Req. No. 8708 Page 1 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
STATE OF OKLAHOMA
2nd Session of the 58th Legislature (2022)
HOUSE BILL 3009 By: Walke
AS INTRODUCED
An Act relating to technology; creating a new title;
creating the Voice Recognition Privacy Act of 2022;
defining terms; regulating connected devices with
voice recognition features; prohibiting voice
recognition services without informing users;
prohibiting use of personal information in voice
recordings; directing that certain recordings be
available to users; directing that users be allowed
to delete recordings; prohibiting the use of
incorrectly activated voice recordings ; prohibiting
compelling of manufacturers and service providers to
allow use of technology by law enforcement; exempting
certain instances of use of voice recordings by third
parties from suit; exempting manufacturer l iability
for applications down loaded by users; exempting
instances where affirmative consent has been gran ted;
creating actions for relief to be brough t by the
Attorney General or district attorney ; granting
courts the ability to enjoin or make orders to
prevent the violation of this act; creating a civil
penalty for violation of this act; mandating certain
disclosures; providing for noncodification; providing
for codification; and providing an effective date.
BE IT ENACTED BY THE P EOPLE OF THE STATE OF OKLAHOMA:
SECTION 1. NEW LAW A new section of law not to be
codified in the Oklahoma Statutes reads as follows:
In publishing the decennial Oklahoma Statutes , and the
cumulative supplements after July 1, 2022, West Publishing Company
Req. No. 8708 Page 2 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
shall include in such decennial statutes a nd supplements a new Title
75A, to be designated "Technology".
SECTION 2. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 101 of Title 75A, unless there
is created a duplication in numbering, reads as follows:
This act shall be known and may be cited as the "Voice
Recognition Privacy Act of 2022".
SECTION 3. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 102 of Title 75A, unless there
is created a duplication in numbering, reads as follows:
As used in this act:
1. "Affirmative consent" means that a manufacturer of a
connected television or smart speaker device has done all of the
following:
a. clearly and conspicuously disclosed to the user,
separate from the device terms of use, all of the
following to the extent applicable:
(1) that the device may be used to process and retain
user recordings,
(2) that the recordings described in division (1) of
this subparagraph may be analyzed or shared with
third parties,
(3) that the device may be used to process and retain
transcriptions of spoken words, and
Req. No. 8708 Page 3 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(4) that the transcriptions described in division (3)
of this subparagraph may be analyzed or shared
with third parties,
b. clearly and conspicuously disclosed to the user,
separate from the device terms of use, the extent to
which the device can operate in the absence of consent
for each practice described in the disclosure required
by subparagraph a of this paragraph,
c. received a freely given, speci fic, informed, and
unambiguous indication of the user 's wishes by which
the user, including by a statement or by a clear
affirmative action, signifies agreement to the
processing of personal information relating to the
user for each practice described in t he disclosure
required by subparagraph a of this paragraph. The
following shall not satisfy the requirements of this
paragraph:
(1) user's acceptance of a gener al or broad terms of
use, or similar document, that contains
descriptions of personal info rmation processing
along with other, unrelated information,
(2) user's hovering over, muting, pausing, or closing
a given piece of content, and
Req. No. 8708 Page 4 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(3) user's agreement obtained through the use of dark
patterns;
2. "Cloud computing storage service" has the same definition as
the term is defined by the National Ins titute of Standards and
Technology Special Publication 800 -145, or a successor publicat ion,
and includes the service and deployment models referenced therein ;
3. "Connected television" means a video device designed for
home use to receive television signa ls and reproduce them on an
integrated, physical screen display that exceeds twelve (12) inches,
except that this term shall not include a personal computer,
portable device, or a separate device that connects physically or
wirelessly to a television, incl uding, but not limited to, a set -top
box, video game console, or digital video recorder ;
4. "Dark pattern" means a user interface designed or
manipulated with the substantial effect of subverting or impairing
user autonomy, decis ion making, or choice;
5. "Deidentified" means information that cannot reasonably
identify, relate to, describe, be capable o f being associated with,
or be linked, directly or indirectly, to a part icular consumer;
provided that a business that uses deiden tified information:
a. has implemented technical safeguards that prohibit
reidentification of the consumer to whom the
information may pertain,
Req. No. 8708 Page 5 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
b. has implemented business processes that specificall y
prohibit reidentification of the information ,
c. has implemented business processes to prevent
inadvertent release of deidentified information , and
d. makes no attempt to reidentify the information;
6. "Personal information " means information that ident ifies,
relates to, describes, is capable of being associat ed with, or could
reasonably be linked, directly or indirectly, with a particular
consumer or household. Personal information shall include, but not
be limited to, the following if it identifies, r elates to,
describes, is capable of being associated with, or co uld be
reasonably linked, directly or indirectly, with a particular
consumer or household:
a. identifiers such as a real name, ali as, postal
address, unique personal identifier, online
identifier, Internet Protocol address, email address,
account name, Social Security number, driver license
number, passport number, or other similar identifiers ,
b. characteristics of protected classifications under
Oklahoma or federal law,
c. commercial information, including records of personal
property, products or services purchased, obta ined, or
considered, or other purchasing or consuming histori es
or tendencies,
Req. No. 8708 Page 6 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
d. biometric information,
e. Internet or other electronic network activity
information, including, but not limited to, browsing
history, search history, and information regardin g a
consumer's interaction with an Internet website,
application, or advertisement ,
f. geolocation data,
g. audio, electronic, visual, thermal, olfactory, or
similar information,
h. professional or employment-related information,
i. education information, defined as information that is
not publicly available , personally identifiable
information as defined in the Family Educational
Rights and Privacy Act (20 U.S.C. Section 1232g, 34
C.F.R. Part 99), and
j. inferences drawn from any of the information
identified in this paragraph to create a profile about
a consumer reflecting the consumer 's preferences,
characteristics, psychological trends,
predispositions, behavior, att itudes, intelligence,
abilities, and aptitudes .
Personal information does not include publicly available information
that is lawfully made available to the general public from federal,
state, or local government records;
Req. No. 8708 Page 7 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
7. "Retained" means saving, storing, or both saving and storing
voice recorded data longer than t he minimum time necessa ry to
complete a requested command by the user;
8. "Smart speaker device " means a speaker and voice command
device offered for sale in this state wit h an integrated virtual
assistant connected to a cloud -computing storage service th at uses
hands-free verbal activation. A smart speaker device does not
include a cellular telephone, tablet, laptop computer with mobile
data access, pager, or motor vehicle, or any speaker or devic e
associated with, or connected to, a vehicle ;
9. "Third party" means a person who is not any of the
following:
a. the business that collects personal information from
consumers under this act,
b. a person to whom the business discloses a consumer 's
personal information for a business purpose pursuant
to a written contract, pr ovided that the contract:
(1) prohibits the person receiving the personal
information from:
(a) selling the personal information,
(b) retaining, using, or disclosing the personal
information for any purpose other than for
the specific purpose of performing the
services specified in the contr act,
Req. No. 8708 Page 8 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
including retaining, using, or disclosing
the personal information for a commercial
purpose other than providing the services
specified in the contract, or
(c) retaining, using, or disclosing the
information outside of the direct business
relationship between the person and the
business, and
(2) includes a certification made b y the person
receiving the personal information that the
person understands the restrictions in division
(1) of this subparagraph and will comply with the
restrictions.
A person covered by this paragraph who violates any of the
restrictions set forth in this act shall be liable for the
violations. A business that discloses personal information to a
person covered by this paragraph in com pliance with this parag raph
shall not be liable under this act if the person receiving the
personal information uses it in violation of the restrictions set
forth in this act; provided that, at the ti me of disclosing the
personal information, the busines s does not have actual knowledge,
or reason to believe, that the person intends to commit such a
violation;
Req. No. 8708 Page 9 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
10. "User" means a person who originally purchases, leases, or
takes ownership of a connected television or smart speaker device ,
or another person designated by the user to perform the initial
setup or installation of the connected television or smart speaker
device. A person who is incidentally recorded when a voice
recognition feature is activ ated by a user shall not be deemed to be
a user;
11. "Voice recognition featu re" means the function of a
connected television or smart speaker device with a voice
recognition feature that allows the collection, recording, storage,
analysis, transmission, interpretation, or other use of spoken words
or other sounds; except that this term shall not include spoken
words or other sounds that are not recorded, retained, or
transmitted beyond th e connected television or smart speaker device ;
and
12. "Voice recorded data" means audio recordings or
transcriptions of those recordings collec ted through the operation
of a voice recognition feature by the manufacturer of a connected
television or smart speaker device.
SECTION 4. NEW LAW A new s ection of law to be codified
in the Oklahoma Statutes a s Section 103 of Title 75A, unless there
is created a duplication in numbering, reads as follows:
A. A person or entity shall not pr ovide the operation of a
voice recognition feature within this state without prominently
Req. No. 8708 Page 10 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
informing, during the initial setu p or installation of a connected
television or smart speaker device, either the user or th e person
designated by the user to perform the initial setup or installation
of the connected television or sma rt speaker device of both of the
following:
1. That the connected television or smart speaker device
contains a voice recognition feature; and
2. What actions or commands will activate the voice recognition
feature to record or transcribe audio.
B. A recording or transcription collected or retained through
the operation of a voic e recognition feature b y the manufacturer of
a connected television or smart speaker device, including, but no t
limited to, the operation of an accessible user interface for peop le
with disabilities, if the recording or transcription qualifies as
personal information or is not d eidentified, shall not be:
1. Used for any advertising purpose;
2. Shared with, or sold to, a third party, unless the user has
provided affirmative conse nt; or
3. Retained electronically, unle ss the user opts in to having
that recording retained by the manufac turer either during
installation or at a la ter time in the device settings.
C. Notwithstanding paragraph 2 of subsection B of this section,
a manufacturer may share information with a third party without
affirmative consent to t he extent sharing that info rmation is
Req. No. 8708 Page 11 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
necessary to execute a function or provide a service specifically
requested by the user; provided the third party do es not use that
information for any purpose other than to facilitate the execut ion
of that function or provision of that service .
D. If a user has provid ed affirmative consent for the sharing
or sale of a recording or transcription as provided in paragraph 2
of subsection B of this section, the manufacturer shall provide the
user with the option to revoke that consent at any time i n a manner
reasonably accessible to the u ser.
E. If a user has declined to prov ide affirmative consent for
the sharing or sale of a recording or transcription as provided in
paragraph 2 of subsection B of this section, the person or entity
seeking consent shall not request that affirmative consent for a
period of at least twelve (12) months after the user has declined to
provide that affirmative cons ent.
F. If a person or entity providing the operation of a device
with a voice recognition feature within t his state retains voice
recordings that qualify as personal inform ation or are not
deidentified, that person or entity shall provide users with both of
the following:
1. An interface to review and delete t hose voice recordings.
The interface shall be easil y accessible and the user 's rights with
respect to these recording s shall be clearly communicated to the
user; and
Req. No. 8708 Page 12 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
2. The ability to delete those voice recordings automatically.
G. If a person or entity providing the operation of a voice
recognition feature that can be activated by a voice command
determines that the voice r ecognition feature was incorrectly
activated, the person or entity shall no t use the associated audio
recording for any purpose, exce pt as specified in subsection B of
this section.
H. A person or entity providing the operation of a voice
recognition feature tha t can be activated by a voice command may use
an audio recording ass ociated with an incorrect activation of a
voice recognition feature to improve the accuracy of the voice
recognition feature; provided that the user has provided affirmative
consent for the use of the audio recording for that purpose .
I. A person or entity shall not compel a manufacturer or other
entity providing the operation of a voice recognition feature to
build specific features for the purpose of allowing an investigative
or law enforcement officer to monitor communications through t hat
feature.
J. A manufacturer shall not be liable for functional ity
provided by applications t hat the user chooses to use in th e cloud
or are downloaded and installed by a user, unless the manufacturer
collects, controls, or has access to any personal information
collected or elicited by the applications .
Req. No. 8708 Page 13 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
K. This act shall not apply to any device regulated by the
United States Food and Drug Administration .
SECTION 5. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 104 of Title 75A, unless there
is created a duplication in numbering, reads as f ollows:
A. Actions for relief purs uant to this act may be prosecuted
exclusively in a court of competent jur isdiction in a civil action
brought in the name of the people of the State of Oklahoma by the
Attorney General or b y any district attorney. This act shall not be
deemed to create a p rivate right of action or limit any existing
private right of actio n.
B. A court may enjoin a person who knowingly engages, has
engaged, or proposes to engage in a violation of this act. The
court may make any orders or judgments as may be necessary to
prevent a violation of this act.
C. A person who knowingly engages, has e ngaged, or proposes to
engage in a violation of this act shall be liable for a civil
penalty not to exceed Two Thousand Five Hundred Dollars ($2,500.00)
for each connected television o r smart speaker device sold or le ased
in violation of this act. If the action is brought by the Attorney
General, the penalty shall be de posited into the Governmental Budget
Account. If the action is bro ught by a district attorney , the
penalty shall be paid to the treasu rer of the county in which th e
judgment was entered .
Req. No. 8708 Page 14 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 6. This act shall become effective November 1, 2022.
58-2-8708 MJ 12/10/21