assi/ance requir$ by section #aaa7;a77#a77;,c72 7#d7 to ! ext5t te*nically feasible1 h export$ cov]$ data ( ! individual or *ild 7z applicable7 t is collect$1 process$1 or reta9$ by ! cov]$ entity1 )\t lic5s+ re/rictions t unreasonably limit su* transf]s1 9-- 7,a7 a =mat t c be naturally read by a human2 & 7,b7 a =mat t is portable1 /ructur$1 int]op]able1 & ma*9e-readable2 & 7#e7 delete any cont5t or in=mation submitt$ to ! cov]$ entity by ! individual :5 a cov]$ m9or &1 = any su* cont5t or in=mation t has be5 transf]r$1 reque/ t ! cov]$ entity notify any ?ird p>ty or s]vice provid] to :i* ! cov]$ entity transf]r$ su* cont5t or in=mation ( ! deletion reque/1 includ+ s t s]vice provid]s may provide ! assi/ance requir$ by section #aaa7;a77#a77;,c74 7b7 ,frequ5cy & co/ ,a cov]$ entity-- 7#a7 %all provide an individual ) ! opportunity to ex]cise ea* ( ! rights describ$ 9 subsection 7a72 & 7#b7 ) respect to-- 7,a7 ! fir/ #c in/ances t an individual ex]cises any "r describ$ 9 subsection 7a7 dur+ any #ab-mon? p]iod1 %all all[ ! individual to ex]cise su* "r free ( *>ge2 & 7,b7 any in/ance beyond ! fir/ #c in/ances describ$ 9 subp>agraph 7,a71 may *>ge a reasonable fee = ea* additional reque/ to ex]cise any su* "r dur+ su* #ab-mon? p]iod4 7c7 ,tim+ 7#a7 ,9 g5]al ,subject to subsections 7b71 7d71 & 7e71 ea* reque/ "u subsection 7a7 %all be complet$-- 7,a7 by any cov]$ entity t is a l>ge data hold] or data brok]1 n lat] ?an #cj cal5d> days aft] receiv+ su* reque/ f an individual1 unless x is impossible or demon/rably impracticable to v]ify ! individual2 or 7,b7 by a cov]$ entity t is n a l>ge data hold] or data brok]1 n lat] ?an #de cal5d> days aft] receiv+ su* reque/ f an individual1 unless x is impossible or demon/rably impracticable to v]ify ! individual4 7#b7 ,ext5sion ,a response p]iod requir$ "u p>agraph 7#a7 may be ext5d$ once1 by n m ?an ! applicable "t p]iod describ$ 9 su* p>agraph1 :5 reasonably necess>y1 consid]+ ! complexity & numb] ( reque/s f ! individual1 if ! cov]$ entity in=ms ! individual ( any su* ext5sion1 & ! reason = ! ext5sion1 )9 ! initial response p]iod4 7d7 ,v]ification 7#a7 ,9 g5]al ,a cov]$ entity %all reasonably v]ify t an individual mak+ a reque/ to ex]cise a "r describ$ 9 subsection 7a7 is-- 7,a7 ! individual ^: cov]$ data is ! subject ( ! reque/2 7,b7 ! p>5t ( ! *ild ^: cov]$ data 7or1 ) respect to a reque/ "u subsection 7a77#e71 ^: cont5t or o!r in=mation7 is ! subject ( ! reque/2 or 7,c7 ano!r individual :o is a natural p]son :o is au?oriz$ to make su* a reque/ on behalf ( ! individual ^: cov]$ data is ! subject ( ! reque/4 7#b7 ,additional in=mation ,if a cov]$ entity _c make ! v]ification describ$ 9 p>agraph 7#a71 ! cov]$ entity may reque/ t ! individual mak+ ! reque/ provide any additional in=mation necess>y = ! sole purpose ( mak+ su* v]ification1 except t-- 7,a7 ! reque/ ( ! cov]$ entity may n be burd5some on ! individual2 & 7,b7 ! cov]$ entity may n process1 reta91 or transf] su* additional in=mation = any o!r purpose4 7e7 ,exceptions 7#a7 ,requir$ exceptions ,a cov]$ entity may n p]mit an individual to ex]cise a "r describ$ 9 subsection 7a71 9 :ole or 9 "p1 if ! cov]$ entity-- 7,a7 _c reasonably make ! v]ification describ$ 9 subsection 7d77#a72 7,b7 det]m9es t ex]cise ( ! "r w\ld require access to1 or ! correction or deletion (1 ! s5sitive cov]$ data ( an individual o!r ?an ! individual ^: cov]$ data is ! subject ( ! reque/2 7,c7 det]m9es t ex]cise ( ! "r w\ld require correction or deletion ( cov]$ data subject to a w>rant1 lawfully execut$ subpo5a1 or litigation hold notice or equival5t pres]vation notice 9 connection ) su* w>rant or subpo5a or issu$ 9 a matt] 9 :i* ! cov]$ entity is a nam$ p>ty2 7,d7 det]m9es t ex]cise ( ! "r w\ld violate a ,f$]al1 ,/ate1 ,tribal1 or local law t is n preempt$ by ?is title2 7,e7 det]m9es t ex]cise ( ! "r w\ld violate ! pr(essional e?ical obligations ( ! cov]$ entity2 7,f7 reasonably believes t ! reque/ is made to fur!r fraud2 7,g7 except ) respect to heal? in=mation1 reasonably believes t ! reque/ is made 9 fur!rance ( crim9al activity2 or 7,h7 reasonably believes t comply+ ) ! reque/ w\ld ?reat5 data security or network security4 7#b7 ,p]missive exceptions ,a cov]$ entity may decl9e1 9 :ole or 9 "p1 to comply ) a reque/ to ex]cise a "r describ$ 9 subsection 7a71 ) adequate explanation to ! individual mak+ ! reque/1 if compliance ) ! reque/ w\ld-- 7,a7 be demon/rably impracticable due to te*nological limitations or prohibitive co/1 & if ! cov]$ entity provides a detail$ description to ! individual reg>d+ ! inability to comply ) ! reque/ due to te*nological limitations or prohibitive co/2 7,b7 delete cov]$ data necess>y to p]=m a contract betwe5 ! cov]$ entity & ! individual2 7,c7 ) respect to a "r describ$ 9 p>agraph 7#a7 or 7#d7 ( subsection 7a71 require ! cov]$ entity to release trade secrets or o!r privileg$1 propriet>y1 or confid5tial bus9ess in=mation2 7,d7 prev5t a cov]$ entity f be+ able to ma9ta9 a confid5tial record ( opt-out reque/s pursuant to ?is title t is ma9ta9$ solely = ! purpose ( prev5t+ cov]$ data ( an individual f be+ collect$1 process$1 reta9$1 or transf]r$ aft] ! individual submits an opt-out reque/2 7,e7 ) respect to a deletion reque/1 require a private elem5t>y or second>y s*ool 7z det]m9$ "u ,/ate law7 or a private in/itution ( high] education 7z def9$ 9 title ,i ( ! ,high] ,education ,act ( #aife 7#bj ,u4,s4,c4 #ajja et seq477 to delete cov]$ data1 if ! deletion w\ld unreasonably int]f]e ) ! provision ( education s]vices by1 or ! ord9>y op]ation (1 ! s*ool or in/itution2 7,f7 delete cov]$ data t relates to a public figure reg>d+ a matt] ( legitimate public int]e/ & = :i* ! reque/+ individual has no reasonable expectation ( privacy2 or 7,g7 delete cov]$ data t ! cov]$ entity reasonably believes may be evid5ce ( an abuse ( ! products or s]vices ( ! cov]$ entity1 includ+ a violation ( t]ms ( s]vice4 7#c7 ,rule ( con/ruction ,?is section may n be con/ru$ to require a cov]$ entity or s]vice provid] act+ on behalf ( a cov]$ entity to-- 7,a7 reta9 cov]$ data collect$ = a #a-"t transaction1 if su* cov]$ data is n process$ or transf]r$ by ! cov]$ entity = any purpose o!r ?an complet+ su* transaction2 7,b7 re-id5tify1 or attempt to re-id5tify1 de-id5tifi$ data2 or 7,c7 collect or reta9 any data 9 ord] to be capable ( associat+ a reque/ ) ! cov]$ data t is ! subject ( ! reque/4 7#d7 ,p>tial compliance ,9 ! ev5t a cov]$ entity decl9es a reque/ "u p>agraph 7#b71 ! cov]$ entity %all comply ) ! rema9d] ( ! reque/ if p>tial compliance is possible & n unduly burd5some4 7#e7 ,numb] ( reque/s ,= purposes ( p>agraph 7#b77;,a71 ! receipt ( a l>ge numb] ( v]ifi$ reque/s1 on its own1 may n be consid]$ to r5d] compliance ) a reque/ demon/rably impracticable4 7#f7 ,additional exceptions 7,a7 ,9 g5]al ,! ,commission may promulgate regulations1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 to e/abli% additional p]missive exceptions to subsection 7a7 necess>y to protect ! rights ( individuals1 to alleviate undue burd5s on cov]$ entities1 to prev5t unju/ or unreasonable outcomes f ! ex]cise ( access1 correction1 deletion1 or portability rights1 or to o!rwise fulfill ! purposes ( ?is section4 7,b7 ,consid]ations ,9 e/abli%+ any exceptions "u subp>agraph 7,a71 ! ,commission %all consid] any relevant *anges 9 te*nology1 means = protect+ privacy & o!r rights1 & b5eficial uses ( cov]$ data by cov]$ entities4 7,c7 ,cl>ification ,a cov]$ entity may decl9e to comply ) a reque/ ( an individual to ex]cise a "r "u ?is section pursuant to an exception ! ,commission e/abli%es "u ?is p>agraph4 7f7 ,l>ge data hold] metrics report+ ,) respect to ea* cal5d> ye> = :i* an entity is a l>ge data hold]1 su* entity %all comply ) ! foll[+ requirem5ts3 7#a7 ,requir$ metrics ,compile ! foll[+ in=mation = su* cal5d> ye>3 7,a7 ,! numb] ( v]ifi$ access reque/s "u subsection 7a77#a74 7,b7 ,! numb] ( v]ifi$ deletion reque/s "u subsection 7a77#c74 7,c7 ,! numb] ( v]ifi$ deletion reque/s "u subsection 7a77#e74 7,d7 ,! numb] ( v]ifi$ reque/s to opt out ( cov]$ data transf]s "u section #ajf7;a77#a74 7,e7 ,! numb] ( v]ifi$ reque/s to opt out ( t>get$ adv]tis+ "u section #ajf7;a77#b74 7,f7 ,= ea* category ( reque/ describ$ 9 subp>agraphs 7,a7 ?r\gh 7,e71 ! numb] ( su* reque/s t ! l>ge data hold] compli$ ) 9 :ole or 9 "p4 7,g7 ,= ea* category ( reque/ describ$ 9 subp>agraphs 7,a7 ?r\gh 7,e71 ! av]age numb] ( days )9 :i* ! l>ge data hold] sub/antively respond$ to ! reque/s4 7#b7 ,public disclosure ,n lat] ?an ,july #a ( ea* cal5d> ye>1 disclose ! in=mation compil$ "u p>agraph 7#a7 = ! previ\s cal5d> ye>-- 7,a7 9 ! privacy policy ( ! l>ge data hold]2 or 7,b7 on a publicly available website ( ! l>ge data hold] t is accessible f a hyp]l9k includ$ 9 ! privacy policy4 7g7 ,guidance ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all issue guidance to cl>ify or expla9 ! provisions ( ?is section & e/abli% practices by :i* a cov]$ entity may v]ify a reque/ to ex]cise a "r describ$ 9 subsection 7a74 7h7 ,accessibility 7#a7 ,language ,a cov]$ entity %all facilitate ! ability ( individuals to make reque/s to ex]cise rights describ$ 9 subsection 7a7 9 any language 9 :i* ! cov]$ entity provides a product or s]vice4 7#b7 ,individuals liv+ ) disabilities ,! me*anisms by :i* a cov]$ entity enables individuals to make a reque/ to ex]cise a "r describ$ 9 subsection 7a7 %all be readily accessible & usable by individuals liv+ ) disabilities4 #ajf4 ,opt-out rights & univ]sal me*anisms 7a7 ,9 g5]al ,a cov]$ entity %all provide to an individual ! foll[+ opt-out rights ) respect to ! cov]$ data ( ! individual3 7#a7 ,"r to opt out ( cov]$ data transf]s to ?ird p>ties ,a cov]$ entity-- 7,a7 %all provide an individual ) a cle> & conspicu\s means to opt out ( ! transf] ( ! cov]$ data ( ! individual to a ?ird p>ty2 7,b7 ^u e/abli%m5t ( an opt out me*anism t meets ! requirem5ts & te*nical specifications promulgat$ "u subsection 7b71 %all all[ an individual to make an opt-out designation pursuant to subp>agraph 7,a7 ?r\gh ! opt out me*anism2 7,c7 %all abide by an opt-out designation made pursuant to subp>agraph 7,a7 & communicate su* designation to all relevant s]vice provid]s & ?ird p>ties2 & 7,d7 except z provid$ 9 subsection 7b7 or 7c77#d7 ( section #ajb1 p>agraph 7#c7 or 7#d7 ( section #aab7;c71 or section #abj7;b71 ne$ n all[ an individual to opt out ( a transf] ( cov]$ data made pursuant to a p]missible purpose describ$ 9 p>agraph 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 7#g71 7#h71 7#i71 7#aj71 7#aa71 7#ab71 7#ac71 or 7#ad7 ( section #ajb7;d74 7#b7 ,"r to opt out ( t>get$ adv]tis+ ,a cov]$ entity t engages 9 t>get$ adv]tis+ %all-- 7,a7 provide an individual ) a cle> & conspicu\s means to opt out ( ! process+ & transf] ( cov]$ data ( ! individual 9 fur!rance ( t>get$ adv]tis+2 7,b7 ^u e/abli%m5t ( an opt out me*anism t meets ! requirem5ts & te*nical specifications promulgat$ "u subsection 7b71 all[ an individual to make an opt-out designation ) respect to t>get$ adv]tis+ ?r\gh ! opt-out me*anism2 & 7,c7 abide by any su* opt-out designation made by an individual & communicate su* designation to all relevant s]vice provid]s & ?ird p>ties4 7b7 ,univ]sal opt-out me*anisms 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all1 9 consultation ) ! ,secret>y ( ,comm]ce1 promulgate regulations1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 to e/abli% requirem5ts & te*nical specifications = #a or m opt-out me*anisms 7includ+ global privacy signals1 su* z br[s] or device privacy sett+s7 = individuals to ex]cise ! opt-out rights e/abli%$ "u ?is title ?r\gh a s+le int]face t-- 7,a7 ensures t ! opt-out pref]5ce signal-- 7i7 is cle>ly describ$1 & easy-to-use by a reasonable individual2 7ii7 does n require t an individual provide additional in=mation beyond :at is necess>y to indicate su* pref]5ce2 7iii7 cle>ly repres5ts ! pref]5ce ( an individual2 7iv7 is provid$-- 7,i7 9 ! #aj mo/-us$ languages 9 :i* a cov]$ entity provides products or s]vices subject to ! opt-out2 or 7,,ii7 if ! cov]$ entity provides products or s]vices subject to ! opt-out 9 few] ?an #aj languages1 9 ! languages 9 :i* ! cov]$ entity provides su* products or s]vices2 & 7v7 is provid$ 9 a mann] t is reasonably accessible to & usable by individuals liv+ ) disabilities2 7,b7 provides a me*anism = an individual to selectively opt out ( ! collection1 process+1 ret5tion1 or transf] ( cov]$ data by a cov]$ entity1 )\t affect+ ! pref]5ces ( ! individual ) respect to o!r entities or disabl+ ! opt-out pref]5ce signal globally2 7,c7 /ates t1 9 ! case ( a page or sett+ view t ! individual accesses to set ! opt-out pref]5ce signal1 ! individual %\ld see up to #b *oices1 correspond+ to ! rights e/abli%$ "u subsection 7a72 & 7,d7 ensures t ! opt-out pref]5ce signal w be regi/]$ & set only by ! individual or by ano!r individual :o is a natural p]son on behalf ( ! individual4 7#b7 ,effect ( designations ,a cov]$ entity %all abide by any designation made by an individual ?r\gh any me*anism t meets ! requirem5ts & te*nical specifications promulgat$ "u p>agraph 7#a74 #ajg4 ,int]f]5ce ) consum] rights 7a7 ,d>k patt]ns prohibit$ 7#a7 ,9 g5]al ,a cov]$ entity may n use d>k patt]ns to-- 7,a7 div]t ! att5tion ( an individual f any notice requir$ "u ?is title2 7,b7 impair ! ability ( an individual to ex]cise any "r "u ?is title2 or 7,c7 obta91 inf]1 or facilitate ! cons5t ( an individual = any action t requires ! cons5t ( an individual "u ?is title4 7#b7 ,cl>ification ,any agreem5t by an individual t is obta9$1 inf]r$1 or facilitat$ ?r\gh d>k patt]ns does n con/itute cons5t = any purpose "u ?is title4 7b7 ,individual autonomy ,a cov]$ entity may n condition1 effectively condition1 attempt to condition1 or attempt to effectively condition ! ex]cise ( a "r describ$ 9 ?is title ?r\gh ! use ( any false1 fictiti\s1 fraudul5t1 or mat]ially mislead+ /atem5t or repres5tation4 #ajh4 ,prohibition on d5ial ( s]vice & waiv] ( rights 7a7 ,retaliation ?r\gh s]vice or pric+ prohibit$ ,a cov]$ entity may n retaliate aga9/ an individual = ex]cis+ any ( ! rights e/abli%$ "u ?is title1 or any regulations promulgat$ "u ?is title1 includ+ by d5y+ goods or s]vices1 *>g+ diff]5t prices or rates = goods or s]vices1 or provid+ a diff]5t level ( quality ( goods or s]vices4 7b7 ,rules ( con/ruction 7#a7 ,bona fide loyalty programs 7,a7 ,9 g5]al ,no?+ 9 subsection 7a7 may be con/ru$ to prohibit a cov]$ entity f (f]+-- 7i7 to an individual diff]5t prices1 rates1 levels1 qualities1 or selections ( goods or s]vices1 or functionalities ) respect to a product or s]vice1 includ+ (f]+ goods or s]vices = no fee1 if ! (f]+ is 9 connection ) ! volunt>y p>ticipation ( ! individual 9 a bona fide loyalty program1 & if-- 7,i7 ! individual provid$ affirmative express cons5t to p>ticipate 9 su* bona fide loyalty program2 7,,ii7 ! cov]$ entity abides by ! ex]cise by ! individual ( any "r provid$ by subsection 7b7 or 7c7 ( section #ajb1 section #aje1 or section #ajf2 & 7,,iii7 ! sale ( cov]$ data is n a condition ( p>ticipation 9 ! bona fide loyalty program2 or 7ii7 to an individual diff]5t prices1 rates1 levels1 qualities1 or selections ( goods or s]vices1 or functionalities ) respect to a product or s]vice1 bas$ on ! decision ( ! individual to t]m9ate memb]%ip 9 a bona fide loyalty program or to ex]cise a "r "u section #aje7;a77#c7 to delete cov]$ data t is necess>y = p>ticipation 9 ! bona fide loyalty program4 7,b7 ,bona fide loyalty program def9$ ,= purposes ( ?is section1 ! t]m bona fide loyalty program-- 7i7 includes rew>ds1 premium features1 disc\nts1 & club c>d programs (f]$ by a cov]$ entity2 & 7ii7 excludes su* programs (f]$ by a cov]$ high-impact social m$ia company or data brok]4 7#b7 ,m>ket rese>* ,no?+ 9 subsection 7a7 may be con/ru$ to prohibit a cov]$ entity f (f]+ a f9ancial inc5tive or o!r consid]ation to an individual = p>ticipation 9 m>ket rese>*4 7#c7 ,decl9+ a product or s]vice ,no?+ 9 subsection 7a7 may be con/ru$ to prohibit a cov]$ entity f decl9+ to provide a product or s]vice or a bona fide loyalty program to an individual1 if any collection1 process+1 ret5tion1 or transf] affect$ by ! individual ex]cis+ a "r e/abli%$ "u ?is title is necess>y1 proportionate1 & limit$ to provid+ su* product or s]vice4 #aji4 ,data security & protection ( cov]$ data 7a7 ,e/abli%m5t ( data security practices 7#a7 ,9 g5]al ,ea* cov]$ entity or s]vice provid] %all e/abli%1 implem5t1 & ma9ta9 reasonable data security practices to protect-- 7,a7 ! confid5tiality1 integrity1 & availability ( cov]$ data2 & 7,b7 cov]$ data aga9/ unau?oriz$ access4 7#b7 ,consid]ations ,! data security practices requir$ "u p>agraph 7#a7 %all be appropriate to-- 7,a7 ! size & complexity ( ! cov]$ entity or s]vice provid]2 7,b7 ! nature & scope ( ! relevant collect+1 process+1 reta9+1 or transf]r+ ( cov]$ data1 tak+ into acc\nt *ang+ bus9ess op]ations ) respect to cov]$ data2 7,c7 ! volume1 nature1 & s5sitivity ( ! cov]$ data2 & 7,d7 ! /ate-(-!-art 7& limitations !re(7 9 adm9i/rative1 te*nical1 & physical safegu>ds = protect+ cov]$ data4 7b7 ,specific requirem5ts ,! data security practices requir$ "u subsection 7a7 %all include1 at a m9imum1 ! foll[+3 7#a7 ,assess vuln]abilities ,r\t9ely id5tify+ & assess+ any reasonably =eseeable int]nal or ext]nal risk to1 or vuln]ability 91 ea* sy/em ma9ta9$ by ! cov]$ entity or s]vice provid] t collects1 processes1 reta9s1 or transf]s cov]$ data1 includ+ unau?oriz$ access to or corruption ( su* cov]$ data1 human vuln]abilities1 access rights1 & ! use ( s]vice provid]s4 ,su* activities %all include develop+ & implem5t+ a plan = receiv+ & consid]+ unsolicit$ reports ( vuln]ability by any entity &1 if su* a report is reasonably cr$ible1 p]=m+ a reasonable & timely inve/igation ( su* report & tak+ appropriate action to protect cov]$ data aga9/ ! vuln]ability4 7#b7 ,prev5tive & corrective action 7,a7 ,9 g5]al ,tak+ prev5tive & corrective action to mitigate any reasonably =eseeable int]nal or ext]nal risk to1 or vuln]ability (1 cov]$ data id5tifi$ by ! cov]$ entity or s]vice provid]1 consi/5t ) ! nature ( su* risk or vuln]ability & ! role ( ! cov]$ entity or s]vice provid] 9 collect+1 process+1 reta9+1 or transf]r+ ! data1 :i* may include implem5t+ adm9i/rative1 te*nical1 or physical safegu>ds or *anges to data security practices or ! ar*itecture1 in/allation1 or implem5tation ( network or op]at+ s(tw>e4 7,b7 ,evaluation ( prev5tative & corrective action ,evaluat+ & mak+ reasonable adju/m5ts to ! action describ$ 9 subp>agraph 7,a7 9 light ( any mat]ial *anges 9 /ate-(-!-art te*nology1 int]nal or ext]nal ?reats to cov]$ data1 & *ang+ bus9ess op]ations ) respect to cov]$ data4 7#c7 ,in=mation ret5tion & disposal ,dispos+ ( cov]$ data 7ei!r by or at ! direction ( ! cov]$ entity7 t is requir$ to be delet$ by law or is no long] necess>y = ! purpose = :i* ! data 0 collect$1 process$1 reta9$1 or transf]r$1 unless a p]mitt$ purpose "u section #ajb7;d7 applies1 except t ret5tion & disposal ( biometric in=mation %all be gov]n$ by section #ajb7;c77#c74 ,su* disposal %all include de/roy+1 p]man5tly eras+1 or o!rwise modify+ ! cov]$ data to make su* data p]man5tly unreadable or indeciph]able & unrecov]able to ensure ongo+ compliance ) ?is section4 7#d7 ,ret5tion s*$ule ,develop+1 ma9ta9+1 & adh]+ to a ret5tion s*$ule = cov]$ data consi/5t ) p>agraph 7#c74 7#e7 ,tra9+ ,tra9+ ea* employee ) access to cov]$ data on h[ to safegu>d cov]$ data1 & updat+ su* tra9+ z necess>y4 7#f7 ,incid5t response ,implem5t+ proc$ures to detect1 respond to1 & recov] f data security incid5ts1 includ+ brea*es4 7c7 ,regulations ,! ,commission may1 9 consultation ) ! ,secret>y ( ,comm]ce1 promulgate1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 te*nology-neutral1 process-bas$ regulations to c>ry out ?is section4 #aaj4 ,executive responsibility 7a7 ,designation ( privacy & data security (fic]s 7#a7 ,9 g5]al ,a cov]$ entity or s]vice provid] 7except = a l>ge data hold]7 %all designate #a or m qualifi$ employees to s]ve z privacy & data security (fic]s4 7#b7 ,requirem5ts = (fic]s ,an employee :o is designat$ by a cov]$ entity or s]vice provid] z a privacy & data security (fic] %all1 at a m9imum-- 7,a7 implem5t a data privacy program & a data security program to safegu>d ! privacy & security ( cov]$ data 9 compliance ) ! requirem5ts ( ?is title2 & 7,b7 facilitate ! ongo+ compliance ( ! cov]$ entity or s]vice provid] ) ?is title4 7b7 ,requirem5ts = l>ge data hold]s 7#a7 ,designation ,a cov]$ entity or s]vice provid] t is a l>ge data hold] %all designate #a qualifi$ employee to s]ve z a privacy (fic] & #a qualifi$ employee to s]ve z a data security (fic]4 7#b7 ,annual c]tification 7,a7 ,9 g5]al ,beg9n+ on ! date t is #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! *ief executive (fic] ( a l>ge data hold] 7or1 if ! l>ge data hold] does n h a *ief executive (fic]1 ! highe/ rank+ (fic] ( ! l>ge data hold]7 & ea* privacy (fic] & data security (fic] ( su* l>ge data hold] designat$ "u p>agraph 7#a71 %all annually c]tify to ! ,commission1 9 a mann] specifi$ by ! ,commission1 t ! l>ge data hold] implem5ts & ma9ta9s-- 7i7 int]nal controls reasonably design$1 implem5t$1 ma9ta9$1 & monitor$ to comply ) ?is title2 & 7ii7 int]nal report+ /ructures 7z describ$ 9 p>agraph 7#c77 to ensure t su* c]tify+ (fic]s are involv$ 91 & responsible =1 decisions t impact compliance by ! l>ge data hold] ) ?is title4 7,b7 ,requirem5ts ,a c]tification submitt$ "u subp>agraph 7,a7 %all be bas$ on a review ( ! effectiv5ess ( ! int]nal controls & report+ /ructures ( ! l>ge data hold] t is conduct$ by ! c]tify+ (fic]s n m ?an #ij days be=e ! submission ( ! c]tification4 7#c7 ,int]nal report+ /ructure requirem5ts ,at lea/ #a ( ! (fic]s designat$ "u p>agraph 7#a7 %all1 ei!r directly or ?r\gh a sup]vis$ designee-- 7,a7 e/abli% practices to p]iodically review & update1 z necess>y1 ! privacy & security policies1 practices1 & proc$ures ( ! l>ge data hold]2 7,b7 conduct bi5nial & compreh5sive audits to ensure ! policies1 practices1 & proc$ures ( ! l>ge data hold] comply ) ?is title &1 ^u reque/1 make su* audits available to ! ,commission2 7,c7 develop a program to educate & tra9 employees ab\t ! requirem5ts ( ?is title2 7,d7 ma9ta9 updat$1 accurate1 cle>1 & und]/&able records ( all significant privacy & data security practices ( ! l>ge data hold]2 & 7,e7 s]ve z ! po9t ( contact betwe5 ! l>ge data hold] & en=cem5t au?orities4 7#d7 ,privacy impact assessm5ts 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act or #a ye> aft] ! date on :i* an entity fir/ meets ! def9ition ( ! t]m l>ge data hold]1 :i*ev] is e>li]1 & bi5nially !reaft]1 ea* l>ge data hold] %all conduct a privacy impact assessm5t t weighs ! b5efits ( ! cov]$ data collection1 process+1 ret5tion1 & transf] practices ( ! entity aga9/ ! pot5tial adv]se consequ5ces ( su* practices to individual privacy4 7,b7 ,assessm5t requirem5ts ,a privacy impact assessm5t requir$ "u subp>agraph 7,a7 %all be-- 7i7 reasonable & appropriate 9 scope giv5-- 7,i7 ! nature & volume ( ! cov]$ data collect$1 process$1 reta9$1 or transf]r$ by ! l>ge data hold]2 & 7,,ii7 ! pot5tial risks pos$ to ! privacy ( individuals by ! collection1 process+1 ret5tion1 & transf] ( cov]$ data by ! l>ge data hold]2 7ii7 docum5t$ 9 writt5 =m & ma9ta9$ by ! l>ge data hold] = z long z ! relevant privacy policy is requir$ to be reta9$ "u section #ajd7;f77#a72 & 7iii7 approv$ by ! privacy (fic] ( ! l>ge data hold]4 7,c7 ,additional factors to include 9 assessm5t ,9 assess+ privacy risks = purposes ( an assessm5t conduct$ "u subp>agraph 7,a71 includ+ significant risks ( h>m to ! privacy ( an individual or ! security ( cov]$ data1 ! l>ge data hold] %all include reviews ( ! means by :i* te*nologies1 includ+ block*a9 & di/ribut$ l$g] te*nologies & o!r em]g+ te*nologies1 includ+ privacy enhanc+ te*nologies1 are us$ to secure cov]$ data4 #aaa4 ,s]vice provid]s & ?ird p>ties 7a7 ,s]vice provid]s 7#a7 ,9 g5]al ,a s]vice provid] t collects1 processes1 reta9s1 or transf]s cov]$ data on behalf ( or at ! direction ( a cov]$ entity or ano!r s]vice provid]-- 7,a7 %all adh]e to ! in/ructions ( ! cov]$ entity or o!r s]vice provid] & collect1 process1 reta91 or transf] cov]$ data only to ! ext5t necess>y1 proportionate1 & limit$ to provide a s]vice reque/$ by ! cov]$ entity or o!r s]vice provid]1 z set out 9 ! contract describ$ 9 p>agraph 7#b72 7,b7 may n collect1 process1 reta91 or transf] cov]$ data if ! s]vice provid] has actual k t ! cov]$ entity or o!r s]vice provid] violat$ ?is title ) respect to su* data2 7,c7 %all assi/ ! cov]$ entity or o!r s]vice provid] 9 fulfill+ ! obligations ( ! cov]$ entity or o!r s]vice provid] to respond to consum] rights reque/s pursuant to ?is title by-- 7i7 provid+ appropriate te*nical & organizational support1 tak+ into acc\nt ! nature ( ! process+ & ! in=mation reasonably available to ! s]vice provid]2 or 7ii7 fulfill+ a reque/ by ! cov]$ entity or o!r s]vice provid] to execute a consum] rights reque/ t ! cov]$ entity or o!r s]vice provid] has det]m9$ %\ld be compil$ )1 by ei!r-- 7,i7 comply+ ) ! reque/ pursuant to ! in/ructions ( ! cov]$ entity or o!r s]vice provid]2 or 7,,ii7 provid+ writt5 v]ification to ! cov]$ entity or o!r s]vice provid] t ! s]vice provid] does n hold data relat$ to ! reque/1 t comply+ ) ! reque/ w\ld be inconsi/5t ) ! legal obligations ( ! s]vice provid]1 or t ! reque/ falls )9 an exception pursuant to ?is title2 7,d7 %all1 ^u ! reasonable reque/ ( ! cov]$ entity or o!r s]vice provid]1 make available to ! cov]$ entity or o!r s]vice provid] all in=mation necess>y to demon/rate ! compliance ( ! s]vice provid] ) ! requirem5ts ( ?is title2 7,e7 %all delete or return1 z direct$ by ! cov]$ entity or o!r s]vice provid]1 all cov]$ data z soon z practicable aft] ! contractually agre$ ^u end ( ! provision ( s]vices1 unless ! ret5tion by ! s]vice provid] ( cov]$ data is requir$ by law2 7,f7 may engage ano!r s]vice provid] = purposes ( process+ or reta9+ cov]$ data on behalf ( ! cov]$ entity or o!r s]vice provid] only aft] ex]cis+ reasonable c>e 9 select+ ano!r s]vice provid] z requir$ by subsection 7d71 provid+ ! cov]$ entity or o!r s]vice provid] ) writt5 notice ( ! engagem5t1 & ent]+ into a writt5 contract t requires ! o!r s]vice provid] to satisfy ! requirem5ts ( ?is title ) respect to cov]$ data2 & 7,g7 %all-- 7i7 all[ & coop]ate ) reasonable assessm5ts by ! cov]$ entity or o!r s]vice provid] at lea/ annually2 or 7ii7 arrange = a qualifi$ & indep5d5t assessor to conduct an assessm5t ( ! policies & te*nical & organizational measures ( ! s]vice provid] 9 support ( ! obligations ( ! s]vice provid] "u ?is title at lea/ annually1 us+ an appropriate & accept$ control /&>d or framework & assessm5t proc$ure = su* assessm5ts1 & report ! results ( su* assessm5t to ! cov]$ entity or o!r s]vice provid]4 7#b7 ,contract requirem5ts ,an entity may only op]ate z a s]vice provid] pursuant to a contract betwe5 a cov]$ entity & a s]vice provid]4 ,su* contract-- 7,a7 %all gov]n ! data process+ proc$ures ( ! s]vice provid] ) respect to any collection1 process+1 ret5tion1 or transf] p]=m$ on behalf ( ! cov]$ entity2 7,b7 %all cle>ly set =?-- 7i7 in/ructions = collect+1 process+1 reta9+1 or transf]r+ data2 7ii7 ! nature & purpose ( ! collection1 process+1 ret5tion1 or transf]2 7iii7 ! type ( data subject to collection1 process+1 ret5tion1 or transf]2 7iv7 ! duration ( ! process+ or ret5tion2 & 7v7 ! rights & obligations ( bo? p>ties2 7,c7 may n relieve ! cov]$ entity or s]vice provid] ( any obligation "u ?is title2 & 7,d7 %all prohibit-- 7i7 ! collection1 process+1 ret5tion1 or transf] ( cov]$ data 9 a mann] t does n comply ) ! requirem5ts ( p>agraph 7#a72 & 7ii7 comb9+ cov]$ data t ! s]vice provid] receives f or on behalf ( a cov]$ entity ) cov]$ data t ! s]vice provid] receives f or on behalf ( ano!r entity or collects f ! int]action ( ! s]vice provid] ) an individual1 unless su* comb9+ is necess>y = a purpose describ$ 9 section #ajb7;d71 o!r ?an a purpose describ$ 9 p>agraph 7#g71 7#ad71 7#ae71 or 7#af7 ( su* section1 & is o!rwise p]mitt$ "u ! contract4 7b7 ,?ird p>ties 7#a7 ,9 g5]al ,a ?ird p>ty may n process1 reta91 or transf] ?ird-p>ty data = a purpose o!r ?an-- 7,a7 9 ! case ( s5sitive cov]$ data-- 7i7 except z provid$ 9 clause 7ii71 a purpose = :i* an individual gave affirmative express cons5t pursuant to subsection 7b7 or 7c7 ( section #ajb2 or 7ii7 9 ! case ( s5sitive cov]$ data ) respect to :i* affirmative express cons5t is n requir$ pursuant to subsection 7b7 ( section #ajb1 a purpose = :i* ! cov]$ entity or s]vice provid] made a disclosure pursuant to section #ajd2 or 7,b7 9 ! case ( cov]$ data t is n s5sitive cov]$ data1 a purpose = :i* ! cov]$ entity or s]vice provid] made a disclosure pursuant to section #ajd4 7#b7 ,contract requirem5ts ,be=e transf]r+ cov]$ data to a ?ird p>ty1 a cov]$ entity or s]vice provid] %all ent] into a contract ) ! ?ird p>ty t-- 7,a7 id5tifies ! purposes = :i* cov]$ data is be+ transf]r$2 7,b7 specifies t ! ?ird p>ty may only use ! cov]$ data = su* purposes2 7,c7 ) respect to ! cov]$ data transf]r$1 requires ! ?ird p>ty to comply ) all applicable provisions (1 & regulations promulgat$ "u1 ?is title2 7,d7 requires ! ?ird p>ty to notify ! cov]$ entity or s]vice provid] if ! ?ird p>ty makes a det]m9ation t ! ?ird p>ty c no long] meet ! obligations ( ! ?ird p>ty "u ?is title2 & 7,e7 grants ! cov]$ entity or s]vice provid] ! "r1 ^u notice 7includ+ "u subp>agraph 7,d771 to take reasonable & appropriate /eps to /op & rem$iate unau?oriz$ use ( cov]$ data by ! ?ird p>ty4 7c7 ,rules ( con/ruction 7#a7 ,successive actor violations 7,a7 ,9 g5]al ,) respect to a violation ( ?is title by a s]vice provid] or ?ird p>ty reg>d+ cov]$ data receiv$ by ! s]vice provid] or ?ird p>ty f a cov]$ entity or ano!r s]vice provid]1 ! cov]$ entity or s]vice provid] t transf]r$ su* cov]$ data may n be consid]$ to be 9 violation ( ?is title if ! cov]$ entity or s]vice provid] transf]r$ ! cov]$ data 9 compliance ) ! requirem5ts ( ?is title &1 at ! "t ( transf]r+ su* cov]$ data1 did n h actual k1 or reason to believe1 t ! s]vice provid] or ?ird p>ty to :i* ! cov]$ data 0 transf]r$ int5d$ to violate ?is title4 7,b7 ,k ( violation ,a cov]$ entity or s]vice provid] t transf]s cov]$ data to a s]vice provid] or ?ird p>ty & has actual k1 or reason to believe1 t su* s]vice provid] or ?ird p>ty is violat+1 or is ab\t to violate1 ! requirem5ts ( ?is title %all imm$iately cease ! transf] ( cov]$ data to su* s]vice provid] or ?ird p>ty4 7#b7 ,prior actor violations ,an entity t collects1 processes1 reta9s1 or transf]s cov]$ data 9 compliance ) ! requirem5ts ( ?is title may n be consid]$ to be 9 violation ( ?is title z a result ( a violation by an entity f :i* x receives1 or on ^: behalf x collects1 processes1 reta9s1 or transf]s1 cov]$ data4 7d7 ,reasonable c>e 7#a7 ,s]vice provid] selection ,a cov]$ entity or s]vice provid] %all ex]cise reasonable c>e 9 select+ a s]vice provid]4 7#b7 ,transf] to ?ird p>ty ,a cov]$ entity or s]vice provid] %all ex]cise reasonable c>e 9 decid+ to transf] cov]$ data to a ?ird p>ty4 7#c7 ,guidance ,n lat] ?an #b ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all publi% guidance reg>d+ compliance ) ?is subsection4 7e7 ,rule ( con/ruction ,solely = purposes ( ?is section1 ! requirem5ts "u ?is section = s]vice provid]s to contract )1 assi/1 & foll[ ! in/ructions ( cov]$ entities %all also apply to any entity t collects1 processes1 reta9s1 or transf]s cov]$ data = ! purpose ( p]=m+ s]vices on behalf (1 or at ! direction (1 a gov]nm5t entity1 z ?\gh su* gov]nm5t entity 7 a cov]$ entity4 #aab4 ,data brok]s 7a7 ,notice ,a data brok] %all-- 7#a7 e/abli% & ma9ta9 a publicly available website2 & 7#b7 place a cle> & conspicu\s1 & n mislead+1 notice on su* publicly available website1 & any mobile application ( ! data brok]1 t-- 7,a7 /ates t ! entity is a data brok]2 7,b7 /ates t an individual may ex]cise a "r describ$ 9 section #aje or #ajf1 & includes a l9k or o!r tool to all[ an individual to ex]cise su* "r2 7,c7 includes a l9k to ! website describ$ 9 subsection 7c77#c72 7,d7 is reasonably accessible to & usable by individuals liv+ ) disabilities2 & 7,e7 is provid$ 9 any language 9 :i* ! data brok] provides products or s]vices4 7b7 ,prohibit$ practices ,a data brok] may n-- 7#a7 adv]tise or m>ket access to1 or ! transf] (1 cov]$ data = ! purposes (-- 7,a7 /alk+ or h>ass+ an individual2 or 7,b7 engag+ 9 fraud1 id5tity !ft1 or unfair or deceptive acts or practices2 or 7#b7 misrepres5t ! bus9ess practices ( ! data brok]4 7c7 ,data brok] regi/ration 7#a7 ,9 g5]al ,n lat] ?an ,janu>y #ca ( ea* cal5d> ye> t foll[s a cal5d> ye> dur+ :i* an entity act$ z a data brok] ) respect to m ?an #e1jjj individuals or devices t id5tify or are l9k$ or reasonably l9kable to an individual1 su* entity %all regi/] ) ! ,commission 9 accordance ) ?is subsection4 7#b7 ,regi/ration requirem5ts ,9 regi/]+ ) ! ,commission z requir$ "u p>agraph 7#a71 a data brok] %all d ! foll[+3 7,a7 ,pay to ! ,commission a regi/ration fee ( #ajj4 7,b7 ,provide ! ,commission ) ! foll[+ in=mation3 7i7 ,! legal "n & prim>y valid physical po/al address1 email address1 & int]net address ( ! data brok]4 7ii7 ,a description ( ! categories ( cov]$ data ! data brok] collects1 processes1 reta9s1 or transf]s4 7iii7 ,! contact in=mation ( ! data brok]1 includ+ ! "n ( a contact p]son1 a human-monitor$ telephone numb]1 a human-monitor$ e-mail address1 a website1 & a physical mail+ address4 7iv7 ,a l9k to a website ?r\gh :i* an individual may easily ex]cise ! rights describ$ 9 sections #aje & #ajf4 7#c7 ,data brok] regi/ry 7,a7 ,e/abli%m5t ,! ,commission %all e/abli% & ma9ta9 on a publicly available website a se>*able li/ ( data brok]s t are regi/]$ ) ! ,commission "u ?is subsection4 7,b7 ,requirem5ts ,! regi/ry e/abli%$ "u subp>agraph 7,a7 %all-- 7i7 all[ memb]s ( ! public to se>* = & id5tify data brok]s2 7ii7 include ! in=mation requir$ "u p>agraph 7#b77;,b7 = ea* data brok]2 7iii7 include a me*anism by :i* an individual1 includ+ a p>5t act+ on behalf ( a *ild ( ! p>5t1 may submit to all regi/]$ data brok]s a ,d ,n ,collect reque/ t results 9 regi/]$ data brok]s no long] collect+ cov]$ data relat$ to su* individual or *ild 7z applicable7 )\t ! affirmative express cons5t ( su* individual2 & 7iv7 include a me*anism by :i* an individual1 includ+ a p>5t act+ on behalf ( a *ild ( ! p>5t1 may submit to all regi/]$ data brok]s a ,delete ,my ,data reque/ t results 9 regi/]$ data brok]s delet+ all cov]$ data relat$ to su* individual or *ild 7z applicable7 t ! data brok] did n collect directly f su* individual or :5 act+ z a s]vice provid]4 7,c7 ,af=dability ,a data brok] may n *>ge an individual a fee to ex]cise a "r "u ?is p>agraph4 7#d7 ,d n collect & delete my data reque/s 7,a7 ,compliance ,subject to subp>agraph 7,b71 ea* data brok] t receives a reque/ f an individual1 includ+ a p>5t act+ on behalf ( a *ild ( ! p>5t1 us+ ! me*anism e/abli%$ "u p>agraph 7#c77;,b77iii7 or p>agraph 7#c77;,b77iv7 %all comply ) su* reque/ n lat] ?an #cj days aft] ! date on :i* ! reque/ is receiv$ by ! data brok]4 7,b7 ,exception ,a data brok] may decl9e to fulfill a reque/ f an individual1 if-- 7i7 ! data brok] has actual k t ! individual has be5 convict$ ( a crime relat$ to ! abduction or sexual exploitation ( a *ild2 & 7ii7 ! data collect$ by ! data brok] is necess>y-- 7,i7 to c>ry out a national or ,/ate-run sex (f5d] regi/ry2 or 7,,ii7 = ! ,national ,c5t] = ,miss+ & ,exploit$ ,*ildr54 #aac4 ,commission-approv$ compliance guidel9es 7a7 ,application = compliance guidel9e approval 7#a7 ,9 g5]al ,a cov]$ entity t is n a data brok] & is n a l>ge data hold]1 or a gr\p ( su* cov]$ entities1 may apply to ! ,commission = approval ( #a or m sets ( compliance guidel9es gov]n+ ! collection1 process+1 ret5tion1 or transf] ( cov]$ data by ! cov]$ entity or cov]$ entities4 7#b7 ,application requirem5ts ,an application "u p>agraph 7#a7 %all include-- 7,a7 a description ( h[ ! propos$ guidel9es w meet or exce$ ! applicable requirem5ts ( ?is title2 7,b7 a description ( ! entities or activities ! propos$ guidel9es are design$ to cov]2 7,c7 a li/ ( ! cov]$ entities1 to ! ext5t kn[n at ! "t ( application1 t int5d to adh]e to ! propos$ guidel9es2 7,d7 a description ( an indep5d5t organization1 n associat$ ) any ( ! int5d$ adh]+ cov]$ entities1 t w adm9i/] ! propos$ guidel9es2 & 7,e7 a description ( h[ su* int5d$ adh]+ entities w be assess$ = adh]5ce to ! propos$ guidel9es by ! indep5d5t organization describ$ 9 subp>agraph 7,d74 7#c7 ,commission review 7,a7 ,initial approval 7i7 ,public comm5t p]iod ,n lat] ?an #ij days aft] receipt ( an application reg>d+ propos$ guidel9es submitt$ pursuant to p>agraph 7#a71 ! ,commission %all publi% ! application & provide an opportunity = public comm5t on su* propos$ guidel9es4 7ii7 ,approval crit]ia ,! ,commission %all approve an application reg>d+ propos$ guidel9es submitt$ pursuant to p>agraph 7#a71 includ+ ! indep5d5t organization t w adm9i/] ! guidel9es1 if ! applicant demon/rates t ! propos$ guidel9es-- 7,i7 meet or exce$ ! applicable requirem5ts ( ?is title2 7,,ii7 provide = regul> review & validation by an indep5d5t organization to ensure t ! cov]$ entity or cov]$ entities adh]+ to ! guidel9es cont9ue to meet or exce$ ! applicable requirem5ts ( ?is title2 & 7,,iii7 include a means ( en=cem5t if a cov]$ entity does n meet or exce$ ! requirem5ts 9 ! guidel9es1 :i* may include ref]ral to ! ,commission = en=cem5t "u section #aae or ref]ral to ! appropriate ,/ate attorney g5]al = en=cem5t "u section #aaf4 7iii7 ,timel9e ,n lat] ?an #a ye> aft] ! date on :i* ! ,commission receives an application reg>d+ propos$ guidel9es pursuant to p>agraph 7#a71 ! ,commission %all issue a det]m9ation approv+ or d5y+ ! application1 includ+ ! relevant indep5d5t organization1 & provid+ ! reasons = approv+ or d5y+ ! application4 7,b7 ,approval ( modifications 7i7 ,9 g5]al ,if ! indep5d5t organization adm9i/]+ a set ( guidel9es approv$ "u subp>agraph 7,a7 makes significant *anges to ! guidel9es1 ! indep5d5t organization %all submit ! updat$ guidel9es to ! ,commission = approval4 ,z soon z feasible1 ! ,commission %all publi% ! updat$ guidel9es & provide an opportunity = public comm5t4 7ii7 ,timel9e ,! ,commission %all approve or d5y any significant *ange to guidel9es submitt$ "u clause 7i7 n lat] ?an #ahj days aft] ! date on :i* ! ,commission receives ! submission = approval4 7b7 ,)drawal ( approval 7#a7 ,9 g5]al ,if at any "t ! ,commission det]m9es t guidel9es previ\sly approv$ "u ?is section no long] meet ! applicable requirem5ts ( ?is title or t compliance ) ! approv$ guidel9es is insuffici5tly en=c$ by ! indep5d5t organization adm9i/]+ ! guidel9es1 ! ,commission %all notify ! relevant cov]$ entity or gr\p ( cov]$ entities & ! indep5d5t organization ( ! det]m9ation ( ! ,commission to )draw approval ( ! guidel9es1 includ+ ! basis = ! det]m9ation4 7#b7 ,opportunity to cure 7,a7 ,9 g5]al ,n lat] ?an #ahj days aft] receipt ( a notice "u p>agraph 7#a71 ! cov]$ entity or gr\p ( cov]$ entities & ! indep5d5t organization may cure any alleg$ defici5cy ) ! guidel9es or ! en=cem5t ( ! guidel9es & submit ea* propos$ cure to ! ,commission4 7,b7 ,effect on )drawal ( approval ,if ! ,commission det]m9es t cures propos$ "u subp>agraph 7,a7 elim9ate alleg$ defici5cies 9 ! guidel9es1 ! ,commission may n )draw ! approval ( su* guidel9es on ! basis ( su* defici5cies4 7c7 ,c]tification ,a cov]$ entity ) guidel9es approv$ by ! ,commission "u ?is section %all-- 7#a7 publicly self-c]tify t ! cov]$ entity is 9 compliance ) ! guidel9es2 & 7#b7 z "p ( ! self-c]tification "u p>agraph 7#a71 indicate ! indep5d5t organization responsible = assess+ compliance ) ! guidel9es4 7d7 ,rebuttable presumption ( compliance ,a cov]$ entity t is eligible to p>ticipate 9 guidel9es approv$ "u ?is section1 p>ticipates 9 ! guidel9es1 & is 9 compliance ) ! guidel9es %all be entitl$ to a rebuttable presumption t ! cov]$ entity is 9 compliance ) ! relevant provisions ( ?is title to :i* ! guidel9es apply4 7e7 ,eligibility ( s]vice provid]s ,?is section %all apply to a s]vice provid] t is n a l>ge data hold]1 or a gr\p ( su* s]vice provid]s1 9 ! same mann] z ?is section applies to a cov]$ entity or gr\p ( cov]$ entities4 ,su* a s]vice provid] or gr\p ( s]vice provid]s may apply = approval (1 & p>ticipate 91 ! same guidel9es z a cov]$ entity or gr\p ( cov]$ entities4 #aad4 ,privacy-enhanc+ te*nology pilot program 7a7 ,privacy-,enhanc+ te*nology def9$ ,9 ?is section1 ! t]m privacy-enhanc+ te*nology-- 7#a7 means any s(tw>e or h>dw>e solution1 cryptographic algori?m1 or o!r te*nical process ( extract+ ! value ( in=mation )\t sub/antially r$uc+ ! privacy & security ( ! in=mation2 & 7#b7 includes te*nologies ) functionality simil> to homomorphic encryption1 diff]5tial privacy1 z]o-k pro(s1 syn!tic data g5]ation1 f$]at$ le>n+1 & secure multi-p>ty computation4 7b7 ,e/abli%m5t ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all e/abli% & c>ry out a pilot program to enc\rage private sector use ( privacy-enhanc+ te*nologies = ! purposes ( protect+ cov]$ data to comply ) section #aji4 7c7 ,purposes ,"u ! pilot program e/abli%$ "u subsection 7b71 ! ,commission %all-- 7#a7 develop & implem5t a petition process = cov]$ entities to reque/ to be a "p ( ! pilot program2 & 7#b7 build an audit+ sy/em t lev]ages privacy-enhanc+ te*nologies to support ! en=cem5t actions ( ! ,commission4 7d7 ,petition process ,a cov]$ entity wi%+ to be accept$ into ! pilot program e/abli%$ "u subsection 7b7 %all demon/rate to ! ,commission t ! privacy-enhanc+ te*nologies to be us$ "u ! pilot program by ! cov]$ entity w e/abli% data security practices t meet or exce$ all or "s ( ! requirem5ts 9 section #aji4 ,if ! cov]$ entity demon/rates ! privacy-enhanc+ te*nologies meet or exce$ ! requirem5ts 9 section #aji1 ! ,commission may accept ! cov]$ entity to be a "p ( ! pilot program4 ,if ! ,commission does n accept a cov]$ entity to be a "p ( ! pilot program1 ! ,commission %all provide an adequate response to ! cov]$ entity detail+ :y ! cov]$ entity 0 n accept$1 & ! cov]$ entity may subsequ5tly revise ! petition ( ! cov]$ entity to address any defici5cies indicat$ by ! ,commission 9 ! response ( ! ,commission to ! cov]$ entity4 7e7 ,requirem5ts ,9 c>ry+ out ! pilot program e/abli%$ "u subsection 7b71 ! ,commission %all-- 7#a7 receive input f private1 public1 & academic /akehold]s2 & 7#b7 develop ongo+ public & private sector engagem5t1 9 consultation ) ! ,secret>y ( ,comm]ce1 to dissem9ate volunt>y1 cons5sus-bas$ res\rces to increase ! integration ( privacy-enhanc+ te*nologies 9 data collection1 %>+1 & analytics by ! public & private sectors4 7f7 ,conclusion ( pilot program ,! ,commission %all t]m9ate ! pilot program e/abli%$ "u subsection 7b7 n lat] ?an #aj ye>s aft] ! comm5cem5t ( ! program4 7g7 ,/udy requir$ 7#a7 ,9 g5]al ,! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all conduct a /udy-- 7,a7 to assess ! progress ( ! pilot program e/abli%$ "u subsection 7b72 7,b7 to det]m9e ! effectiv5ess ( us+ privacy-enhanc+ te*nologies at ! ,commission to support ov]sight ( ! data security practices ( cov]$ entities2 & 7,c7 to develop recomm5dations to improve & advance privacy-enhanc+ te*nologies1 includ+ by improv+ communication & coord9ation betwe5 cov]$ entities & ! ,commission to increase implem5tation ( privacy-enhanc+ te*nologies by su* entities & ! ,commission4 7#b7 ,initial brief+ ,n lat] ?an #c ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al %all brief ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate on ! initial results ( ! /udy conduct$ "u p>agraph 7#a74 7#c7 ,f9al report ,n lat] ?an #bdj days aft] ! date on :i* ! brief+ requir$ by p>agraph 7#b7 is conduct$1 ! ,comptroll] ,g5]al %all submit to ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate a f9al report sett+ =? ! results ( ! /udy conduct$ "u p>agraph 7#a71 includ+ ! recomm5dations develop$ "u subp>agraph 7,c7 ( su* p>agraph4 7h7 ,audit ( cov]$ entities ,! ,commission %all1 on an ongo+ basis1 audit cov]$ entities :o h be5 accept$ to be "p ( ! pilot program e/abli%$ "u subsection 7b7 to det]m9e :e!r su* a cov]$ entity is ma9ta9+ ! use & implem5tation ( privacy-enhanc+ te*nologies to secure cov]$ data4 7i7 ,)drawal f ! pilot program ,if at any "t ! ,commission det]m9es t a cov]$ entity accept$ to be a "p ( ! pilot program e/abli%$ "u subsection 7b7 is no long] ma9ta9+ ! use ( privacy-enhanc+ te*nologies1 ! ,commission %all notify ! cov]$ entity ( ! det]m9ation ( ! ,commission to )draw approval = ! cov]$ entity to be a "p ( ! pilot program & ! basis = do+ s4 ,n lat] ?an #ahj days aft] ! date on :i* a cov]$ entity receives su* notice1 ! cov]$ entity may cure any alleg$ defici5cy ) ! use ( privacy-enhanc+ te*nologies & submit ea* propos$ cure to ! ,commission4 ,if ! ,commission det]m9es t su* cures elim9ate alleg$ defici5cies ) ! use ( privacy-enhanc+ te*nologies1 ! ,commission may n )draw ! approval ( ! cov]$ entity to be a "p ( ! pilot program on ! basis ( su* defici5cies4 7j7 ,limitations on liability ,any cov]$ entity t petitions1 & is accept$1 to be "p ( ! pilot program e/abli%$ "u subsection 7b71 actively implem5ts & ma9ta9s ! use ( privacy-enhanc+ te*nologies1 & is det]m9$ by ! ,commission to be 9 compliance ) ! program %all-- 7#a7 = any action "u section #aae or #aaf = a violation ( section #aji1 be deem$ to be 9 compliance ) section #aji ) respect to ! cov]$ data subject to ! privacy-enhanc+ te*nologies2 & 7#b7 = any action "u section #aag = a violation ( section #aji1 be entitl$ to a rebuttable presumption t su* entity is 9 compliance ) section #aji ) respect to ! cov]$ data subject to ! privacy-enhanc+ te*nologies4 #aae4 ,en=cem5t by ,f$]al ,trade ,commission 7a7 ,new bureau 7#a7 ,9 g5]al ,subject to ! availability ( appropriations1 ! ,commission %all e/abli%1 )9 ! ,commission1 a new bureau comp>able 9 /ructure1 size1 organization1 & au?ority to ! exi/+ bureaus )9 ! ,commission relat$ to consum] protection & competition4 7#b7 ,mission ,! mission ( ! bureau e/abli%$ "u ?is subsection %all be to assi/ ! ,commission 9 ex]cis+ ! au?ority ( ! ,commission "u ?is title & relat$ au?orities4 7#c7 ,/aff 7,a7 ,9 g5]al ,9 /aff+ ! bureau e/abli%$ "u ?is subsection1 ! ,commission %all ensure ! allocation ( full "t employees or full "t employee equival5ts t include attorneys1 economi/s1 inve/igators1 te*nologi/s1 & m5tal heal? pr(essionals ) exp]i5ce 9 ! well-be+ ( *ildr5 & te5s4 7,b7 ,te*nologi/ def9$ ,= ! purposes ( ?is p>agraph1 ! t]m te*nologi/ means an individual ) tra9+ & exp]tise ) respect to te*nology1 includ+ /ate-(-! art in=mation te*nology1 network or data security1 h>dw>e or s(tw>e developm5t1 privacy-enhanc+ te*nologies1 cryptography1 comput] sci5ce1 data sci5ce1 adv]tis+ te*nology1 web track+1 ma*9e le>n+1 & o!r relat$ fields & applications4 7#d7 ,timel9e ,! bureau e/abli%$ "u ?is subsection %all be e/abli%$1 /aff$1 & fully op]ational n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is ,act4 7b7 ,en=cem5t by commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( ?is title or a regulation promulgat$ "u ?is title %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice prescrib$ "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,p[]s ( commission 7,a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#c7 or o!rwise provid$ 9 ?is title1 ! ,commission %all en=ce ?is title & ! regulations promulgat$ "u ?is title 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is title4 7,b7 ,privileges & immunities ,any entity t violates ?is title or a regulation promulgat$ "u ?is title %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,common c>ri]s & nonpr(its ,not)/&+ section #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd2 #de7;a77#b72 #df7 or any jurisdictional limitation ( ! ,commission1 ! ,commission %all also en=ce ?is title1 & ! regulations promulgat$ "u ?is title1 9 ! same mann] provid$ 9 p>agraphs 7#a7 & 7#b7 ( ?is subsection ) respect to-- 7,a7 common c>ri]s subject to title ,,ii ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bja et seq472 & 7,b7 organizations n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s4 7#d7 ,p5alty (fset = /ate or individual actions ,any am\nt t a c\rt ord]s an entity to pay 9 an action br\ght "u ?is subsection %all be (fset by any am\nt a c\rt has ord]$ ! entity to pay 9 an action br\ght aga9/ ! entity = ! same violation "u section #aaf or #aag4 7#e7 ,privacy & security victims relief fund 7,a7 ,e/abli%m5t ( victims relief fund ,!re is e/abli%$ 9 ! ,treasury ( ! ,unit$ ,/ates a sep>ate fund to be kn[n z ! ,privacy & ,security ,victims ,relief ,fund 79 ?is p>agraph ref]r$ to z ! ,victims ,relief ,fund74 7,b7 ,deposits ,! ,commission or ! ,attorney ,g5]al ( ! ,unit$ ,/ates1 z applicable1 %all deposit into ! ,victims ,relief ,fund ! am\nt ( any civil p5alty obta9$ 9 any civil action ! ,commission1 or ! ,attorney ,g5]al on behalf ( ! ,commission1 comm5ces to en=ce ?is title or a regulation promulgat$ "u ?is title4 7,c7 ,use ( fund am\nts 7i7 ,availability to ! commission ,not)/&+ section #ccjb ( title #ca1 ,unit$ ,/ates ,code1 am\nts 9 ! ,victims ,relief ,fund %all be available to ! ,commission1 )\t fiscal ye> limitation1 to provide r$ress1 damages1 paym5ts or comp5sation1 or o!r monet>y relief to p]sons affect$ by an act or practice = :i* civil p5alties1 o!r monet>y relief1 or any o!r =ms ( relief 7includ+ injunctive relief7 h be5 ord]$ 9 a civil action or adm9i/rative proce$+ ! ,commission comm5ces1 or 9 any civil action ! ,attorney ,g5]al ( ! ,unit$ ,/ates comm5ces on behalf ( ! ,commission1 to en=ce ?is title or a regulation promulgat$ "u ?is title4 7ii7 ,o!r p]missible uses ,to ! ext5t t individuals _c be locat$ or su* r$ress1 damages1 paym5ts or comp5sation1 or o!r monet>y relief are o!rwise n practicable1 ! ,commission may use am\nts 9 ! ,victims ,relief ,fund = ! purpose (-- 7,i7 consum] or bus9ess education relat+ to data privacy or data security2 or 7,,ii7 engag+ 9 te*nological rese>* t ! ,commission consid]s necess>y to implem5t ?is title1 includ+ promot+ privacy-enhanc+ te*nologies t promote compliance ) ?is title4 7,d7 ,calculation ,any am\nt t ! ,commission provides to a p]son z r$ress1 paym5ts or comp5sation1 or o!r monet>y relief "u subp>agraph 7,c7 ) respect to a violation by an entity %all be (fset by any am\nt ! p]son receiv$ f an action br\ght aga9/ ! entity = ! same violation "u section #aaf or #aag4 7,e7 ,rule ( con/ruction ,am\nts collect$ & deposit$ 9 ! ,victims ,relief ,fund may n be con/ru$ to be ,gov]nm5t funds or appropriat$ monies & may n be subject to apportionm5t = ! purpose ( *apt] #ae ( title #ca1 ,unit$ ,/ates ,code1 or "u any o!r au?ority4 7c7 ,report 7#a7 ,9 g5]al ,n lat] ?an #d ye>s aft] ! date ( ! enactm5t ( ?is ,act1 & annually !reaft]1 ! ,commission %all submit to ,congress a report describ+ inve/igations conduct$ dur+ ! prior ye> ) respect to violations ( ?is title1 includ+-- 7,a7 ! numb] ( su* inve/igations ! ,commission comm5c$2 7,b7 ! numb] ( su* inve/igations ! ,commission clos$ ) no (ficial ag5cy action2 7,c7 ! disposition ( su* inve/igations1 if su* inve/igations h conclud$ & result$ 9 (ficial ag5cy action2 & 7,d7 = ea* inve/igation t 0 clos$ ) no (ficial ag5cy action1 ! indu/ry sectors ( ! cov]$ entities subject to ea* inve/igation4 7#b7 ,privacy protections ,a report requir$ "u p>agraph 7#a7 may n include ! id5tity ( any p]son :o is ! subject ( an inve/igation or any o!r in=mation t id5tifies su* a p]son4 7#c7 ,annual plan ,n lat] ?an #edj days aft] ! date ( ! enactm5t ( ?is ,act1 & annually !reaft]1 ! ,commission %all submit to ,congress a plan = ! next cal5d> ye> describ+ ! project$ activities ( ! ,commission "u ?is title1 includ+-- 7,a7 ! policy priorities ( ! ,commission & any *anges to ! previ\s policy priorities ( ! ,commission2 7,b7 any rulemak+ proce$+s project$ to be comm5c$1 includ+ any su* proce$+s to am5d or repeal a rule2 7,c7 any plans to develop1 update1 or )draw guidel9es or guidance requir$ "u ?is title2 7,d7 any plans to re/ructure ! ,commission2 & 7,e7 project$ dates & timel9es1 or *anges to project$ dates & timel9es1 associat$ ) any ( ! requirem5ts "u ?is title4 #aaf4 ,en=cem5t by ,/ates 7a7 ,civil action 7#a7 ,9 g5]al ,9 any case 9 :i* ! attorney g5]al ( a ,/ate1 ! *ief consum] protection (fic] ( a ,/ate1 or an (fic] or (fice ( a ,/ate au?oriz$ to en=ce privacy or data security laws applicable to cov]$ entities or s]vice provid]s has reason to believe t an int]e/ ( ! resid5ts ( ! ,/ate has be5 or is adv]sely affect$ by ! engagem5t ( any entity 9 an act or practice t violates ?is title or a regulation promulgat$ "u ?is title1 ! attorney g5]al1 *ief consum] protection (fic]1 or o!r au?oriz$ (fic] or (fice ( ! ,/ate may br+ a civil action 9 ! "n ( ! ,/ate1 or z p>5s patriae on behalf ( ! resid5ts ( ! ,/ate1 9 an appropriate ,f$]al di/rict c\rt ( ! ,unit$ ,/ates to-- 7,a7 enjo9 su* act or practice2 7,b7 en=ce compliance ) ?is title or ! regulations promulgat$ "u ?is title2 7,c7 obta9 civil p5alties2 7,d7 obta9 damages1 re/itution1 or o!r comp5sation on behalf ( ! resid5ts ( ! ,/ate2 7,e7 obta9 reasonable attorney's fees & o!r litigation co/s reasonably incurr$2 or 7,f7 obta9 su* o!r relief z ! c\rt may consid] to be appropriate4 7#b7 ,limitation ,9 any case ) respect to :i* ! attorney g5]al ( a ,/ate1 ! *ief consum] protection (fic] ( a ,/ate1 or an (fic] or (fice ( a ,/ate au?oriz$ to en=ce privacy or data security laws applicable to cov]$ entities or s]vice provid]s br+s an action "u p>agraph 7#a71 no o!r (fic] or (fice ( ! same ,/ate may in/itute a civil action "u p>agraph 7#a7 aga9/ ! same def5dant = ! same violation ( ?is title or regulation promulgat$ "u ?is title4 7b7 ,rights ( ! commission 7#a7 ,9 g5]al ,except if n feasible1 a ,/ate (fic] %all notify ! ,commission 9 writ+ prior to initiat+ a civil action "u subsection 7a74 ,su* notice %all include a copy ( ! compla9t to be fil$ to initiate su* action4 ,^u receiv+ su* notice1 ! ,commission may int]v5e 9 su* action &1 ^u int]v5+-- 7,a7 be he>d on all matt]s aris+ 9 su* action2 & 7,b7 file petitions = appeal ( a decision 9 su* action4 7#b7 ,notification timel9e ,if n feasible = a ,/ate (fic] to provide ! notification requir$ by p>agraph 7#a7 be=e initiat+ a civil action "u subsection 7a71 ! ,/ate (fic] %all notify ! ,commission imm$iately aft] initiat+ ! civil action4 7c7 ,actions by ! commission ,9 any case 9 :i* a civil action is in/itut$ by or on behalf ( ! ,commission = a violation ( ?is title or a regulation promulgat$ "u ?is title1 no attorney g5]al ( a ,/ate1 *ief consum] protection (fic] ( a ,/ate1 or (fic] or (fice ( a ,/ate au?oriz$ to en=ce privacy or data security laws may1 dur+ ! p5d5cy ( su* action1 in/itute a civil action aga9/ any def5dant nam$ 9 ! compla9t 9 ! action in/itut$ by or on behalf ( ! ,commission = a violation ( ?is title or a regulation promulgat$ "u ?is title t is alleg$ 9 su* compla9t4 7d7 ,inve/igatory p[]s ,no?+ 9 ?is title may be con/ru$ to prev5t ! attorney g5]al ( a ,/ate1 ! *ief consum] protection (fic] ( a ,/ate1 or an (fic] or (fice ( a ,/ate au?oriz$ to en=ce privacy or data security laws applicable to cov]$ entities or s]vice provid]s f ex]cis+ ! p[]s conf]r$ on su* (fic] or (fice to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7e7 ,v5ue2 s]vice ( process 7#a7 ,v5ue ,any action br\ght "u subsection 7a7 may be br\ght 9 any ,f$]al di/rict c\rt ( ! ,unit$ ,/ates t meets applicable requirem5ts relat+ to v5ue "u section #acia ( title #bh1 ,unit$ ,/ates ,code4 7#b7 ,s]vice ( process ,9 an action br\ght "u subsection 7a71 process may be s]v$ 9 any di/rict 9 :i* ! def5dant-- 7,a7 is an inhabitant2 or 7,b7 may be f\nd4 7f7 ,,gao /udy 7#a7 ,9 g5]al ,! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all conduct a /udy ( ! practice ( ,/ate attorneys g5]al hir+1 or o!rwise contract+ )1 outside firms to assi/ 9 en=cem5t ef=ts pursuant to ?is title1 :i* %all include ! /udy (-- 7,a7 ! frequ5cy ) :i* ea* ,/ate attorney g5]al hires or contracts ) outside firms to assi/ 9 su* en=cem5t ef=ts2 7,b7 ! cont+5cy fees1 h\rly rates1 & o!r co/s ( hir+ or contract+ ) outside firms2 7,c7 ! types ( matt]s = :i* outside firms are hir$ or contract$2 7,d7 ! bid & selection process = su* outside firms1 includ+ reviews ( conflicts ( int]e/2 7,e7 ! practices ,/ate attorneys g5]al set 9 place to protect s5sitive in=mation t w\ld become accessible by outside firms :ile ! outside firms are assi/+ 9 su* en=cem5t ef=ts2 7,f7 ! p]c5tage ( monet>y recov]y t is return$ to victims & ! p]c5tage ( su* recov]y t is reta9$ by outside firms2 & 7,g7 ! m>ket av]age = ! h\rly rate ( hir$ or contract$ attorneys 9 ea* m>ket4 7#b7 ,report ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al %all submit to ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate a report on ! results ( ! /udy conduct$ "u p>agraph 7#a74 7g7 ,pres]vation ( /ate p[]s ,except z provid$ 9 subsections 7a77#b7 & 7c71 no provision ( ?is section may be con/ru$ z alt]+1 limit+1 or affect+ ! au?ority ( a ,/ate attorney g5]al1 ! *ief consum] protection (fic] ( a ,/ate1 or an (fic] or (fice ( a ,/ate au?oriz$ to en=ce laws applicable to cov]$ entities or s]vice provid]s to-- 7#a7 br+ an action or o!r regulatory proce$+ aris+ solely "u ! laws 9 effect 9 su* ,/ate2 or 7#b7 ex]cise ! p[]s conf]r$ on ! attorney g5]al1 *ief consum] protection (fic]1 or (fic] or (fice by ! laws ( su* ,/ate1 includ+ ! ability to conduct inve/igations1 to adm9i/] oa?s or affirmations1 or to compel ! att5dance ( witnesses or ! production ( docum5t>y or o!r evid5ce4 7h7 ,calculation ,any am\nt t a c\rt ord]s an entity to pay to a p]son "u ?is section %all be (fset by any am\nt ! p]son receiv$ f an action br\ght aga9/ ! entity = ! same violation "u section #aae or #aag4 #aag4 ,en=cem5t by p]sons 7a7 ,civil action 7#a7 ,9 g5]al ,subject to subsections 7b7 & 7c71 a p]son may br+ a civil action aga9/ a cov]$ entity or s]vice provid] = a violation ( subsection 7b7 or 7c7 ( section #ajb1 subsection 7a7 or 7e7 ( section #ajd1 section #aje1 subsection 7a7 or 7b77#b7 ( section #ajf1 section #ajg1 section #ajh1 section #aji to ! ext5t su* action alleges a data brea* aris+ f a violation ( subsection 7a7 ( su* section1 subsection 7d7 ( section #aaa1 or subsection 7c77#d7 ( section #aab1 or a regulation promulgat$ !reund]1 9 an appropriate ,f$]al di/rict c\rt ( ! ,unit$ ,/ates4 7#b7 ,relief 7,a7 ,9 g5]al ,9 a civil action br\ght "u p>agraph 7#a7 9 :i* ! pla9tiff prevails1 ! c\rt may aw>d ! pla9tiff-- 7i7 an am\nt equal to ! sum ( any actual damages2 7ii7 injunctive relief1 includ+ an ord] t an entity retrieve any cov]$ data transf]r$ 9 violation ( ?is title2 7iii7 decl>atory relief2 & 7iv7 reasonable attorney fees & litigation co/s4 7,b7 ,biometric & g5etic in=mation ,9 a civil action br\ght "u p>agraph 7#a7 = a violation ( ?is title ) respect to section #ajb7;c71 9 :i* ! pla9tiff prevails1 if ! conduct und]ly+ ! violation occurr$ prim>ily & sub/antially 9 ,ill9ois1 ! c\rt may aw>d ! pla9tiff-- 7i7 = a violation involv+ biometric in=mation1 ! same relief z set =? 9 section #bj ( ! ,biometric ,in=mation ,privacy ,act 7#gdj ,,ilcs #ad_/bj71 z su* /atute reads on ,decemb] #ca1 #bjbd2 or 7ii7 = a violation involv+ g5etic in=mation1 ! same relief z set =? 9 section #dj ( ! ,g5etic ,in=mation ,privacy ,act 7#daj ,,ilcs #eac_/dj71 z su* /atute reads on ,decemb] #ca1 #bjbd4 7,c7 ,data security 7i7 ,9 g5]al ,9 a civil action br\ght "u p>agraph 7#a7 = a violation ( ?is title alleg+ unau?oriz$ access ( cov]$ in=mation z a result ( a violation ( section #aji7;a71 9 :i* ! pla9tiff prevails1 ! c\rt may aw>d a pla9tiff :o is a resid5t ( ,cali=nia ! same relief z set =? 9 section #agih4aej ( ! ,cali=nia ,civil ,code1 z su* /atute read on ,janu>y #a1 #bjbd4 7ii7 ,cov]$ in=mation def9$ ,= purposes ( ?is subp>agraph1 ! t]m cov]$ in=mation means ! foll[+3 7,i7 ,a us]name1 email address1 or telephone numb] ( an individual 9 comb9ation ) a password or security "q or answ] t w\ld p]mit access to an acc\nt held by ! individual t conta9s or provides access to s5sitive cov]$ data4 7,,ii7 ,! fir/ "n or fir/ initial ( an individual & ! la/ "n ( ! individual 9 comb9ation ) #a or m ( ! foll[+ categories ( s5sitive cov]$ data1 if ei!r ! "n or ! s5sitive cov]$ data are n encrypt$ or r$act$3 7aa7 ,a gov]nm5t-issu$ id5tifi] describ$ 9 section #aja7di77;,a77i74 7bb7 ,a f9ancial acc\nt numb] describ$ 9 section #aja7di77;,a77iv74 7cc7 ,heal? in=mation1 b only to ! ext5t su* in=mation reveals ! hi/ory ( m$ical treatm5t or diagnosis by a heal? c>e pr(essional ( ! individual4 7dd7 ,biometric in=mation4 7ee7 ,g5etic in=mation4 7,d7 ,limitations on dual actions ,any am\nt t a c\rt ord]s an entity to pay to a p]son "u subp>agraph 7,a77i71 7,b71 or 7,c7 %all be (fset by any am\nt ! p]son receiv$ f an action br\ght aga9/ ! entity = ! same violation "u section #aae or #aaf4 7b7 ,opportunity to cure 9 actions = injunctive relief 7#a7 ,notice ,subject to p>agraph 7#c71 an action = injunctive relief may be br\ght by a p]son "u ?is section only if1 prior to initiat+ su* action aga9/ an entity1 ! p]son provides to ! entity writt5 notice id5tify+ ! specific provisions ( ?is title ! p]son alleges h be5 or are be+ violat$4 7#b7 ,effect ( cure ,9 ! ev5t a cure is possible ) respect to a violation alleg$ 9 a notice describ$ 9 p>agraph 7#a7 &1 n lat] ?an #fj days aft] ! date ( receipt ( su* notice1 ! entity cures su* violation & provides ! p]son an express writt5 /atem5t t ! violation has be5 cur$ & t no fur!r su* violations %all occur1 an action = injunctive relief may n be p]mitt$ ) respect to ! notic$ violation4 7#c7 ,injunctive relief = a sub/antial privacy h>m ,notice is n requir$ "u p>agraph 7#a7 prior to br++ an action = injunctive relief = a violation t result$ 9 a sub/antial privacy h>m4 7c7 ,notice ( actions seek+ actual damages 7#a7 ,notice ,subject to p>agraph 7#d71 an action "u ?is section = actual damages may be br\ght by a p]son only if1 #fj days prior to initiat+ su* action aga9/ an entity1 ! p]son provides ! entity writt5 notice id5tify+ ! specific provisions ( ?is title ! p]son alleges h be5 or are be+ violat$4 7#b7 ,settlem5t ,an entity t receives a writt5 notice f a p]son "u p>agraph 7#a7 may settle ) ! p]son :o s5t ! writt5 notice4 7#c7 ,effect ( settlem5t ,9 ! ev5t ( a settlem5t "u p>agraph 7#b71 ! t]ms ( su* settlem5t %all gov]n any future action "u ?is section = actual damages betwe5 ! p>ties to ! settlem5t t relates to ! und]ly+ facts t result$ 9 ! settlem5t4 7#d7 ,no notice requir$ = a sub/antial privacy h>m ,notice is n requir$ "u p>agraph 7#a7 prior to br++ an action = actual damages = a violation ( ?is title t result$ 9 a sub/antial privacy h>m1 if su* action includes a claim = a prelim9>y injunction or tempor>y re/ra9+ ord]4 7d7 ,pre-,dispute arbitration agreem5ts 7#a7 ,9 g5]al ,not)/&+ any o!r provision ( law1 at ! election ( ! p]son alleg+ a violation ( ?is title1 no pre-dispute arbitration agreem5t %all be valid or en=ceable ) respect to-- 7,a7 a claim alleg+ a violation involv+ an individual "u ! age ( #ah2 or 7,b7 a claim alleg+ a violation t result$ 9 a sub/antial privacy h>m4 7#b7 ,det]m9ation ( applicability ,any issue z to :e!r ?is subsection applies to a dispute %all be det]m9$ "u ,f$]al law4 ,! applicability ( ?is subsection to an agreem5t to arbitrate & ! validity & en=ceability ( an agreem5t to :i* ?is subsection applies %all be det]m9$ by a ,f$]al c\rt1 r ?an an arbitrator1 irrespective ( :e!r ! p>ty resi/+ arbitration *all5ges ! arbitration agreem5t specifically or 9 conjunction ) o!r t]ms ( ! contract conta9+ ! agreem5t1 & irrespective ( :e!r ! agreem5t purports to delegate ! det]m9ation to an arbitrator4 7#c7 ,pre-dispute arbitration agreem5t def9$ ,= purposes ( ?is subsection1 ! t]m pre-dispute arbitration agreem5t means any agreem5t to arbitrate a dispute t has n aris5 at ! "t ( ! mak+ ( ! agreem5t4 7e7 ,comb9$ notices ,a p]son may comb9e ! notices requir$ by subsections 7b77#a7 & 7c77#a7 into a s+le notice1 if ! s+le notice complies ) ! requirem5ts ( ea* su* subsection4 7f7 ,bad fai? ,if a p]son repres5t$ by c\nsel br+s a civil action "u ?is section aga9/ a cov]$ entity or s]vice provid] reque/+ actual damages f ! cov]$ entity or s]vice provid]1 & fails to provide notice to ! cov]$ entity or s]vice provid] 9 accordance ) ?is section1 ! action may be dismiss$ )\t prejudice & may n be re9/at$ until ! p]son has compli$ ) ! notice requirem5ts ( ?is section4 #aah4 ,relation to o!r laws 7a7 ,preemption ( /ate laws 7#a7 ,congressional int5t ,! purposes ( ?is section are to-- 7,a7 e/abli% a uni=m national privacy & data security /&>d 9 ! ,unit$ ,/ates to prev5t adm9i/rative co/s & burd5s f be+ plac$ on int]/ate comm]ce2 & 7,b7 expressly preempt ! laws ( a ,/ate or political subdivision ( a ,/ate z provid$ 9 ?is subsection4 7#b7 ,preemption ,except z provid$ 9 p>agraphs 7#c7 & 7#d71 no ,/ate or political subdivision ( a ,/ate may adopt1 ma9ta91 en=ce1 impose1 or cont9ue 9 effect any law1 regulation1 rule1 requirem5t1 prohibition1 /&>d1 or o!r provision cov]$ by ! provisions ( ?is title or a rule1 regulation1 or requirem5t promulgat$ "u ?is title4 7#c7 ,/ate law pres]vation ,p>agraph 7#b7 may n be con/ru$ to preempt1 displace1 or supplant ! foll[+ ,/ate laws1 rules1 regulations1 or requirem5ts3 7,a7 ,consum] protection laws ( g5]al applicability1 su* z laws regulat+ deceptive1 unfair1 or unconscionable practices4 7,b7 ,civil rights laws4 7,c7 ,provisions ( laws t address ! privacy rights or o!r protections ( employees or employee in=mation4 7,d7 ,provisions ( laws t address ! privacy rights or o!r protections ( /ud5ts or /ud5t in=mation4 7,e7 ,provisions ( laws1 ins(> z su* provisions address notification requirem5ts 9 ! ev5t ( a data brea*4 7,f7 ,contract or tort law4 7,g7 ,crim9al laws4 7,h7 ,civil laws reg>d+-- 7i7 blackmail2 7ii7 /alk+ 7includ+ cyb]/alk+72 7iii7 cyb]bully+2 7iv7 intimate images 7:e!r au!ntic or comput]-g5]at$7 kn[n to be noncons5sual2 7v7 *ild abuse2 7vi7 *ild sexual abuse mat]ial2 7vii7 *ild abduction or attempt$ *ild abduction2 7viii7 *ild traffick+2 or 7ix7 sexual h>assm5t4 7,i7 ,public safety or sector-specific laws unrelat$ to privacy or data security1 b only to ! ext5t su* laws d n directly conflict ) ! provisions ( ?is title4 7,j7 ,provisions ( laws t address public records1 crim9al ju/ice in=mation sy/ems1 arre/ records1 mug %ots1 conviction records1 or non-conviction records4 7,k7 ,provisions ( laws t address bank+ records1 f9ancial records1 tax records1 ,social ,security numb]s1 cr$it c>ds1 id5tity !ft1 cr$it report+ & inve/igations1 cr$it repair1 cr$it cl9ics1 or *eck-ca%+ s]vices4 7,l7 ,provisions ( laws t address electronic surveillance1 wiretapp+1 or telephone monitor+4 7,m7 ,provisions ( laws t address unsolicit$ email messages1 telephone solicitation1 or call] id5tification4 7,n7 ,provisions ( laws t protect ! privacy ( heal? in=mation1 heal?c>e in=mation1 m$ical in=mation1 m$ical records1 ,,hiv /atus1 or ,,hiv te/+4 7,o7 ,provisions ( laws t address ! confid5tiality ( libr>y records4 7,p7 ,provisions ( laws t address ! use ( encryption z a means ( provid+ data security4 7#d7 ,additional preemption limitations ,not)/&+ p>agraph 7#b71 ! provisions ( ?is title %all preempt any ,/ate law1 rule1 or regulation t provides protections = *ildr5 or te5s only to ! ext5t t su* ,/ate law1 rule1 or regulation conflicts ) a provision ( ?is title4 ,no?+ 9 ?is title %all be con/ru$ to prohibit any ,/ate f enact+ a law1 rule1 or regulation t provides great] protection to *ildr5 or te5s ?an ! provisions ( ?is title4 7b7 ,f$]al law pres]vation 7#a7 ,9 g5]al ,no?+ 9 ?is title or a regulation promulgat$ "u ?is title may be con/ru$ to limit-- 7,a7 ! au?ority ( ! ,commission1 or any o!r ,executive ag5cy1 "u any o!r provision ( law2 7,b7 any requirem5t = a common c>ri] subject to section #fd4bjaa ( title #dg1 ,code ( ,f$]al ,regulations 7or any successor regulation71 reg>d+ in=mation security brea*es2 or 7,c7 any o!r provision ( ,f$]al law1 except z o!rwise provid$ 9 ?is title4 7#b7 ,antitru/ sav+s clause 7,a7 ,antitru/ laws def9$ ,= purposes ( ?is p>agraph1 ! t]m antitru/ laws-- 7i7 has ! mean+ giv5 su* t]m 9 subsection 7a7 ( ! fir/ section ( ! ,clayton ,act 7#ae ,u4,s4,c4 #ab7;a772 & 7ii7 includes section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de71 to ! ext5t su* section applies to unfair me?ods ( competition4 7,b7 ,full application ( ! antitru/ laws ,no?+ 9 ?is title or a regulation promulgat$ "u ?is title may be con/ru$ to modify1 impair1 sup]s$e ! op]ation (1 or preclude ! application ( ! antitru/ laws4 7#c7 ,application ( o!r ,f$]al privacy & data security requirem5ts 7,a7 ,9 g5]al ,to ! ext5t t a cov]$ entity or s]vice provid] is requir$ to comply ) any ,f$]al law or regulation describ$ 9 subp>agraph 7,b71 su* cov]$ entity or s]vice provid] is n subject to ?is title ) respect to ! activities gov]n$ by ! requirem5ts ( su* law or regulation4 7,b7 ,laws & regulations describ$ ,! ,f$]al laws & regulations describ$ 9 ?is subp>agraph are ! foll[+3 7i7 ,title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7ii7 ,"p ,c ( title ,,xi ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq474 7iii7 ,subtitle ,d ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agiba et seq474 7iv7 ,! regulations promulgat$ pursuant to section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 7v7 ,! requirem5ts reg>d+ ! confid5tiality ( sub/ance use disord] in=mation "u section #edc ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bij;dd-#b7 or any regulation promulgat$ "u su* section4 7vi7 ,! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq474 7vii7 ,section #ddd ( ! ,g5]al ,education ,provisions ,act 7commonly kn[n z ! ,family ,educational ,rights & ,privacy ,act ( #aigd7 7#bj ,u4,s4,c4 #abcb;g7 & "p #ii ( title #cd1 ,code ( ,f$]al ,regulations 7or any successor regulation71 to ! ext5t a cov]$ entity or s]vice provid] is an educational ag5cy or in/itution 7z def9$ 9 su* section or section #ii4c ( title #cd1 ,code ( ,f$]al ,regulations 7or any successor regulation774 7viii7 ,! regulations relat$ to ! protection ( human subjects "u "p #df ( title #de1 ,code ( ,f$]al ,regulations4 7x7 ,! ,heal? ,c>e ,quality ,improvem5t ,act ( #aihf 7#db ,u4,s4,c4 #aaaja et seq474 7xi7 ,"p ,c ( title ,,ix ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bii;b-#ba et seq474 7xii7 ,*apt] #abc ( title #ah1 ,unit$ ,/ates ,code4 7,c7 ,implem5tation guidance ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all issue guidance ) respect to ! implem5tation ( ?is p>agraph4 7c7 ,pres]vation ( common law or /atutory causes ( action = civil relief ,no?+ 9 ?is title1 nor any am5dm5t1 /&>d1 rule1 requirem5t1 assessm5t1 or regulation promulgat$ "u ?is title1 may be con/ru$ to preempt1 displace1 or supplant any ,f$]al or ,/ate common law rights or rem$ies1 or any ,/ate /atute creat+ a rem$y = civil relief1 includ+ any cause ( action = p]sonal injury1 wrongful dea?1 prop]ty damage1 or o!r f9ancial1 physical1 reputational1 or psy*ological injury bas$ 9 neglig5ce1 /rict liability1 products liability1 failure to w>n1 an objectively (f5sive intrusion into ! private affairs or conc]ns ( an individual1 or any o!r legal !ory ( liability "u any ,f$]al or ,/ate common law1 or any ,/ate /atutory law1 except t ! fact ( a violation ( ?is title or a regulation promulgat$ "u ?is title may n be plead$ z an elem5t ( any violation ( su* law4 7d7 ,nonapplication ( c]ta9 provisions ( ,communications ,act ( #aicd & ,telecommunications ,act ( #aiif relat$ to ,,fcc privacy & data security laws & regulations 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b71 sections #bja1 #bjb1 #bbb1 #cch7;i71 & #fca ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bja2 #bjb2 #bbb2 #cch7;i72 #eea7 & section #gjf ( ! ,telecommunications ,act ( #aiif 7#dg ,u4,s4,c4 #acjb71 & any regulation or ord] issu$ by ! ,f$]al ,communications ,commission "u any su* section1 d n apply to any cov]$ entity or s]vice provid] ) respect to ! collection1 process+1 ret5tion1 transf]1 or security ( cov]$ data 7or ! equival5t ( su* data71 to ! ext5t t su* sections or any regulation or ord] issu$ "u su* sections w\ld o!rwise cov] ! collection1 process+1 ret5tion1 transf]1 or security ( cov]$ data 7or ! equival5t ( su* data7 9 ord] to protect consum] privacy or ! security ( su* data1 & a cov]$ entity or s]vice provid] %all in/ead be cov]$ by ! requirem5ts ( ?is title ) respect to ! collection1 process+1 ret5tion1 transf]1 & security ( cov]$ data4 7#b7 ,exceptions ,p>agraph 7#a7 does n sup]s$e any au?ority ( ! ,f$]al ,communications ,commission ) respect to ! foll[+3 7,a7 ,em]g5cy s]vices 7z def9$ 9 section #g ( ! ,wireless ,communications & ,public ,safety ,act ( #aiii 7#dg ,u4,s4,c4 #fae;b774 7,b7 ,proce$+s to implem5t section #bbg ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbg7 or ! ,pallone-,?une ,telephone ,robocall ,abuse ,crim9al ,en=cem5t & ,det]r5ce ,act 7,public ,law #aaf-aje2 #acc ,/at4 #cbgd71 or any o!r au?ority us$ by ! ,f$]al ,communications ,commission to prev5t or r$uce unwant$ telephone calls or text messages4 7,c7 ,an en=cem5t action alleg+ or f9d+ a violation ( a section ( ! ,communications ,act ( #aicd specifi$ 9 p>agraph 7#a71 if su* action 0 adopt$ by ! ,f$]al ,communications ,commission prior to ! date ( ! enactm5t ( ?is ,act4 7,d7 ,subsection 7a7 ( section #bbb ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbb71 to ! ext5t su* subsection imposes a duty on e telecommunications c>ri] to protect ! confid5tiality ( propriet>y in=mation (1 & relat+ to1 o!r telecommunications c>ri]s & equipm5t manufactur]s4 7,e7 ,subsections 7b71 7d71 & 7g7 ( section #bbb ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbb74 7,f7 ,any obligation ( an int]national treaty relat$ to ! ex*ange ( traffic implem5t$ & en=c$ by ! ,f$]al ,communications ,commission4 #aai4 ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih ,no?+ 9 ?is title may be con/ru$ to relieve or *ange any obligation t a cov]$ entity or o!r p]son may h "u ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq474 #abj4 ,data protections = cov]$ m9ors 7a7 ,prohibition on t>get$ & fir/-,p>ty adv]tis+ to cov]$ m9ors ,a cov]$ entity or s]vice provid] act+ on behalf ( a cov]$ entity may n engage 9 t>get$ adv]tis+ or fir/-p>ty adv]tis+ to an individual if ! cov]$ entity has k t ! individual is a cov]$ m9or1 except t a cov]$ entity or s]vice provid] may pres5t or display to a cov]$ m9or age-appropriate adv]tisem5ts int5d$ = an audi5ce ( cov]$ m9ors1 if ! cov]$ entity or s]vice provid] does n use any cov]$ data 9 relation to su* adv]tisem5ts1 o!r ?an data relat+ to ! /atus ( ! individual z a cov]$ m9or4 7b7 ,data transf] requirem5ts relat$ to cov]$ m9ors 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b71 & not)/&+ section #ajb7;b71 a cov]$ entity or a s]vice provid] act+ on behalf ( a cov]$ entity may n transf] or direct a s]vice provid] to transf] ! cov]$ data ( an individual to a ?ird p>ty if ! cov]$ entity-- 7,a7 has k t ! individual is a cov]$ m9or2 & 7,b7 has n obta9$ affirmative express cons5t1 unless ! transf] is necess>y1 proportionate1 & limit$ to a purpose expressly p]mitt$ by p>agraph 7#b71 7#c71 7#d71 7#h71 7#i71 7#aa71 7#ab71 or 7#ac7 ( section #ajb7;d74 7#b7 ,exception ,a cov]$ entity or s]vice provid] may collect1 process1 reta91 or transf] cov]$ data ( an individual t ! cov]$ entity or s]vice provid] kn[s is a cov]$ m9or 9 ord] to submit in=mation relat+ to *ild victimization to law en=cem5t or to ! nonpr(it1 national res\rce c5t] & cle>+h\se congressionally designat$ to provide assi/ance to victims1 families1 *ild-s]v+ pr(essionals1 & ! g5]al public on miss+ & exploit$ *ildr5 issues4 7c7 ,rulemak+ ,! ,commission may conduct a rulemak+ pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code1 to e/abli% processes = p>5ts & te5s to ex]cise ! rights provid$ 9 ?is title ) respect to cov]$ entities & data brok]s4 ,any su* rulemak+ %all take into acc\nt-- 7#a7 ! specific ne$s ( p>5ts1 *ildr51 & te5s2 7#b7 h[ be/ to h>monize ! processes provid$ = "u ?is title ) ! processes & guidance provid$ = "u ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq471 z am5d$ by title ,,ii ( ?is ,act1 & any regulations promulgat$ by ! ,commission !reund]2 & 7#c7 options = r$uc+ undue burd5s on p>5ts1 *ildr51 te5s1 cov]$ entities1 & data brok]s4 #aba4 ,t]m9ation ( ,,ftc rulemak+ on comm]cial surveillance & data security ,beg9n+ on ! date ( ! enactm5t ( ?is ,act1 ! rulemak+ propos$ 9 ! advance notice ( propos$ rulemak+ titl$ ,trade ,regulation ,rule on ,comm]cial ,surveillance & ,data ,security & publi%$ on ,augu/ #bb1 #bjbb 7#hg ,f$4 ,reg4 #eabgc7 %all be t]m9at$4 #abb4 ,sev]ability ,if any provision ( ?is title1 or ! application !re( to any p]son or circum/ance1 is held invalid1 ! rema9d] ( ?is title1 & ! application ( su* provision to o!r p]sons n simil>ly situat$ or to o!r circum/ances1 may n be affect$ by ! invalidation4 #abc4 ,innovation rulemak+s ,! ,commission may conduct a rulemak+ pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code-- 7#a7 to include o!r cov]$ data 9 ! def9ition ( ! t]m s5sitive cov]$ data1 except t ! ,commission may n exp& ! category ( in=mation describ$ 9 section #aja7di77;,a77ii72 & 7#b7 to include 9 ! li/ ( p]mitt$ purposes 9 section #ajb7;d7 o!r p]mitt$ purposes = collect+1 process+1 reta9+1 or transf]r+ cov]$ data4 #abd4 ,effective date ,unless o!rwise specifi$ 9 ?is title1 ?is title %all take effect on ! date t is #ahj days aft] ! date ( ! enactm5t ( ?is ,act4 ,,ii ,*ildr5's ,onl9e ,privacy ,protection ,act #b4j #bja4 ,%ort title ,?is title may be cit$ z ! ,*ildr5's ,onl9e ,privacy ,protection ,act #b4j4 #bjb4 ,onl9e collection1 use1 disclosure1 & deletion ( p]sonal in=mation ( *ildr5 7a7 ,def9itions ,section #acjb ( ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja7 is am5d$-- 7#a7 by am5d+ p>agraph 7#b7 to read z foll[s3 7#b7 ,op]ator ,! t]m op]ator-- 7,a7 means any p]son-- 7i7 :o1 = comm]cial purposes1 9 int]/ate or =eign comm]ce1 op]ates or provides a website on ! int]net1 an onl9e s]vice1 an onl9e application1 or a mobile application2 & 7ii7 :o-- 7,i7 collects or ma9ta9s1 ei!r directly or ?r\gh a s]vice provid]1 p]sonal in=mation f or ab\t ! us]s ( t website1 s]vice1 or application2 7,,ii7 all[s ano!r p]son to collect p]sonal in=mation directly f us]s ( t website1 s]vice1 or application 79 :i* case1 ! op]ator is deem$ to h collect$ ! in=mation72 or 7,,iii7 all[s us]s ( t website1 s]vice1 or application to publicly disclose p]sonal in=mation 79 :i* case1 ! op]ator is deem$ to h collect$ ! in=mation72 & 7,b7 does n include any nonpr(it entity t w\ld o!rwise be exempt f cov]age "u section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de74 2 7#b7 9 p>agraph 7#d7-- 7,a7 by am5d+ subp>agraph 7,a7 to read z foll[s3 7,a7 ! release ( p]sonal in=mation collect$ f a *ild by an op]ator = any purpose1 except :]e ! p]sonal in=mation is provid$ to a p]son o!r ?an an op]ator :o-- 7i7 provides support = ! int]nal op]ations ( a website1 onl9e s]vice1 onl9e application1 or mobile application 7z def9$ 9 p>agraph 7#h77;,c77 ( ! op]ator1 exclud+ any activity relat+ to t>get$ adv]tis+ or fir/-p>ty adv]tis+ 7z su* t]ms are def9$ 9 section #aja ( ! ,am]ican ,privacy ,rights ,act ( #bjbd7 to *ildr52 & 7ii7 does n disclose or use t p]sonal in=mation = any o!r purpose2 & 2 & 7,b7 9 subp>agraph 7,b7-- 7i7 by /rik+ website or onl9e s]vice & ins]t+ website1 onl9e s]vice1 onl9e application1 or mobile application2 & 7ii7 by /rik+ actual k & ins]t+ actual k or k fairly impli$ on ! basis ( objective circum/ances2 7#c7 by /rik+ p>agraph 7#h7 & ins]t+ ! foll[+3 7#h7 ,p]sonal in=mation 7,a7 ,9 g5]al ,! t]m p]sonal in=mation means individually id5tifiable in=mation ab\t an individual collect$ onl9e1 includ+-- 7i7 a fir/ & la/ "n2 7ii7 a home or o!r physical address includ+ /reet "n & "n ( a city or t[n2 7iii7 an e-mail address2 7iv7 a telephone numb]2 7v7 a ,social ,security numb]2 7vi7 any o!r id5tifi] t ! ,commission det]m9es p]mits ! physical or onl9e contact+ ( a specific individual2 7vii7 a p]si/5t id5tifi] t c be us$ to recognize a specific *ild ov] "t & across diff]5t websites1 onl9e s]vices1 onl9e applications1 or mobile applications1 includ+ a cu/om] numb] held 9 a cookie1 an ,int]net ,protocol 7,,ip7 address1 a processor or device s]ial numb]1 or a unique device id5tifi]1 b exclud+ an id5tifi] t is us$ by an op]ator solely = provid+ support = ! int]nal op]ations ( a website1 onl9e s]vice1 onl9e application1 or mobile application2 7viii7 a photograph1 video1 or audio file1 if su* file conta9s ! image or voice ( a specific *ild2 7ix7 geolocation in=mation2 7x7 in=mation g5]at$ f ! measurem5t or te*nological process+ ( ! biological1 physical1 or physiological *>act]i/ics ( an individual t is us$ to id5tify an individual1 includ+-- 7,i7 f+]pr9ts2 7,,ii7 voice pr9ts2 7,,iii7 iris or ret9a imag]y scans2 7,,iv7 facial templates2 7,v7 deoxyribonucleic acid 7,,dna7 in=mation2 or 7,,vi7 gait2 or 7xi7 in=mation l9k$ or reasonably l9kable to a *ild or ! p>5ts ( t *ild 7includ+ any unique id5tifi]7 t an op]ator collects onl9e f ! *ild & comb9es ) an id5tifi] describ$ 9 ?is subp>agraph4 7,b7 ,exclusion ,! t]m p]sonal in=mation does n include an audio file t conta9s ! voice ( a *ild1 if ! op]ator-- 7i7 does n reque/ in=mation via voice t w\ld o!rwise be consid]$ p]sonal in=mation "u ?is p>agraph2 7ii7 provides1 9 ! privacy policy ( ! op]ator1 cle> notice ( ! collection & use ( ! audio file by ! op]ator & ! deletion policy ( ! op]ator2 7iii7 uses ! voice )9 ! audio file solely z a replacem5t = writt5 words1 to p]=m a task1 or to engage ) a website1 onl9e s]vice1 onl9e application1 or mobile application1 su* z to p]=m a se>* or fulfill a v]bal in/ruction or reque/2 & 7iv7 only ma9ta9s ! audio file long en\gh to complete ! /at$ purpose & !n imm$iately deletes ! audio file & does n make any o!r use ( ! audio file prior to deletion4 7,c7 ,support = ! int]nal op]ations ( a website1 onl9e s]vice1 onl9e application1 or mobile application 7i7 ,9 g5]al ,= purposes ( subp>agraph 7,a77vii71 ! t]m support = ! int]nal op]ations ( a website1 onl9e s]vice1 onl9e application1 or mobile application means ^? activities necess>y to-- 7,i7 ma9ta9 or analyze ! function+ ( ! website1 onl9e s]vice1 onl9e application1 or mobile application2 7,,ii7 p]=m network communications2 7,,iii7 au!nticate us]s (1 or p]sonalize ! cont5t on1 ! website1 onl9e s]vice1 onl9e application1 or mobile application2 7,,iv7 cap ! frequ5cy ( adv]tis+2 7,v7 protect ! security or integrity ( ! us]1 website1 onl9e s]vice1 onl9e application1 or mobile application2 7,,vi7 ensure legal or regulatory compliance2 or 7,,vii7 fulfill a reque/ ( a *ild z p]mitt$ by subp>agraphs 7,a7 ?r\gh 7,c7 ( section #acjc7;b77#b74 7ii7 ,condition ,except z specifically p]mitt$ "u clause 7i71 in=mation collect$ = ! activities li/$ 9 clause 7i7 may n be us$ or disclos$ to contact a specific individual1 includ+ ?r\gh t>get$ adv]tis+ or fir/-p>ty adv]tis+ 7z su* t]ms are def9$ 9 section #aja ( ! ,am]ican ,privacy ,rights ,act ( #bjbd7 to *ildr51 to amass a pr(ile on a specific individual1 9 connection ) processes t enc\rage or prompt use ( a website1 onl9e s]vice1 onl9e application1 or mobile application1 or = any o!r purpose4 2 7#d7 by am5d+ p>agraph 7#i7 to read z foll[s3 7#i7 ,v]ifiable cons5t ,! t]m v]ifiable cons5t means any reasonable ef=t 7tak+ into consid]ation available te*nology71 includ+ a reque/ = au?orization = future collection1 use1 & disclosure describ$ 9 ! notice1 to ensure t a p>5t ( ! *ild-- 7,a7 receives direct notice ( ! p]sonal in=mation collection1 use1 & disclosure practices ( ! op]ator2 & 7,b7 be=e ! p]sonal in=mation ( ! *ild is collect$1 freely & unambigu\sly au?orizes-- 7i7 ! collection1 use1 & disclosure1 z applicable1 ( t p]sonal in=mation2 & 7ii7 any subsequ5t use ( t p]sonal in=mation4 2 7#e7 9 p>agraph 7#aj7-- 7,a7 9 ! p>agraph head+1 by /rik+ ,website or onl9e s]vice direct$ to *ildr5 & ins]t+ ,website1 onl9e s]vice1 onl9e application1 or mobile application direct$ to *ildr52 7,b7 by /rik+ website or onl9e s]vice ea* place x appe>s & ins]t+ website1 onl9e s]vice1 onl9e application1 or mobile application2 & 7,c7 by add+ at ! end ! foll[+ new subp>agraph3 7,c7 ,rule ( con/ruction ,9 consid]+ :e!r a website1 onl9e s]vice1 onl9e application1 or mobile application1 or portion !re(1 is direct$ to *ildr51 ! ,commission %all apply a totality ( circum/ances te/ & %all also consid] compet5t & reliable empirical evid5ce reg>d+ audi5ce composition & evid5ce reg>d+ ! int5d$ audi5ce ( ! website1 onl9e s]vice1 onl9e application1 or mobile application4 2 & 7#f7 by add+ at ! end ! foll[+3 7#ac7 ,connect$ device ,! t]m connect$ device has ! mean+ giv5 su* t]m 9 section #aja ( ! ,am]ican ,privacy ,rights ,act ( #bjbd4 7#ad7 ,educational ag5cy or in/itution ,! t]m educational ag5cy or in/itution means a ,/ate educational ag5cy or local educational ag5cy z def9$ "u ,f$]al law1 z well z an in/itutional day or resid5tial s*ool1 includ+ a public s*ool1 *>t] s*ool1 or private s*ool1 t provides elem5t>y or second>y education1 z det]m9$ "u ,/ate law4 7#ae7 ,mobile application ,! t]m mobile application has ! mean+ giv5 su* t]m 9 section #aja ( ! ,am]ican ,privacy ,rights ,act ( #bjbd4 7#af7 ,onl9e application ,! t]m onl9e application has ! mean+ giv5 su* t]m 9 section #aja ( ! ,am]ican ,privacy ,rights ,act ( #bjbd4 7#ag7 ,precise geolocation in=mation ,! t]m precise geolocation in=mation has ! mean+ giv5 su* t]m 9 section #aja ( ! ,am]ican ,privacy ,rights ,act ( #bjbd4 4 7b7 ,onl9e collection1 use1 disclosure1 & deletion ( p]sonal in=mation ( *ildr5 ,section #acjc ( ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #fejb7 is am5d$-- 7#a7 by /rik+ ! head+ & ins]t+ ! foll[+3 ,onl9e collection1 use1 disclosure1 & deletion ( p]sonal in=mation ( *ildr542 7#b7 by am5d+ subsection 7a7 to read z foll[s3 7a7 ,acts prohibit$ ,x is unlawful = an op]ator ( a website1 onl9e s]vice1 onl9e application1 or mobile application direct$ to *ildr5 or = any op]ator ( a website1 onl9e s]vice1 onl9e application1 or mobile application ) actual k or k fairly impli$ on ! basis ( objective circum/ances t a us] is a *ild-- 7#a7 to collect p]sonal in=mation f a *ild 9 a mann] t violates ! ,am]ican ,privacy ,rights ,act ( #bjbd or ! regulations prescrib$ "u subsection 7b72 or 7#b7 to /ore or transf] ! p]sonal in=mation ( a *ild outside ( ! ,unit$ ,/ates1 unless-- 7,a7 ! op]ator provides direct notice to ! p>5t ( ! *ild t ! p]sonal in=mation ( ! *ild is be+ /or$ or transf]r$ outside ( ! ,unit$ ,/ates2 & 7,b7 ) respect to transf]1 ! op]ator meets ! requirem5ts ( section #ajb7;b7 ( ! ,am]ican ,privacy ,rights ,act ( #bjbd4 2 7#c7 9 subsection 7b7-- 7,a7 9 p>agraph 7#a7-- 7i7 9 subp>agraph 7,a7-- 7,i7 9 ! matt] prec$+ clause 7i71 by /rik+ op]ator ( any website & all t foll[s ?r\gh f a *ild & ins]t+ op]ator ( a website1 onl9e s]vice1 onl9e application1 or mobile application direct$ to *ildr5 or t has actual k or k fairly impli$ on ! basis ( objective circum/ances t a us] is a *ild2 7,,ii7 9 clause 7i7-- 7aa7 by /rik+ notice on ! website & ins]t+ cle> & conspicu\s notice on ! website1 s]vice1 or application2 & 7bb7 by /rik+ 2 & & ins]t+ a semicolon2 7,,iii7 9 clause 7ii7-- 7aa7 by /rik+ v]ifiable p>5tal cons5t & ins]t+ v]ifiable cons5t2 & 7bb7 by /rik+ ! semicolon at ! end & ins]t+ 2 &2 & 7,,iv7 by ins]t+ aft] clause 7ii7 ! foll[+ new clause3 7iii7 to obta9 v]ifiable cons5t f a p>5t ( a *ild be=e us+ or disclos+ p]sonal in=mation ( ! *ild = any purpose t is a mat]ial *ange f ! orig9al purposes & disclosure practices specifi$ to ! p>5t ( ! *ild "u clause 7i72 2 7ii7 by /rik+ subp>agraph 7,b72 7iii7 9 subp>agraph 7,c7-- 7,i7 by /rik+ reasonably2 & 7,,ii7 by ins]t+ 1 proportionate1 & limit$ aft] necess>y2 7iv7 9 subp>agraph 7,d71 by /rik+ website or onl9e s]vice & ins]t+ website1 onl9e s]vice1 onl9e application1 or mobile application2 & 7v7 by r$esignat+ subp>agraphs 7,c7 & 7,d7 z subp>agraphs 7,b7 & 7,c71 respectively2 7,b7 9 p>agraph 7#b7-- 7i7 9 ! matt] prec$+ subp>agraph 7,a7-- 7,i7 by /rik+ v]ifiable p>5tal cons5t & ins]t+ v]ifiable cons5t2 & 7,,ii7 by /rik+ p>agraph 7#a77;,a77ii7 & ins]t+ clause 7ii7 or 7iii7 ( p>agraph 7#a77;,a72 7ii7 9 subp>agraph 7,a71 by ins]t+ or to contact ano!r *ild aft] to recontact ! *ild2 7iii7 9 subp>agraph 7,b7-- 7,i7 by /rik+ or *ild2 & 7,,ii7 by /rik+ p>5tal cons5t ea* place ! t]m appe>s & ins]t+ v]ifiable cons5t2 7iv7 9 subp>agraph 7,d71 9 ! matt] prec$+ clause 7i7-- 7,i7 by /rik+ reasonably2 & 7,,ii7 by ins]t+ 1 proportionate1 & limit$ aft] necess>y2 & 7v7 9 subp>agraph 7,e7-- 7,i7 9 ! matt] prec$+ clause 7i71 by /rik+ website or onl9e s]vice & ins]t+ website1 onl9e s]vice1 onl9e application1 or mobile application2 & 7,,ii7 9 clause 7i71 by /rik+ website & ins]t+ website1 s]vice1 or application2 7,c7 by r$esignat+ p>agraph 7#c7 z p>agraph 7#d7 & ins]t+ aft] p>agraph 7#b7 ! foll[+ new p>agraph3 7#c7 ,application to op]ators act+ "u agreem5ts ) educational ag5cies or in/itutions ,! regulations may provide t v]ifiable cons5t "u clause 7ii7 or 7iii7 ( p>agraph 7#a77;,a7 is n requir$ = an op]ator t is act+ "u a writt5 agreem5t ) an educational ag5cy or in/itution t1 at a m9imum1 requires-- 7,a7 ! op]ator to-- 7i7 limit its collection1 use1 & disclosure ( ! p]sonal in=mation f a *ild to solely educational purposes & = no o!r comm]cial purposes2 7ii7 provide ! educational ag5cy or in/itution ) a notice ( ! specific types ( p]sonal in=mation ! op]ator w collect f ! *ild1 ! me?od by :i* ! op]ator w obta9 ! p]sonal in=mation1 & ! purposes = :i* ! op]ator w collect1 use1 disclose1 & reta9 ! p]sonal in=mation2 7iii7 provide ! educational ag5cy or in/itution ) a l9k to ! onl9e notice ( in=mation practices ( ! op]ator z requir$ "u p>agraph 7#a77;,a77i72 & 7iv7 provide ! educational ag5cy or in/itution1 ^u reque/1 ) a means to review ! p]sonal in=mation collect$ f a *ild1 to prev5t fur!r use or ma9t5ance or future collection ( p]sonal in=mation f a *ild1 & to delete p]sonal in=mation collect$ f a *ild or cont5t or in=mation submitt$ by a *ild to ! website1 onl9e s]vice1 onl9e application1 or mobile application ( ! op]ator2 7,b7 a repres5tative ( ! educational ag5cy or in/itution to-- 7i7 ackn[l$ge & agree t ! repres5tative has au?ority to au?orize ! collection1 use1 & disclosure ( p]sonal in=mation f *ildr5 on behalf ( ! educational ag5cy or in/itution2 & 7ii7 provide ! "n ( ! repres5tative & ! title ( ! repres5tative at ! educational ag5cy or in/itution2 & 7,c7 ! educational ag5cy or in/itution to-- 7i7 provide on ! website ( ! educational ag5cy or in/itution a notice t id5tifies ! op]ator ) :i* ! educational ag5cy or in/itution has ent]$ into a writt5 agreem5t "u ?is p>agraph & a l9k to ! onl9e notice ( in=mation practices ( ! op]ator z requir$ "u p>agraph 7#a77;,a77i72 7ii7 provide ! notice ( ! op]ator reg>d+ ! in=mation practices ( ! op]ator1 z requir$ "u subp>agraph 7,a77ii71 ^u reque/1 to a p>5t2 & 7iii7 ^u ! reque/ ( a p>5t1 reque/ ! op]ator provide a means to review ! p]sonal in=mation collect$ f ! *ild ( ! p>5t & provide ! p>5t a means to review ! p]sonal in=mation4 2 7,d7 by am5d+ p>agraph 7#d71 z s r$esignat$1 to read z foll[s3 7#d7 ,t]m9ation ( s]vice ,! regulations %all p]mit ! op]ator ( a website1 onl9e s]vice1 onl9e application1 or mobile application to t]m9ate s]vice provid$ to a *ild ^: p>5t has reque/$ to delete cov]$ data ( ! *ild pursuant to section #aje ( ! ,am]ican ,privacy ,rights ,act ( #bjbd4 2 & 7,e7 by add+ at ! end ! foll[+ new p>agraphs3 7#e7 ,cont9uation ( s]vice ,! regulations %all prohibit an op]ator f discont9u+ s]vice provid$ to a *ild on ! basis ( a reque/ by ! p>5t ( ! *ild to delete p]sonal in=mation collect$ f ! *ild1 to ! ext5t t ! op]ator is capable ( provid+ su* s]vice )\t su* in=mation4 7#f7 ,common v]ifiable cons5t me*anism 7,a7 ,9 g5]al 7i7 ,feasibility ( me*anism ,! ,commission %all conduct an assessm5t1 ) notice & public comm5t1 ( ! feasibility ( all[+ op]ators ! option to use a common v]ifiable cons5t me*anism t fully meets ! requirem5ts ( ?is title4 7ii7 ,requirem5ts ,! feasibility assessm5t describ$ 9 clause 7i7 %all consid] :e!r a s+le op]ator c\ld use a common v]ifiable cons5t me*anism to obta9 v]ifiable cons5t1 z requir$ "u ?is title1 f a p>5t ( a *ild on behalf ( multiple1 li/$ op]ators t provide a jo9t or relat$ s]vice4 7,b7 ,report ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is p>agraph1 ! ,commission %all submit to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report ) ! f9d+s ( ! assessm5t requir$ by subp>agraph 7,a74 7,c7 ,regulations ,if ! ,commission f9ds1 9 ! assessm5t requir$ by subp>agraph 7,a71 t ! use ( a common v]ifiable cons5t me*anism is feasible & w\ld meet ! requirem5ts ( ?is title1 ! ,commission %all issue regulations1 pursuant to section #eec ( title #e1 ,unit$ ,/ates ,code1 to p]mit ! use ( a common v]ifiable cons5t me*anism 9 accordance ) ! f9d+s outl9$ 9 ! report submitt$ "u subp>agraph 7,b74 2 7#d7 9 subsection 7c71 by /rik+ a regulation prescrib$ "u subsection 7a7 & ins]t+ p>agraph 7#b7 ( subsection 7a71 or ( a regulation prescrib$ "u subsection 7b712 & 7#e7 by /rik+ subsection 7d7 & ins]t+ ! foll[+3 7d7 ,relation%ip to ,/ate law ,! provisions ( ?is title %all preempt any ,/ate law1 rule1 or regulation only to ! ext5t t su* ,/ate law1 rule1 or regulation conflicts ) a provision ( ?is title4 ,no?+ 9 ?is title may be con/ru$ to prohibit any ,/ate f enact+ a law1 rule1 or regulation t provides great] protection to *ildr5 ?an ! provisions ( ?is title4 4 7c7 ,safe h>bors ,section #acjd ( ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #fejc7 is am5d$ by add+ at ! end ! foll[+3 7d7 ,publication 7#a7 ,9 g5]al ,subject to ! re/rictions describ$ 9 p>agraph 7#b71 ! ,commission %all publi% on ! website ( ! ,commission any report or docum5tation requir$ by regulation to be submitt$ to ! ,commission to c>ry out ?is section4 7#b7 ,re/rictions on publication ,! re/rictions describ$ 9 sections #f7;f7 & #ba ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;f72 #eg;b-#b7 applicable to ! disclosure ( in=mation obta9$ by ! ,commission %all apply 9 ! same mann] to ! disclosure "u ?is subsection ( in=mation obta9$ by ! ,commission f a report or docum5tation describ$ 9 p>agraph 7#a74 4 7d7 ,actions by /ates ,section #acje ( ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #fejd7 is am5d$-- 7#a7 9 subsection 7a77#a7-- 7,a7 9 ! matt] prec$+ subp>agraph 7,a71 by ins]t+ section #acjc7;a7 or be=e any regulation2 & 7,b7 9 subp>agraph 7,b71 by /rik+ ! regulation & ins]t+ su* section or regulation2 & 7#b7 9 subsection 7d7-- 7,a7 by ins]t+ section #acjc7;a7 or be=e any regulation2 & 7,b7 by /rik+ t regulation & ins]t+ su* section or regulation4 7e7 ,adm9i/ration & applicability ( act ,section #acjf ( ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feje7 is am5d$-- 7#a7 9 subsection 7d7-- 7,a7 by ins]t+ section #acjc7;a7 or be=e a rule2 & 7,b7 by /rik+ su* rule & ins]t+ section #acjc7;a7 or a rule ( ! ,commission "u section #acjc2 & 7#b7 by add+ at ! end ! foll[+ new subsections3 7f7 ,det]m9ation ( :e!r an op]ator has k fairly impli$ on ! basis ( objective circum/ances 7#a7 ,rule ( con/ruction ,= purposes ( en=c+ ?is title or a regulation promulgat$ "u ?is title1 9 mak+ a det]m9ation z to :e!r an op]ator has k fairly impli$ on ! basis ( objective circum/ances t a specific us] is a *ild1 ! ,commission or a ,/ate attorney g5]al %all rely on compet5t & reliable evid5ce1 tak+ into acc\nt ! totality ( ! circum/ances1 includ+ :e!r a reasonable & prud5t p]son "u ! circum/ances w\ld h kn[n t ! us] is a *ild4 ,no?+ 9 ?is title1 includ+ a det]m9ation describ$ 9 ! prec$+ s5t5ce1 may be con/ru$ to require an op]ator to-- 7,a7 affirmatively collect any p]sonal in=mation ) respect to ! age ( a *ild t an op]ator is n already collect+ 9 ! normal c\rse ( bus9ess2 or 7,b7 implem5t an age gat+ or age v]ification functionality4 7#b7 ,commission guidance 7,a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is subsection1 ! ,commission %all issue guidance to provide in=mation1 includ+ be/ practices & examples1 = op]ators to und]/& ! process ( ! ,commission = det]m9+ :e!r an op]ator has k fairly impli$ on ! basis ( objective circum/ances t a us] is a *ild4 7,b7 ,limitation ,no guidance issu$ by ! ,commission "u subp>agraph 7,a7 conf]s any rights on any p]son1 ,/ate1 or locality1 or op]ates to b9d ! ,commission or any p]son1 ,/ate1 or locality to ! approa* recomm5d$ 9 su* guidance4 ,9 any en=cem5t action br\ght pursuant to ?is title1 ! ,commission or ,/ate attorney g5]al1 z applicable1 %all allege a specific violation ( a provision ( ?is title1 & ! ,commission or ,/ate attorney g5]al1 z applicable1 may n base an en=cem5t action on1 or execute a cons5t ord] bas$ on1 practices t are alleg$ to be inconsi/5t ) any su* guidance1 unless ! practices alleg$ly violate ?is title4 7g7 ,additional requirem5t ,any regulations issu$ "u ?is title %all include a description & analysis ( ! impact ( propos$ & f9al rules on small entities p] *apt] #f ( title #e1 ,unit$ ,/ates ,code4 4 #bjc4 ,/udy & reports on mobile & onl9e application ov]sight & en=cem5t 7a7 ,ov]sight report ,n lat] ?an #c ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,f$]al ,trade ,commission %all submit to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report on ! processes ( plat=ms t (f] mobile & onl9e applications = ensur+ t1 = ^? applications t are websites1 onl9e s]vices1 onl9e applications1 or mobile applications direct$ to *ildr51 ! applications op]ate 9 accordance )-- 7#a7 ?is title1 ! am5dm5ts made by ?is title1 & any rules promulgat$ "u ?is title or ! am5dm5ts made by ?is title2 & 7#b7 rules promulgat$ by ! ,commission "u section #ah ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7 relat+ to unfair or deceptive acts or practices 9 m>ket+4 7b7 ,en=cem5t report ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 & annually !reaft]1 ! ,f$]al ,trade ,commission %all submit to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report t addresses1 at a m9imum-- 7#a7 ! numb] ( actions br\ght by ! ,commission dur+ ! report+ ye> to en=ce ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq47 & ! outcome ( ea* su* action2 7#b7 ! total numb] ( inve/igations or inquiries into pot5tial violations ( su* ,act comm5c$ dur+ ! report+ ye>2 7#c7 ! total numb] ( op5 inve/igations or inquiries into pot5tial violations ( su* ,act z ( ! "t ! report is submitt$2 7#d7 ! numb] & nature ( compla9ts receiv$ by ! ,commission relat+ to an allegation ( a violation ( su* ,act dur+ ! report+ ye>2 & 7#e7 policy or legislative recomm5dations to /r5g!n onl9e protections = *ildr54 7c7 ,report by ! inspector g5]al 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,inspector ,g5]al ( ! ,f$]al ,trade ,commission %all submit to ! ,f$]al ,trade ,commission & to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report reg>d+ ! safe h>bor provisions 9 section #acjd ( ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #fejc71 :i* %all include-- 7,a7 an analysis ( :e!r ! safe h>bor provisions are-- 7i7 op]at+ fairly & effectively2 & 7ii7 effectively protect+ ! int]e/s ( *ildr52 & 7,b7 any proposal or recomm5dation = policy *anges t w\ld improve ! effectiv5ess ( ! safe h>bor provisions4 7#b7 ,publication ,n lat] ?an #aj days aft] ! date on :i* a report is submitt$ "u p>agraph 7#a71 ! ,commission %all publi% ! report on ! website ( ! ,commission4 #bjd4 ,sev]ability ,if any provision ( ?is title or ! am5dm5ts made by ?is title1 or ! application !re( to any p]son or circum/ance1 is held invalid1 ! rema9d] ( ?is title & ! am5dm5ts made by ?is title1 & ! application ( su* provision to o!r p]sons n simil>ly situat$ or to o!r circum/ances1 may n be affect$ by ! invalidation4