1 | 1 | | |
---|
2 | 2 | | <BillNo> <Sponsor> |
---|
3 | 3 | | |
---|
4 | 4 | | HOUSE BILL 630 |
---|
5 | 5 | | By Clemmons |
---|
6 | 6 | | |
---|
7 | 7 | | |
---|
8 | 8 | | HB0630 |
---|
9 | 9 | | 001991 |
---|
10 | 10 | | - 1 - |
---|
11 | 11 | | |
---|
12 | 12 | | AN ACT to amend Tennessee Code Annotated, Title 47, |
---|
13 | 13 | | Chapter 18, relative to consumer data. |
---|
14 | 14 | | |
---|
15 | 15 | | BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF TENNESSEE: |
---|
16 | 16 | | SECTION 1. Tennessee Code Annotated, Section 47-18-3304, is amended by adding |
---|
17 | 17 | | the following new subsection: |
---|
18 | 18 | | (d) |
---|
19 | 19 | | (1) A consumer may designate another person to serve as the |
---|
20 | 20 | | consumer's authorized agent and act on the consumer's behalf to opt out of the |
---|
21 | 21 | | processing of the consumer's personal data under subdivisions (a)(2)(E)(i)-(iii). |
---|
22 | 22 | | The consumer may designate an authorized agent using a technology, including |
---|
23 | 23 | | a link to an internet website, an internet browser setting or extension, or a global |
---|
24 | 24 | | setting on an electronic device, that allows the consumer to indicate the |
---|
25 | 25 | | consumer's intent to opt out of such processing. |
---|
26 | 26 | | (2) A controller shall comply with an opt-out request received from an |
---|
27 | 27 | | authorized agent under this subsection (d) if the controller is able to verify, with |
---|
28 | 28 | | commercially reasonable effort, the identity of the consumer and the authorized |
---|
29 | 29 | | agent's authority to act on the consumer's behalf. |
---|
30 | 30 | | (3) Opt-out methods must: |
---|
31 | 31 | | (A) Provide a clear and conspicuous link on the controller's |
---|
32 | 32 | | internet website to an internet web page that enables a consumer, or a |
---|
33 | 33 | | consumer's authorized agent, to opt out of the targeted advertising or sale |
---|
34 | 34 | | of the consumer's personal data; and |
---|
35 | 35 | | |
---|
36 | 36 | | |
---|
37 | 37 | | - 2 - 001991 |
---|
38 | 38 | | |
---|
39 | 39 | | (B) On or before January 1, 2026, allow a consumer to opt out of |
---|
40 | 40 | | any processing of the consumer's personal data for the purposes of |
---|
41 | 41 | | targeted advertising, or any sale of such personal data through an opt-out |
---|
42 | 42 | | preference signal sent with the consumer's consent, to the controller by a |
---|
43 | 43 | | platform, technology, or mechanism that: |
---|
44 | 44 | | (i) Must not unfairly disadvantage another controller; |
---|
45 | 45 | | (ii) Must not make use of a default setting, but must |
---|
46 | 46 | | require the consumer to make an affirmative, freely given, and |
---|
47 | 47 | | unambiguous choice to indicate the consumer's intent to opt out of |
---|
48 | 48 | | any processing of a consumer's personal data; |
---|
49 | 49 | | (iii) Must be consumer-friendly and easy to use by the |
---|
50 | 50 | | average consumer; |
---|
51 | 51 | | (iv) Must be consistent with any federal or state law or |
---|
52 | 52 | | rule; and |
---|
53 | 53 | | (v) Must allow the controller to accurately determine |
---|
54 | 54 | | whether the consumer is a resident of this state and whether the |
---|
55 | 55 | | consumer has made a legitimate request to opt out of any sale of |
---|
56 | 56 | | a consumer's personal data or targeted advertising. |
---|
57 | 57 | | (4) |
---|
58 | 58 | | (A) If a consumer's decision to opt out of any processing of the |
---|
59 | 59 | | consumer's personal data for the purposes of targeted advertising, or any |
---|
60 | 60 | | sale of personal data, through an opt-out preference signal sent in |
---|
61 | 61 | | accordance with subdivision (d)(3) conflicts with the consumer's existing |
---|
62 | 62 | | controller-specific privacy setting or voluntary participation in a controller's |
---|
63 | 63 | | bona fide loyalty, rewards, premium features, discounts, or club card |
---|
64 | 64 | | |
---|
65 | 65 | | |
---|
66 | 66 | | - 3 - 001991 |
---|
67 | 67 | | |
---|
68 | 68 | | program, then the controller shall comply with the consumer's opt-out |
---|
69 | 69 | | preference signal but may notify the consumer of the conflict and provide |
---|
70 | 70 | | the choice to confirm controller-specific privacy settings or participation in |
---|
71 | 71 | | such a program. |
---|
72 | 72 | | (B) If a controller responds to consumer opt-out requests received |
---|
73 | 73 | | in accordance with subdivision (d)(3) by informing the consumer of a |
---|
74 | 74 | | charge for the use of any product or service, then the controller shall |
---|
75 | 75 | | present the terms of any financial incentive offered pursuant to |
---|
76 | 76 | | subdivision (d)(3) for the retention, use, sale, or sharing of the consumer's |
---|
77 | 77 | | personal data. |
---|
78 | 78 | | SECTION 2. This act takes effect July 1, 2025, the public welfare requiring it. |
---|