Bill > S09088

This bill establishes new regulations for "data brokers," which are businesses that knowingly collect and sell personal information of consumers, especially when they don't have a direct relationship with that consumer or collect information outside of the consumer's expected interaction. Key provisions include requiring data brokers to register with the Attorney General, pay a registration fee, and disclose specific details about their data collection and sharing practices, including whether they collect data from minors or sensitive information like precise geolocation or reproductive health data. The bill also mandates the creation of a centralized "data deletion mechanism" that allows consumers to request the deletion of their personal information from all registered data brokers through a single request, with data brokers required to comply within 45 days. Furthermore, data brokers must implement comprehensive information security programs to protect consumer data and are subject to audits by independent third parties. The bill outlines penalties for violations, including daily civil fines for failing to register, delete data, or comply with disclosure requirements, and also provides exemptions for certain entities like healthcare providers and financial institutions covered by other federal laws.