Bill > SB111

This bill enacts the Georgia Consumer Privacy Protection Act, a comprehensive data privacy law that establishes new rights for consumers and obligations for businesses handling personal information. The law applies to businesses that conduct business in Georgia, have over $25 million in revenue, and either process personal information of at least 25,000 consumers (with over 50% of revenue from selling personal information) or process information of at least 175,000 consumers. Consumers are granted several key rights, including the ability to confirm what personal information a company has, access that information, correct inaccuracies, delete their personal information, obtain a copy of their data, and opt out of data sales, targeted advertising, and certain types of profiling. Companies must provide clear privacy notices, obtain consent for processing sensitive data, and implement reasonable data security practices. The law includes extensive exemptions for certain types of entities and data, such as healthcare providers, financial institutions, and government agencies. Enforcement is exclusively handled by the Attorney General, who must provide a 60-day cure period before taking action, with potential civil penalties of up to $7,500 per violation. The law does not create a private right of action for consumers, meaning individuals cannot sue companies directly for violations. The act will become effective on July 1, 2026, and preempts local privacy regulations in Georgia.

Business and Industry, Justice

https://www.legis.ga.gov/legislation/69990