Bill > SB0663

This bill amends Tennessee consumer data protection law to allow consumers to designate an authorized agent who can opt out of the processing of their personal data on their behalf. The bill establishes detailed requirements for how consumers and their authorized agents can exercise opt-out rights, including allowing consumers to use technology like internet browser settings or website links to indicate their intent to opt out of data processing. Controllers (companies handling consumer data) must comply with opt-out requests from authorized agents if they can reasonably verify the consumer's identity and the agent's authority. By January 1, 2026, controllers must provide a clear opt-out link on their website and accept opt-out preference signals that meet specific criteria, such as being consumer-friendly, not using default settings, and allowing accurate determination of the consumer's residency. The bill also addresses potential conflicts between opt-out signals and existing privacy settings or loyalty programs, requiring controllers to respect the opt-out signal while potentially notifying the consumer of any conflicts. If a controller suggests a charge for opting out, they must clearly present any financial incentives related to data retention or use. The law will take effect on July 1, 2025.