Bill > HB263

This bill establishes new protections for biological and neural data collected by health and fitness apps, defining "biological data" as information derived from an individual's biological or neural properties used to identify them, and "neural data" as information from central nervous system activity measurable by a device. It clarifies that a "covered entity" is the operator of such an app that collects this data for health or wellness purposes, and "express consent" requires clear, written or electronic permission after a prominent notice. The bill prohibits these covered entities from transferring, disclosing, or using a consumer's biological or neural data to third parties or for purposes beyond what's reasonably expected by the consumer without their express consent, and also prohibits marketing based on this data. The Attorney General is granted exclusive authority to enforce these provisions, with a process that includes issuing a notice of violation and allowing the entity 45 days to correct the issue before civil penalties of up to $3,000 per violation can be assessed. The bill includes several exceptions, such as for law enforcement, court orders, compliance with federal law, certain genetic testing companies, de-identified data, research by educational institutions, insurance regulations, and actions necessary to provide requested services, fulfill contracts, or prevent security incidents.