HB 630

CONSUMER RIGHTS Present law authorizes a consumer to invoke certain consumer rights at any time by submitting a request to a controller specifying the consumer rights the consumer wishes t o invoke. A "controller"" is the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information . A known child's parent or legal guardian may invoke the child's consumer rights. A controlle r must comply with an authenticated consumer request to exercise certain rights, including opting out of a controller's processing of personal information for purposes of (i) s elling personal information about the consumer; (ii) t argeted advertising; or (i ii) p rofiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. DESIGNATED AGENT This bill authorizes a consumer to designate another person to serve as the consumer's authorized agent and act on th e consumer's behalf to opt out of the processing of the consumer's personal data for the purposes of (i) s elling personal information about the consumer; (ii) t argeted advertising; or (iii) p rofiling in furtherance of decisions that produce legal or simila rly significant effects concerning the consumer. The consumer may designate an authorized agent using a technology, including a link to an internet website, an internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of such processing. A controller must comply with an opt-out request received from an authorized agent if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf. OPT-OUT METHODS This bill requires opt-out methods to provide a clear and conspicuous link on the controller's internet website to an internet web page that enables a consum er, or a consumer's authorized agent, to opt out of the targeted advertising or sale of the consumer's personal data. On or before January 1, 2026, this bill authorizes a consumer to opt out of any processing of the consumer's personal data for the purpo ses of targeted advertising, or any sale of such personal data through an opt-out preference signal sent with the consumer's consent, to the controller by a platform, technology, or mechanism that meets all of the following requirements:  Must not unfairly disadvantage another controller .  Must not make use of a default setting, but must require the consumer to make an affirmative, freely given, and unambiguous choice to indicate the consumer's intent to opt out of any processing of a consumer's personal data .  Must be consumer-friendly and easy to use by the average consumer .  Must be consistent with any federal or state law or rule .  Must allow the controller to accurately determine whether the consumer is a resident of this state and whether the consumer has made a legitimate request to opt out of any sale of a consumer's personal data or targeted advertising. INCENTIVE DISCLOSURES If a consumer's decision to opt out of any personal data processing for the purposes of targeted advertising, or any sale o f personal data, conflicts with the consumer's existing controller-specific privacy setting or voluntary participation in a controller's bona fide loyalty, rewards, premium features, discounts, or club card program, then this bill requires the controller t o comply with the consumer's opt-out preference signal but may notify the consumer of the conflict and provide the choice to confirm controller-specific privacy settings or participation in such a program. If a controller responds to consumer opt-out requ ests by informing the consumer of a charge for the use of any product or service, then the controller must present the terms of any financial incentive offered for the retention, use, sale, or sharing of the consumer's personal data."