Consumer Data Privacy Act

The act governs how businesses collect, use, and share consumers' personal data, dividing responsibility between the controllers who determine why data is processed and the processors who handle it on their behalf, while carving out categories of entities and data that fall outside its reach. It gives consumers rights over their own information — including the ability to opt out of certain processing, to exercise those rights through an authorized agent, and to appeal a controller's response — and imposes on controllers a duty of care, limits on how collected data may be used, standards for treating data as de-identified, and an obligation to conduct data protection assessments before undertaking processing that carries heightened risk. Additional duties attach to the personal data of minors, and compliance is backed by enforcement authority that includes civil penalties and injunctive relief.

Editorial summary generated from the text of this act. It is not part of the statute — read the sections below for the operative language.