SB 3603

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a consumer may opt out of the processing of personal data for the purpose of targeted advertising by submitting a request using the methods specified in a data processing controller's privacy notice. Sets forth the requirements of a controller's privacy notice. Provides that, if a controller processes personal data for purposes of targeted advertising or sells personal data to third parties for targeted advertising, the controller shall disclose the processing or sale in a privacy notice and provide access to a clear and conspicuous method outside the privacy notice for a consumer to opt out of the processing or sale. Makes other changes. Effective January 1, 2028.