Regulon — GA-SB-495 · GA SB 495 (Age-Appropriate Design Code)

WHAT THIS BILL REGULATES · 7 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Public enforcement by the Georgia Attorney General under the Fair Business Practices Act of 1975, plus an express private right of action. The Attorney General may bring an action in a court of competent jurisdiction; any person who suffers injury or damages as a result of a violation may bring a private civil action. Small businesses (under $25M average revenue and under 50,000 individuals' personal data processed annually) are exempt from the design risk-assessment requirements in § 10-1-973.

Private Right of Action

private right of action.

Penalties

$5,000 per violation (CPI-adjusted) or actual damages, whichever is greater. Private plaintiffs may also recover restitution, injunctive relief, punitive damages of $50,000 or three times combined damages/costs/fees (whichever is greater), expenses of litigation including reasonable attorney's fees, and other equitable relief. Attorney General may obtain remedies provided in O.C.G.A. § 10-1-397 (Fair Business Practices Act).

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

O.C.G.A. §§ 10-1-970 & 10-1-971

Short title and definitions

10-1-970 This article shall be known and may be cited as the 'Age-Appropriate Design Code Act.'

10-1-971 As used in this article, the term: [definitions of Adult, Affiliate, Age status, Algorithmic feed, Algorithmic recommendation system, Biometric data, Collect, Compulsive use, Consumer, Covered entity, Default, De-identified data, Derived data, Design or design feature, Direct messaging, Genetic data, Media, Minor, Online service product or feature, Personal data, Process or processing, Processor, Publicly available information, Reasonable alternative design, Reasonably likely to be accessed, and Third party — see verbatim definitions catalogued in the top-level definitions object.]

Section 10-1-970 establishes the short title (Age-Appropriate Design Code Act). Section 10-1-971 supplies the lengthy definitional framework that drives every operative obligation in the article — most notably covered entity, minor, algorithmic recommendation system, algorithmic feed, compulsive use, design feature, and reasonably likely to be accessed.

The covered-entity definition pulls in any for-profit entity deriving a majority of its revenue from online services that are reasonably likely to be accessed by minors — a meaningfully broader reach than COPPA, which is keyed to services directed to children. The 2 percent audience threshold for the 'reasonably likely to be accessed' branch is the principal scoping lever practitioners should focus on.

O.C.G.A. § 10-1-972

Prohibited high-risk data practices and design features

Deployer

(a)(1)–(2) 1 A covered entity shall not engage in or use any of the following high-risk data practices or design features: (1) Collect, sell, share, or retain any personal data of a consumer that is not necessary to provide an online service, product, or feature with which a consumer is actively and knowingly engaged; (2) Use previously collected personal data of a consumer for any purpose other than a purpose for which the personal data was collected, unless necessary to comply with any obligation under this article;

(a)(3) 2 Permit any person, including a parent or guardian, to monitor the online activity of a consumer or to track the location of a consumer without providing a conspicuous signal to the consumer when the consumer is being monitored or tracked;

(a)(4)–(5) 3 Use the personal data of the consumer to select, recommend, or prioritize media for the consumer in an algorithmic feed, unless the consumer has explicitly requested to receive media from a specific account, specific category, or related media; (5) Use the personal data of the consumer to select, recommend, or prioritize media for the consumer in an algorithmic feed, unless the personal data are: (A) Consumer selected privacy or accessibility settings; (B) The consumer's location, but only to determine whether the consumer is within this state for purposes of complying with this Code section; (C) The consumer's age status, but only to implement the covered entity's policies regarding media appropriate for minors; or (D) A search query, provided the search query is used only to select and prioritize media in response to the search;

(a)(6) 4 Send push notifications to the consumer between the hours of 12:00 Midnight and 6:00 A.M.; or

(a)(7) 5 Use any design feature or component of a design feature that: (A) Automatically plays a video, unless the video is the next in a series and the consumer chose to play a prior video in the series; (B) Uses intermittent, variable reward schedules; (C) Continuously and seamlessly loads new media in an algorithmic feed and absent a specific request from the consumer, such as an infinite scroll feed; (D) Is intended to cause compulsive use; or (E) Has been identified and declared by the Attorney General as a prohibited data practice or design feature pursuant to subsection (c) of this Code section.

(b) A covered entity may engage in any of the high-risk data practices or design features listed in subsection (a) of this Code section if: (1) The consumer explicitly requests the practice or feature; and (2) The covered entity has used a commercially reasonable and technically feasible age-assurance method to determine that the consumer is not a minor.

(c)–(d) The Attorney General shall adopt rules and regulations pursuant to this article that prohibit a covered entity from engaging in or using any data practices or design features that: (1) Carry a risk of compulsive use that is not substantially outweighed by any benefits provided by the practice or feature to consumers; or (2) Subvert or impair consumer autonomy, decision making, or choice while using the covered entity's online service, product, or feature. (d) The Attorney General shall, at least once every two years, review and update the rules and regulations promulgated under subsection (c) of this Code Section to keep pace with emerging technology.

Section 10-1-972 is the core substantive prohibition. It bars covered entities from a defined list of data practices and design features unless the consumer explicitly requests them and the covered entity has used a commercially reasonable, technically feasible age-assurance method to confirm the consumer is not a minor. The list combines familiar privacy-minimization rules (collection limitation, purpose limitation) with novel design prohibitions targeting compulsive-use mechanics: variable reward schedules, autoplay, infinite scroll, overnight push notifications, and personalized algorithmic feeds.

Subsection (c) further authorizes the Attorney General to add to the prohibited list by rule, and (d) requires biennial review of those rules. The default rule for algorithmic feeds is a hard one: a feed served to a minor cannot use the minor's personal data to rank or select content beyond a narrow whitelist (privacy/accessibility settings, location for jurisdictional purposes, age status for content-appropriateness, and search query).

Compliance actions 5 items

Covered entities must not collect, sell, share, or retain any consumer personal data that is not necessary to provide a service the consumer is actively and knowingly engaged with, and must not reuse previously collected personal data for any purpose other than the original collection purpose.

D-01.4

Covered entities must not allow any person — including a parent or guardian — to monitor a consumer's online activity or track their location without displaying a conspicuous signal to the consumer that monitoring or tracking is occurring.

T-01.1

Covered entities must not use a minor's personal data to select, recommend, or prioritize media in an algorithmic feed, except using a narrow whitelist of inputs (privacy/accessibility settings, location to determine Georgia residency, age status for content-appropriateness policies, or a current search query).

MN-01.4

Covered entities must not send push notifications to a consumer between 12:00 a.m. and 6:00 a.m., unless the consumer is age-assured as not a minor and explicitly requested overnight notifications.

MN-01.12

Covered entities must not deploy autoplay video, intermittent variable reward schedules, infinite-scroll algorithmic feeds, designs intended to cause compulsive use, or any design feature the Attorney General has identified by rule as prohibited.

CP-01.2

O.C.G.A. § 10-1-973

Compulsive-use risk assessments and reasonable alternative design

DeployerDeveloper

(a)–(c) 6 Prior to deploying any new design, or making a material change to an existing design that will be deployed to consumers, a covered entity shall assess the risk that the design will cause compulsive use in minors. (b) For any design that carries a reasonably foreseeable risk of causing compulsive use in minors, a covered entity shall: (1) Determine if there is a reasonable alternative design; and (2) Provide the reasonable alternative design that carries the lowest risk of compulsive use as a default to each consumer, until: (A) The consumer explicitly requests the original design; and (B) The covered entity determines, using a commercially reasonable and technically feasible age-assurance method, that the consumer is not a minor. (c) Notwithstanding subsection (b) of this Code section, a covered entity shall not deploy any design to consumers if its assessed risk of causing compulsive use to minors outweighs the assessed benefit of the design to minors, unless: (1) The consumer explicitly requests the design; and (2) The covered entity determines, using a commercially reasonable and technically feasible age-assurance method, that the consumer is not a minor.

(d) 6 A covered entity shall assess all existing design and mitigate the risk of causing compulsive use in minors as described in this Code section.

(e) 7 A covered entity shall document each step taken in accordance with subsections (a), (b), and (c) of this Code section, along with any experiments, evidence, and data that support the assessments and determinations made, and retain such documents for a period of ten years. All data collected about individual consumers to comply with this subsection shall be de-identified and made anonymous.

(f) 8 A covered entity shall submit annually all records related to the assessments and determinations made in accordance with subsections (a), (b), and (c) of this Code section to an independent auditor who shall assess the records for compliance with this Code section and recommend any changes that would bolster compliance.

(g) Nothing in this Code section shall require a covered entity to: (1) Assess any media for the risk of causing compulsive use; or (2) Limit any consumer's access to any specific consumer generated content or category of consumer generated content.

(h) The provisions of this Code section shall not apply to a covered entity that qualifies as a small business. To qualify as a small business, a covered entity shall meet the following criteria for the three preceding calendar years, or for the covered entity's period of existence if the covered entity is less than three years old: (1) The covered entity's average annual gross revenues during the three-year period did not exceed $25 million, as adjusted annually based on the Consumer Price Index as reported by the Bureau of Labor Statistics of the United States Department of Labor; and (2) The covered entity, on average, did not annually collect, process, retain, or transfer the personal data of more than 50,000 people during the three-year period for any purpose other than initiating, rendering, billing for, finalizing, completing, or otherwise collecting payment for a requested service or product.

Section 10-1-973 imposes a documented pre-deployment risk-assessment regime focused specifically on compulsive use in minors. Before launching any new design (or material change to an existing design), a covered entity must assess the risk of causing compulsive use in minors. Where a reasonable alternative design exists, that lower-risk alternative must be the default for all consumers until the consumer explicitly requests the original design AND has been age-assured as not a minor.

Where the assessed compulsive-use risk to minors outweighs the benefit, the covered entity may not deploy the design at all to consumers — minor or adult — except after the same explicit-request-plus-age-assurance gate. Documentation must be retained for ten years; assessments must be submitted annually to an independent auditor for compliance review. Small businesses (under $25M average revenue and under 50,000 individuals' personal data processed) are exempt from this section only.

Compliance actions 3 items

Before deploying any new design or materially modifying an existing design, covered entities must assess the risk that the design will cause compulsive use in minors. Where a reasonable lower-risk alternative exists, the alternative must be set as the default until the consumer explicitly requests the original AND has been age-assured as not a minor. Designs whose minor-compulsive-use risk outweighs the benefit may not be deployed to any consumer absent that same gate. Existing designs must be retroactively assessed and mitigated.

S-01.1

Covered entities must contemporaneously document each step of the compulsive-use risk-assessment process — including supporting experiments, evidence, and data — and retain the documentation for ten years, with all individual-consumer data de-identified and anonymized.

G-01.3

Covered entities must annually submit all compulsive-use risk-assessment records to an independent auditor, who must assess compliance with § 10-1-973 and recommend remediation.

G-01.5

O.C.G.A. § 10-1-974

Default privacy and safety settings for minors

Deployer

(a)–(c) 9 A covered entity shall configure all default privacy settings provided to a minor through its online service, product, or feature to the highest level of privacy. (b) A covered entity shall provide the following settings by default to all minors: (1) Do not use an algorithmic recommendation system to recommend to adult consumers that they connect to a minor as a friend, follower, or contact on an online service; (2) Do not use an algorithmic recommendation system to recommend to adult consumers that they follow a minor's media, unless the minor's account was connected to the known adult's account as a friend, follower, or contact prior to the recommendation; (3) Do not use an algorithmic recommendation system to recommend to adult consumers that they communicate with a minor through direct messaging, unless the minor's account was connected to the known adult's account as a friend, follower, or contact prior to the recommendation; (4) Do not use an algorithmic recommendation system to recommend to minors that they communicate with a known adult through direct messaging, unless the minor's account was connected to the adult's account as a friend, follower, or contact prior to the recommendation; (5) Do not display a minor's friends, followers, or contacts; and (6) Disable search engine indexing of a minor's account profile and media. (c) A covered entity shall not display the location of any minor to another consumer by default; provided, however, that a covered entity may display a minor's location to another consumer when the minor has explicitly chosen to share his or her location with a specific consumer.

(d)–(e) 10 A covered entity shall not send push notifications to any minor by default or provide a single setting that enable all push notifications. (e) A covered entity shall provide minors with settings to enable or disable each specific category of push notification offered by the covered entity's online service, product, or feature, such as marketing notifications, direct message notifications, media interaction notifications, and any other category of notification pushed by the product or service.

(f) 11 A covered entity shall: (1) Disable by default all interaction counts, including counts of reactions and comments, on all of a minor's media; (2) Offer settings to minors to enable or disable specific types of interaction counts, such as comments, reactions, reshares, or other categories of interactions; and (3) Offer to minors a single setting to enable all interaction counts at once only if the settings to enable specific interactions are equally or more prominent and accessible.

(g) 12 A covered entity shall not undermine consumer autonomy in settings by: (1) Providing a minor with a single setting that makes more than one default privacy setting less protective at once; or (2) Requesting or prompting a minor to make any setting less protective, unless the change is strictly necessary for the minor to access a service, product, or feature explicitly requested by the minor.

(h) 13 A covered entity that facilitates communications between consumers shall provide a prominent, accessible, and responsive tool that gives minors the option to block specific consumers from taking, at minimum, each of the following actions: (A) Accessing the minor's media; (B) Interacting with the minor's media; (C) Communicating with the minor through their media; (D) Communicating with the minor through direct messaging; and (E) Communicating with the minor through any other means offered by the covered entity through its product or service. (2) The tool described in paragraph (1) of this subsection shall provide a minor with the option to prevent media from a blocked consumer from appearing in the minor's feed. (3) The tool described in paragraph (1) of this subsection shall, at a minimum, be accessible from a feature located: (A) Proximate to every instance of another consumer's username or avatar; (B) On all media shared by another consumer; (C) On every direct message or direct message thread; and (D) In a first-level settings menu labeled 'Blocked Users.' (4) The features listed in subparagraphs (A), (B), and (C) of paragraph (3) of this subsection shall provide a minor with the ability to: (A) Block the other consumer, which shall trigger all of the settings in paragraphs (1) and (2) of this subsection; or (B) Go to the settings feature to select more granular block settings for the other consumer.

(i)–(j) 14 A covered entity offering an algorithmic feed to a minor that uses the minor's personal data to select, recommend, or prioritize media in the feed shall provide a prominent and accessible interface that enables the minor to: (1) Explicitly communicate preferences about the types of media to be recommended and to be blocked in the output of the relevant algorithmic recommendation system; (2) Access, review, and make changes to any personal data the covered entity uses to determine the output of the relevant algorithmic recommendation system; and (3) Ensure that the relevant algorithmic recommendation system is informed by these preferences. (j) A covered entity offering an algorithmic feed to a minor that uses the minor's personal data to select, recommend, or prioritize media in the feed shall provide the minor with the choice of an algorithmic feed that only selects media from sources the minor affirmatively chose to follow or otherwise include in the feed.

(k) 15 A covered entity shall provide a prominent and accessible tool to allow: (A) A minor to request that the covered entity delete any account profiles, media, and personal data provided by, or obtained about, the minor, including personal data the minor provided to the covered entity, personal data the controller obtained from another source, and derived data; and (B) The parent or legal guardian of a minor to make such a request on the minor's behalf. (2) A request made pursuant to this subsection shall be honored no later than 15 days after a covered entity receives the request.

Section 10-1-974 prescribes a detailed catalog of default settings that covered entities must apply to minor accounts: maximum privacy, no adult-to-minor recommendations, no minor-to-known-adult DM recommendations, no display of minor friends/followers, search-engine-indexing disabled, location not displayed, push notifications off by default with category-by-category granular controls, interaction counts hidden by default, and no single setting that downgrades multiple privacy protections at once.

It also imposes a comprehensive blocking tool requirement, requires algorithmic-feed control surfaces letting minors set preferences and access/correct personal data feeding the recommendation system, mandates a minor-only-follow feed option, and creates a 15-day deletion right for minors and their parents/guardians.

Compliance actions 7 items

Covered entities must configure all default privacy settings for minors to the highest level — including: not recommending minors to adults (or vice versa) for friend/follow/DM connections absent a pre-existing connection, not displaying minor friend/follower lists, disabling search-engine indexing of minor accounts, and not displaying a minor's location to other consumers absent the minor's explicit per-recipient choice.

MN-01.8

Covered entities must turn off push notifications for minors by default, must not provide a single all-on toggle, and must offer category-by-category controls (marketing, DM, interactions, etc.) so minors can enable each notification type individually.

MN-01.4

Covered entities must hide all interaction counts (likes, reactions, comments, reshares) on minors' content by default, must offer per-category enable/disable controls, and may provide an enable-all toggle only if equally prominent per-category controls are also available.

MN-01.4

Covered entities must not give minors a single setting that downgrades multiple privacy defaults at once, and must not request or prompt minors to weaken any setting unless strictly necessary for a service the minor explicitly requested.

CP-01.3

Covered entities that facilitate consumer-to-consumer communication must provide minors with a prominent blocking tool — accessible from every username, avatar, shared media item, DM thread, and a top-level Blocked Users menu — that can prevent another user from accessing, interacting with, or communicating with the minor through any channel, with the option to suppress the blocked user's media from the minor's feed.

MN-01.8

Covered entities offering algorithmic feeds to minors that use the minor's personal data must provide a prominent control surface letting the minor set content preferences (recommend/block), access and correct the personal data feeding the recommendation system, and ensure the system honors those preferences. The covered entity must also offer minors a follow-only feed option that ranks content solely from sources the minor affirmatively chose.

D-01.1

Covered entities must provide a prominent, accessible tool letting a minor — or the minor's parent/guardian on their behalf — request deletion of all account profiles, media, and personal data (including data obtained from third parties andderived data) about the minor. Requests must be honored within 15 days.

MN-01.9

O.C.G.A. § 10-1-975

Public transparency about algorithmic systems and data use

Deployer

(1)–(4) 16 A covered entity shall prominently and clearly provide on its website or mobile application: (1) The covered entity's privacy information, terms of service, policies, and community standards; (2) The purpose of the feed and the algorithmic recommendation system used to determine the feed for each algorithmic feed in use by the covered entity; (3) For each algorithmic recommendation system in use by the covered entity: (A) The purpose of the system; (B) A description of any personal data of minors that is used as an input or to inform an input; (C) The source of the personal data; (D) The purpose of using the personal data; and (E) How each personal data input is measured and determined, if it is derived data and is weighed relative to the other inputs reported in this paragraph, and if it is categorized into one of four quartile groups according to the input's relative importance in contributing to the system's output; and (4) For every other feature of the product or service that uses the personal data of minors, descriptions of: (A) The purpose of the feature; (B) The personal data collected by the feature; (C) The personal data used by the feature; (D) How the personal data are used by the feature; (E) Any personal data transferred to or shared with a processor or third party by the feature, the identity of the processor or third party, and the purpose of the transfer or sharing; and (F) How long personal data are retained.

Section 10-1-975 imposes a public-website transparency catalog. The covered entity must publish its privacy information, terms of service, and community standards, plus per-feed and per-algorithmic-recommendation-system descriptions covering purpose, personal-data inputs (with quartile-bucketed input weighting for derived data), data sources, and use purposes. For every other feature using minor personal data, the entity must publish purpose, data collected/used, third-party transfers, and retention period.

The quartile-bucketed input-weight disclosure for derived data is unusual — it requires the operator to categorize each derived input by relative importance to the recommendation system's output.

Compliance actions 1 item

Covered entities must publish on their website or mobile application: (1) privacy policy, terms of service, and community standards; (2) for each algorithmic feed and recommendation system, the system's purpose, the minor personal data used as inputs, data sources, use purposes, and (for derived-data inputs) a quartile-bucket disclosure of relative input weight; and (3) for every other feature using minor personal data, purpose, data collected and used, third-party transfers and recipients, and retention periods.

G-02.4

O.C.G.A. § 10-1-976

Age assurance: data minimization, appeals, and rulemaking

Deployer

(a) 17 During the process of conducting age assurance, covered entities and processors shall: (1) Only collect personal data of a consumer that is strictly necessary for determining a consumer's age status; (2) Immediately upon determining that a consumer is a minor, delete any personal data collected of such consumer for age assurance, except the determination of the consumer's age status; (3) Not use any personal data of a consumer collected for age assurance for any other purpose; (4) Not combine personal data of a consumer collected for age assurance, except the determination of the consumer's age status, with any other personal data of the consumer; (5) Not disclose personal data of a consumer collected for age assurance to a third party that is not a processor; and (6) Implement a review process to allow consumers to appeal age status determinations.

(b) A covered entity or processor that complies with all of the provisions of this article shall not be liable for any inaccuracies in a consumer's age status.

(c)–(e) Subject to subsection (d) of this Code section, the Attorney General shall adopt rules and regulations: (1) Identifying commercially reasonable and technically feasible methods for covered entities and processors to determine if a consumer is a minor; (2) Describing the appropriate review process for consumers appealing age status determinations; (3) Describing transparency measures that would increase consumer trust in age-assurance methods; and (4) Providing any additional privacy protections for personal data collected for age assurance. (d) The Attorney General shall periodically review and update such rules and regulations as necessary to keep pace with emerging technology. (e) In adopting such rules and regulations, the Attorney General shall: (1) Prioritize consumer privacy and accessibility; (2) Consider the size, financial resources, and technical capabilities of covered entities and processors; (3) Consider the costs and effectiveness of available age-assurance methods; (4) Consider the impact of age-assurance methods on consumers' safety, utility, and experience; (5) Consider the efficacy of requiring covered entities and processors to use previously collected data to determine the age status of some or all consumers or adopting interoperable age assurance methods; and (6) Provide consumers with multiple options for age assurance.

Section 10-1-976 governs HOW age assurance must be conducted. Covered entities must minimize data collection during the age-assurance process to what is strictly necessary, must immediately delete that data on minor determination (retaining only the determined age status), must not reuse, combine, or disclose age-assurance data except to processors, and must offer a consumer appeal process for age-status determinations.

The Attorney General must adopt rules identifying commercially reasonable age-assurance methods, the appeal process, transparency measures, and additional privacy protections, with periodic updates. A safe harbor protects compliant entities from liability for inaccurate age-status determinations.

Compliance actions 1 item

When conducting age assurance, covered entities and processors must: (1) collect only data strictly necessary to determine age status; (2) immediately delete the data on minor determination, retaining only the age-status outcome; (3) not reuse, combine, or disclose age-assurance data outside the processor relationship; and (4) provide a consumer appeals process for age-status determinations.

D-01.6

O.C.G.A. § 10-1-977

Enforcement, penalties, and private right of action

(a)–(b) A violation of this article shall constitute an unfair or deceptive act or practice in the conduct of consumer transactions under Part 2 of Article 15 of this chapter, the 'Fair Business Practices Act of 1975,' and the enforcement against any such violation shall be by public enforcement by the Attorney General and shall be enforceable through private action. (b) Whenever it may appear to the Attorney General that any covered entity is using or has used any method, act, or practice declared by this article to be unlawful and that proceedings would be in the public interest, the Attorney General may bring action in a court of competent jurisdiction. Upon a showing by the Attorney General that a covered entity has violated this article, the court may enter or grant any or all of the relief provided for in Code Section 10-1-397.

(c)–(e) Any person who suffers injury or damages as a result of a violation of this article may bring an action individually against the person or persons engaged in such violation under the rules of civil procedure to seek equitable injunctive relief and to recover his or her general and exemplary damages sustained as a consequence thereof in any court having jurisdiction over the defendant. Such relief may include: (1) Restitution to any person or persons adversely affected by a defendant's actions in violation of this article; (2) Punitive damages in an amount equal to $50,000.00 or three times the combined total of damages, costs, and fees, whichever is greater; (3) Expenses of litigation, including reasonable attorney's fees; and (4) Other relief as the court deems just and equitable. (d) A covered entity that has violated a provision of this article shall be liable for damages of $5,000 per violation, as adjusted annually to reflect an increase in the Consumer Price Index, or actual damages, whichever is greater; (e) Except as otherwise provided, this article is cumulative with other laws and is not exclusive.

Section 10-1-977 hooks violations into the Georgia Fair Business Practices Act, authorizes Attorney General enforcement, and creates a strong private right of action. Statutory damages run $5,000 per violation (CPI-adjusted) or actual damages, whichever is greater. Private plaintiffs may also recover restitution, punitive damages of $50,000 or 3x combined damages/costs/fees (whichever is greater), and reasonable attorney's fees. Cumulative with other laws.

O.C.G.A. §§ 10-1-978 through 10-1-980

Construction, exclusions, and anti-retaliation

Deployer

10-1-978 Nothing in this article shall be interpreted or construed to: (1) Impose liability in a manner that is inconsistent with 47 U.S.C. Section 230; (2) Impose liability in a manner that is inconsistent with the First Amendment to the United States Constitution; (3) Force any consumer to undergo age assurance as a condition of accessing the online services, products, or features of a covered entity; (4) Prevent any consumer from accessing any consumer generated media; or (5) Preempt or otherwise affect any right, claim, remedy, presumption, or defense available at law or in equity, including but not limited to antidiscrimination, consumer protection, labor, and civil rights laws.

10-1-979 This article shall not apply to: (1) Any federal, state, tribal, or local government entity in the ordinary course of its operation; (2) Protected health information that a covered entity or its affiliate processes in accordance with the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996, P.L. 104-191, or documents that a covered entity or its affiliate creates for the purpose of complying with HIPAA; (3) Information used only for public health activities and purposes described in 45 C.F.R. Section 164.512; (4) Information that identifies a consumer with: (A) Activities that are subject to the federal policy for the protection of human subjects as set forth in 45 C.F.R. Part 46; (B) Research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; (C) Activities that are subject to the protections provided in 21 C.F.R. Part 50 and 21 C.F.R. Part 56; or (D) Research conducted in accordance with the requirements set forth in subparagraphs (A) through (C) of this paragraph or otherwise in accordance with state or federal law; (5) Any entity whose primary purpose is journalism and has a majority of its workforce consisting of persons engaging in journalism; or (6) Any financial institution subject to Title V of the federal Gramm-Leach-Bliley Act, P.L. 106-102, and regulations adopted to implement that act.

10-1-980 18 A covered entity shall not discriminate or retaliate against any consumer, including denying products or services, charging different prices or rates for products or services, or providing lower quality products or services to the consumer, for receiving any of the protections contained in this chapter, for exercising any of the rights contained in this article, for refusing to change privacy and safety settings, or for refusing to agree to the collection or processing of personal data or to the use of any design feature.

Section 10-1-978 contains construction savings clauses (47 U.S.C. § 230, First Amendment, no forced age assurance, no preemption of other rights/remedies). Section 10-1-979 carves out government entities, HIPAA-protected health information, public-health data, human-subjects research, journalism entities, and Gramm-Leach-Bliley financial institutions. Section 10-1-980 prohibits retaliation against consumers who exercise rights under the article — including denying service, charging different prices, or providing lower-quality service.

Compliance actions 1 item

Covered entities must not retaliate or discriminate against consumers — by denying service, charging different prices, or providing lower-quality service — because the consumer exercised rights under the article, refused to weaken privacy/safety settings, or refused to consent to data processing or design features.

—

Minor Safety Parental consent · controls · termination workflows

7 items

MN-01.4

MN-01.12

Covered entities must not send push notifications to a consumer between 12:00 a.m. and 6:00 a.m., unless the consumer is age-assured as not a minor and explicitly requested overnight notifications.

MN-01.8

MN-01.4

MN-01.8

MN-01.9

Transparency AI identity disclosure · periodic reminders

1 item

T-01.1

Safety Harmful content prevention · self-harm escalation

1 item

S-01.1

Data Controls Data sale restrictions · deidentification

3 items

D-01.4

D-01.1

D-01.6

Deceptive Conduct AI-generated likeness · consent requirements

2 items

CP-01.2

CP-01.3

Governance Risk management · accountability programs

3 items

G-01.3

G-01.5

Covered entities must annually submit all compulsive-use risk-assessment records to an independent auditor, who must assess compliance with § 10-1-973 and recommend remediation.

G-02.4

—

Other

1 item

—

Passage Likelihood

Low

Status Introduced

Chamber No passage

Committee No action

Majority party No

Bipartisan No

Prior session None

Legislative History

2026-02-11 Senate Hopper

2026-02-12 Senate Read and Referred

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated