Bill > H300

This bill establishes the "Online Advertising Act" to regulate how companies collect and use data from consumers browsing the internet for advertising purposes. It defines key terms like "consumer" (anyone using a website with ads), "non-personally identifiable information" (data that can't identify a specific person on its own, like browsing history), "online preference marketing" (using collected data to predict consumer interests for targeted ads), "personally identifiable information" (data that can directly identify someone, like a name or email), "publisher" (anyone with a website), and "third party advertising network" (companies collecting data for ad delivery). The Act requires these networks to clearly inform consumers on their websites about what data they collect, how it's used, and how long it's kept, especially if they engage in online preference marketing or merge different types of data. Consumers must be given the option to "opt-out" of online preference marketing, and affirmative consent is required before sensitive medical or financial data, or data related to sexual behavior or orientation, can be used for this purpose. Merging non-personally identifiable information with personally identifiable information also requires consumer consent. The bill mandates reasonable security measures to protect collected data and provides consumers with access to their personally identifiable information, with some exceptions. Non-personally identifiable information collected for ad delivery must be deleted after 24 months. The Attorney General can enforce these provisions, with penalties of up to $1,000 per violation, which can be tripled for repeated offenses.