Controllers, processors, and consumer health data controllers operating a facial recognition database must maintain a privacy policy that lets consumers (1) readily determine whether they are included in the FRT database and (2) submit a written request to be removed. The entity must grant or deny each removal request within 15 days and send a written notice to the consumer disclosing the decision, the reasons for it, and — if denied — contact information for the Connecticut Attorney General's office.

Controllers must provide consumers with a reasonably accessible, clear, and meaningful privacy notice disclosing: (1) categories of personal data processed, (2) processing purposes, (3) how to exercise consumer rights and appeal decisions, (4) categories of data shared with third parties, and (5) categories of third-party recipients.

Controllers must establish and describe in a privacy notice one or more secure and reliable means for consumers to submit rights requests, accounting for normal interaction channels, security, and authentication capability. Controllers must not require consumers to create a new account to exercise their rights.

Covered online services must display an obvious sign to covered minors when precise geolocation information is being collected or used.

Workers have the right to request, and employers must provide, a copy of the most recent 12 months of the worker's own data primarily used by an ADS to make a disciplinary, termination, or deactivation decision. Workers may make one such request every 12 months. When providing worker data, employers must anonymize all personal information of customers, other workers, and other individuals.

Manufacturers and operators must, upon request, provide the owner with all footage captured by the owner's networked camera device within 72 hours, regardless of subscription status, in a commonly used electronic format.

Chatbot providers must, upon request by a user, provide the user with access to their own chat logs in a downloadable and easy-to-read format. Providers must not discriminate or retaliate against a user who requests their chat logs.

Social media companies and deployers must allow consumers to request a copy of their personal information, contextual data, and social graph, and must fulfill the request within five business days in a format that is portable, readily usable, and transmittable to another platform or deployer without impediment.

Deployers must, before collecting any personal data of an applicant or employee for processing in an automated employment-related decision process, provide written notice disclosing: (1) the purpose of the data collection, (2) the categories of personal data to be collected, (3) the data retention period, (4) the categories of persons who will have access to the data, and (5) information about the right to opt out of personal data processing under § 42-518.

Covered entities offering algorithmic feeds to minors that use the minor's personal data must provide a prominent control surface letting the minor set content preferences (recommend/block), access and correct the personal data feeding the recommendation system, and ensure the system honors those preferences. The covered entity must also offer minors a follow-only feed option that ranks content solely from sources the minor affirmatively chose.

Deployers and developers must provide affected individuals with the right to access all personal characteristics analyzed, predicted, input, inferred, or collected by the algorithmic decision system and the right to challenge and correct inaccurate data, and must create reasonable, accessible, plain-language procedures for exercising these rights.

Device companies must present a standalone agreement at smart device initialization that (1) notifies the user that AI is installed, (2) includes the device's statement of purpose if the AI accesses private data, (3) offers an option to uninstall the AI, and (4) provides an interactive form allowing the user to refuse AI access to each type of private data before it is accessed. This agreement must be separate from any terms of service or EULA.

Device companies must update the initialization agreement and re-present it on each affected smart device whenever the statement of purpose changes, so that users who have not yet authorized or refused access under the new terms can do so.

Developers must present a standalone agreement at initial application startup that (1) notifies the user that the application includes AI and accesses private data, (2) includes the application's statement of purpose, and (3) provides an interactive form allowing the user to refuse application access to each type of private data before it is accessed. This agreement must be separate from any terms of service or EULA.

Developers must update the initialization agreement and re-present it on each affected smart device whenever the application's statement of purpose changes, so that users who have not yet authorized or refused access under the new terms can do so.

Employees have the right to request a copy of the most recent twelve months of their own data primarily used by an automated decision system to make a discipline, termination, or deactivation decision. Employers must provide the data upon request. Employees are limited to one request every twelve months.

Employers must allow employees and their exclusive bargaining representatives to view the data collected by any automated decision-making system that is collecting employee data.

Entities must make available to consumers (1) a high-level privacy policy overview covering the entity's collection, use, and disclosure of neurotechnology data, and (2) a prominent, publicly available privacy notice covering data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices.

Social media companies and model operators must provide users who request a copy of their personal data with all personal data — including social graph and contextual data — in a format that is portable, readily usable, and allows unimpeded transfer to another social media company or model operator.

Employers must allow workers to access worker data collected, used by, or produced by an ADS and to correct errors in any input or output data used by or produced by the ADS or used as corroborating evidence by a human reviewer. Workers may designate an authorized representative to request data access on their behalf.

Employers must, upon a worker's request, provide a copy of the most recent twelve months of the worker's own data primarily used by an ADS to make a discipline, termination, or deactivation decision. Workers are limited to one such request per twelve-month period.

Chatbot providers must provide users the ability to access their own retained chat logs at any time in a downloadable, human-readable, and machine-readable format, and must not discriminate against users for exercising this right.

Covered insurers must, upon consumer request, identify data sources used in an insurance decision, allow consumers to dispute data accuracy, correct inaccurate data and reconsider the adverse action, and investigate data disputes within 30 days.

Covered entities must, upon verified request, provide individuals with the right to (1) access their covered data in human-readable and machine-readable formats, (2) correct inaccuracies and notify downstream recipients, (3) delete their covered data and notify downstream recipients, and (4) export their data portably — all within 45 days (extendable by 20 days), free of charge for the first two requests per year, and without using dark patterns or deceptive design to impede exercise of these rights.

Controllers must honor consumer rights to confirm and access personal data (including inferences), obtain third-party recipient lists, correct inaccuracies with downstream notification, delete personal data with downstream notification, and obtain a portable copy — responding within 45 days (extendable by 20 days) and providing at least two free responses per 12-month period.

Controllers must publish a clear and meaningful privacy notice — provided directly to consumers and publicly online — that discloses categories of personal and sensitive data collected, processing purposes per category, how to exercise consumer rights, categories of third-party data transfers, retention periods, and contact information, and must notify consumers before implementing material changes.

Employers must provide prior written notice to and obtain written consent from all candidates and employees subject to electronic monitoring, and must conspicuously post notice describing the monitoring purpose, data collected, schedule, ADS usage, retention, use in employment decisions, productivity assessments, storage, least-invasive justification, opt-out rights, and how to exercise rights under the chapter.

Employers must give prior written notice to and obtain written consent from all candidates and employees subject to electronic monitoring, and must post the notice in a conspicuous place readily available for viewing. The notice must include at minimum: (1) a description of the monitoring purpose; (2) a description of the specific employee data to be collected, stored, secured, and disposed of, and the activities, locations, communications, and job roles monitored; (3) the dates, times, and frequency of monitoring; (4) whether and how collected data will be used as input to an automated employment decision tool; (5) whether and how collected data will be used to make an employment decision; (6) whether and how data may be used in discipline, compliance, adjudications, or litigation; (7) whether data will be used for productivity assessment or standards-setting; (8) where data will be stored and how long retained; (9) an explanation of how the monitoring practice is the least invasive means available; (10) a statement of the employee's right to refuse sale, transfer, or disclosure of their data; and (11) a description of how the employee can exercise rights under this chapter.

Employers using an electronic monitoring tool or automated decisions tool must: (a) provide written notice to all covered individuals subject to the tool; (b) obtain written consent from each covered individual; (c) ensure that collected data is accurate and up to date; (d) allow covered individuals to correct inaccurate data about themselves; (e) use the tool in a narrowly tailored manner to accomplish only a permitted purpose; (f) use the tool through the least invasive means possible; (g) ensure the tool applies to the smallest number of covered individuals, collects the least amount of data, and is used no more frequently than necessary; and (h) ensure the tool does not collect any employee data when the employee is off duty.

Employers using an electronic monitoring tool or automated decisions tool must display a poster at the employer's place of business, in a conspicuous place accessible to employees, that provides notice of the use of the tool.

At least 30 days before implementing an electronic monitoring tool or automated decisions tool, employers must provide written notice of the tool's use to all employees. Employers must also include the notice in every job posting, post it on the employer's website, provide it directly to every applicant, and make it available in accessible formats accounting for the applicant's first language (if not English) and any disability. The notice must provide covered individuals with the ability to opt out. If a covered individual opts out, the employer must not use the tool for any employment-related decisions concerning that individual.

At least 30 days before implementing a monitoring or automated decisions tool, employers must give written notice to all employees, include it in every job posting, on the website, and directly to applicants in accessible language- and disability-appropriate formats, and must let workers opt out — and may not use the tool to make any employment-related decision about a worker who opts out.

Any person using an automated decision system for pricing or wage decisions must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge inaccurate data, and (3) allow consumers or workers to request and receive information about what data is considered and how the system uses it.

Persons using an automated decision system for pricing or wage decisions must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge data accuracy, and (3) provide consumers or workers with information about what data the system considers and how it uses that data.

Employers must obtain affirmative written consent from each job applicant or worker before subjecting them to an automated decision system. The worker must first receive the pre-use notice required under § 181.9922 before providing consent.

Employers must, within seven days of a worker's request, provide copies of: (1) any of the worker's data collected, used, or produced by an ADS; (2) any input or output data used or produced by the ADS; and (3) any corroborating evidence used by a human reviewer.

Employers must provide workers with copies of their monitored data and any corroborating evidence used by a human reviewer within seven days of receiving a request.

Persons using an automated decision system for wage- or price-setting must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge inaccurate data, and (3) enable consumers or workers to request and receive information about what data is considered and how the system uses it.

Persons using automated decision systems for wage or price decisions must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge the accuracy of data used by the system, and (3) enable consumers or workers to request and receive information about what data the system considers and how it uses that data.

Employers must provide workers with a copy of all of their data collected through electronic monitoring tools, and any corroborating evidence used by a human reviewer, within seven days of receiving a request.

Employers must provide workers with copies of their data — including all worker data collected, used, or produced by the automated decision system, all input/output data, and any corroborating evidence used by a human reviewer — within seven days of a worker's request.

Employers must, within five calendar days of an employee's or former employee's request, provide in English and the employee's primary language: (1) a written description of applicable work performance standards, (2) personal work speed data for the prior ninety days, (3) aggregated work speed data for similar employees at the same site for the prior ninety days, and (4) any discipline notices from the prior year. Former employees are limited to one request.

Employers, public entities, and vendors must ensure all employee and service beneficiary data is accurate and up to date, notify individuals of significant data changes, provide access to all held data, and allow written correction or removal requests at least annually. If a correction request is denied, the employer must provide a written explanation and retain the request and explanation for appeal purposes.

Employers and employment agencies must publish on the employment section of their website in a clear and conspicuous manner their AEDT data retention policy, the types of data collected, and data sources. They must also post instructions for submitting written requests for this information and respond within 30 days, or explain why disclosure would violate law or interfere with a law enforcement investigation.

Employers must, upon worker request, provide a copy of the most recent 12 months of the worker's own data primarily used by an ADS for a discipline, termination, or deactivation decision. Workers may make one such request per 12-month period. Data provided must anonymize any customer, other worker, or individual personal information.

Landlords must not share a tenant's personal data with any third party without the tenant's written consent.

Landlords must disclose to each tenant the categories of personal data processed, sources of data collection, processing purposes, retention periods, and the identity and data practices of each third party with whom tenant data is shared — including whether the third party uses the data for targeted advertising.

Designers, developers, and deployers of automated systems must seek and respect New York residents' decisions regarding the collection, use, access, transfer, and deletion of their data in all appropriate ways and to the fullest extent possible. Where honoring such decisions is not possible, alternative privacy-by-design safeguards must be implemented.

Persons developing automated systems must use consent to justify data collection only where consent can be appropriately and meaningfully given. Consent requests must be brief, understandable in plain language, and give residents agency over data collection and its specific context of use. Existing practices of complex notice-and-choice for broad data use must be transformed to emphasize clarity and user comprehension.

Employers must ensure employee data used by an AEDT is accurate and kept up to date for three years. Current and former employees have the right to request and receive, at no cost and within 14 calendar days, a copy of their own data used by the AEDT, in English or the employee's primary language. Former employees are limited to one request per year. Employers that do not monitor the relevant data have no obligation to provide it.

Landlords must disclose to each tenant the categories of personal data processed, the sources of collection, the purposes of processing, retention periods, and the identity of each third party receiving the data — including, for each third party, the categories shared, the purposes, the retention period, and whether the data is used for targeted advertising.

Employers using authorized automated wage-setting systems must develop and publish reasonable procedures to (1) ensure the accuracy of all data considered by the automated decision system, (2) allow employees to correct or challenge data accuracy, and (3) enable employees to request and receive information about what data was considered and how the system used it to set their particular wages.

Employers must ensure employee data used by AEDTs is accurate and kept up to date for three years, and must provide current or former employees with a copy of their own data used by an AEDT within 14 calendar days of request, at no cost, in the employee's primary language.

Employers must ensure electronically monitored data used for employment decisions is accurate and up to date. Current and former employees have the right to request a copy of their own monitored data and aggregated peer data (former employees limited to one request per year). Employers must respond within seven calendar days at no cost to the employee, in the employee's primary language, and may not take adverse action against employees who make such requests.

Employers using automated decision systems for wage-setting under the safe harbor must develop and publish reasonable procedures, as specified by the attorney general, to (1) ensure data accuracy, (2) allow employees to correct or challenge data used by the system, and (3) enable employees to request and receive information about what data is considered and how the system used it to set their wages.

State education agencies and local school districts must provide parents, within thirty days of request, a complete record of all data elements collected or maintained on their child and must honor requests to correct or delete inaccurate or unnecessary data.

School districts and the State Department of Education must provide parents annual written notice listing all data elements collected on their child, the purpose of each, and all authorized data-sharing agreements.

Digital platforms must obtain clear, conspicuous opt-in consent — separate from terms of service — before deploying an AI simulation of a user after death or five years of inactivity, specifying the content categories, simulation duration, and whether private communications may be used, and must let the user revoke consent at any time; consent expires two years after death unless renewed by the estate.

Employers must give prior written notice to and obtain written acknowledgment from all candidates and employees subject to electronic monitoring, and must also post the notice in a conspicuous place readily available for viewing. The notice must include at minimum: (1) the purpose for which the monitoring tool will be used, (2) the specific employee data to be collected, stored, secured, and disposed of and the schedule therefor, plus the activities, locations, communications, and job roles to be monitored, (3) the dates, times, and frequency of monitoring, (4) whether and how data will be used as input in an ADS, (5) whether and how data will be used alone or with an ADS to make employment decisions, (6) whether and how data may be stored and used in discipline, internal compliance, adjudications, or litigation, (7) whether data will be used to assess productivity performance or set productivity standards and how, (8) where data will be stored and how long it will be retained, (9) an explanation of how the monitoring practice is the least invasive means available, (10) that the employee has the right to refuse the sale, transfer, or disclosure of their employee data, and (11) a clear and understandable description of how an employee can exercise their rights under the chapter.

Chatbot providers must provide users with access to their own chat logs at any time upon request. Chat logs must be provided in a downloadable and easy-to-read format. Providers must not discriminate or retaliate against a user who requests their chat logs.

Chatbot providers must provide any user with access to their own chat logs at any time upon request. Chat logs must be delivered in a downloadable and easy-to-read format. Chatbot providers must not discriminate or retaliate against a user who requests their chat logs.

Persons intending to use an automated decision system to inform worker wages must, at least 180 days before commencing such use, publicly publish in a conspicuous and accessible format reasonable procedures that include (1) a process for ensuring data accuracy, (2) disclosure to all affected workers of what data the system considers and how it uses that data when setting wages, and (3) a procedure for workers to correct or challenge data accuracy.

Providers of covered online platforms must present minor users with a clear and conspicuous notice that the platform uses a personalized recommendation system to select content, displayed the first time the minor interacts with the system.

Providers of covered online platforms must include in their terms and conditions a clear, accessible, and current description of (1) features, inputs, and parameters essential to the personalized recommendation system's operation, (2) how user-specific data is collected or inferred and the categories of such data, (3) all available user options to opt out, switch algorithms, modify their profile, or influence the system's inputs, and (4) each quantity the system is designed to optimize and its relative importance.

Developers must provide a publicly available mechanism for primary content owners to submit Training Data Verification Requests and must verify within 30 days whether the owner's content was ingested by or included in a generative AI training dataset.

Employers must provide written notice to each employee at least 15 calendar days before commencing any form of electronic monitoring. The notice must be in plain, clear, and concise language in the employee's primary language and must include at minimum 14 enumerated items: the form of monitoring; its purpose and necessity; how data will be used including for employment decisions; the technologies used; the activities, locations, communications, and job roles monitored; any third-party monitors and contract terms; any non-employer data recipients and reasons; internal positions with data access; monitoring frequency, timing, and location; data retention periods and destruction schedules; how employees can access and correct data; a cover sheet summary; employee rights and available remedies; and complaint instructions. When monitoring tracks productivity or performance, additional disclosures of standards, measurement methods, and consequences are required. Updated notice must be provided for any significant changes. An exception to advance notice applies only when the employer has reasonable grounds to believe an employee is engaged in illegal conduct, rights violations, or creating a hostile work environment — and the monitoring must be narrowly tailored and otherwise compliant.

Employers must annually provide each employee with a list of all electronic monitoring systems currently in use in relation to that employee. The list must be in the employee's primary language. A system is considered currently in use if the employer is currently using it, used it within the past 90 days, or intends to use it within the next 30 days.

Employers must, within seven days of receiving a request, provide an employee with access to any data relating to that employee that was produced or utilized by electronic monitoring or an automated decision system used by the employer.

Chatbot providers must provide users with access to any of their own retained chat logs at any time, in a portable, downloadable, human- and machine-readable format. Chatbot providers must not discriminate or retaliate against any user for exercising this access right.

Employers must provide each affected employee with written notice at least 15 calendar days before commencing electronic monitoring, in the employee's primary language, covering the form, purpose, data use, technologies, employment-decision linkage, third-party access, retention period, data access and correction rights, and the employee's statutory rights. Updated notice must be provided upon any significant change. An exception applies where the employer has reasonable grounds to believe the employee is engaged in illegal conduct, rights violations, or hostile-work-environment behavior and monitoring is reasonably likely to produce evidence.

Employers must annually provide each employee with a list of all electronic monitoring systems currently in use, recently used (within 90 days), or planned for use (within 30 days) in relation to that employee, in the employee's primary language.

Employers must provide any employee, upon request, with all data relating to that employee that was produced or utilized by electronic monitoring or an automated decision system used by the employer.

Entities must provide consumers with clear and complete information about the entity's policies and procedures for the collection, use, or disclosure of genetic data, including: (1) a high-level privacy policy overview covering basic, essential information about genetic data collection, use, and disclosure; and (2) a prominent, publicly available privacy notice covering, at minimum, data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices for genetic data.

Deployers must, upon request from a consumer who experienced an adverse outcome from a consequential decision materially influenced by a covered ADMT, provide instructions for requesting personal data and for correcting factually incorrect or materially inaccurate personal data used in the consequential decision, consistent with § 6-1-1306. The correction right does not extend to opinions, predictions, scores, or protected evaluations. The consumer-definition exceptions in § 6-1-1303(6)(b) and certain CPA exceptions do not apply to this data-correction right.

Controllers, processors, and consumer health data controllers operating a facial recognition database must maintain a privacy policy that lets consumers (1) readily determine whether they are included in the FRT database and (2) submit a written request to be removed. The entity must grant or deny each removal request within 15 days and send a written notice to the consumer disclosing the decision, the reasons for it, and — if denied — contact information for the Connecticut Attorney General's office.

Workers have the right to request, and employers must provide, a copy of the most recent 12 months of the worker's own data primarily used by an ADS to make a disciplinary, termination, or deactivation decision. Workers may make one such request every 12 months. When providing worker data, employers must anonymize all personal information of customers, other workers, and other individuals.

Manufacturers and operators must, upon request, delete all footage and derivative data associated with an owner's networked camera device within 30 days.

Covered entities offering algorithmic feeds to minors that use the minor's personal data must provide a prominent control surface letting the minor set content preferences (recommend/block), access and correct the personal data feeding the recommendation system, and ensure the system honors those preferences. The covered entity must also offer minors a follow-only feed option that ranks content solely from sources the minor affirmatively chose.

Deployers and developers must provide affected individuals with the right to access all personal characteristics analyzed, predicted, input, inferred, or collected by the algorithmic decision system and the right to challenge and correct inaccurate data, and must create reasonable, accessible, plain-language procedures for exercising these rights.

Entities must provide consumers with the ability to (1) access their neurotechnology data, (2) request and obtain its destruction, and (3) revoke any previously provided consent. These rights may be waived for clinical research conducted under express informed written consent meeting specified conditions, including ICH-GCP compliance, a 14-day waiting period for secondary research use, separate consent, readable format, disclosure of data retention policies, and notice of rights waiver.

Employers must allow workers to access worker data collected, used by, or produced by an ADS and to correct errors in any input or output data used by or produced by the ADS or used as corroborating evidence by a human reviewer. Workers may designate an authorized representative to request data access on their behalf.

Covered insurers must, upon consumer request, identify data sources used in an insurance decision, allow consumers to dispute data accuracy, correct inaccurate data and reconsider the adverse action, and investigate data disputes within 30 days.

Covered entities must, upon verified request, provide individuals with the right to (1) access their covered data in human-readable and machine-readable formats, (2) correct inaccuracies and notify downstream recipients, (3) delete their covered data and notify downstream recipients, and (4) export their data portably — all within 45 days (extendable by 20 days), free of charge for the first two requests per year, and without using dark patterns or deceptive design to impede exercise of these rights.

Controllers must honor consumer rights to confirm and access personal data (including inferences), obtain third-party recipient lists, correct inaccuracies with downstream notification, delete personal data with downstream notification, and obtain a portable copy — responding within 45 days (extendable by 20 days) and providing at least two free responses per 12-month period.

Employers using an electronic monitoring tool or automated decisions tool must: (a) provide written notice to all covered individuals subject to the tool; (b) obtain written consent from each covered individual; (c) ensure that collected data is accurate and up to date; (d) allow covered individuals to correct inaccurate data about themselves; (e) use the tool in a narrowly tailored manner to accomplish only a permitted purpose; (f) use the tool through the least invasive means possible; (g) ensure the tool applies to the smallest number of covered individuals, collects the least amount of data, and is used no more frequently than necessary; and (h) ensure the tool does not collect any employee data when the employee is off duty.

Any person using an automated decision system for pricing or wage decisions must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge inaccurate data, and (3) allow consumers or workers to request and receive information about what data is considered and how the system uses it.

Persons using an automated decision system for pricing or wage decisions must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge data accuracy, and (3) provide consumers or workers with information about what data the system considers and how it uses that data.

Employers must honor worker requests to correct inaccurate data collected, used, or produced by an ADS. Upon receiving a correction request, the employer must investigate the dispute and, if the data is inaccurate: (1) promptly correct the data and inform the worker; (2) review and adjust any employment-related decisions partially or solely based on the inaccurate data and inform the worker; and (3) notify any third parties that shared or supplied the inaccurate data and direct them to correct it. If the employer determines the data is accurate, it must inform the worker of: the decision not to amend, the verification steps taken, and the supporting evidence.

Employers must investigate worker requests to correct monitored data, correct confirmed inaccuracies, adjust any employment-related decisions that relied on the inaccurate data, notify affected third parties, and — if the data is determined accurate — provide the worker with a written explanation of the verification steps and supporting evidence.

Persons using an automated decision system for wage- or price-setting must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge inaccurate data, and (3) enable consumers or workers to request and receive information about what data is considered and how the system uses it.

Persons using automated decision systems for wage or price decisions must develop and publish reasonable procedures to (1) ensure data accuracy, (2) allow consumers or workers to correct or challenge the accuracy of data used by the system, and (3) enable consumers or workers to request and receive information about what data the system considers and how it uses that data.

Employers must investigate worker requests to correct monitoring data, correct confirmed inaccuracies, adjust employment decisions based on inaccurate data, notify affected third parties, and — if the data is found accurate — explain to the worker the decision, the verification steps, and the supporting evidence.

Employers must investigate and, if data is found inaccurate, promptly correct any worker data used by the automated decision system, review and adjust any employment-related decisions based on the inaccurate data, and notify affected third parties. If the data is found accurate, the employer must inform the worker of the decision, the verification steps taken, and the supporting evidence.

Employers, public entities, and vendors must ensure all employee and service beneficiary data is accurate and up to date, notify individuals of significant data changes, provide access to all held data, and allow written correction or removal requests at least annually. If a correction request is denied, the employer must provide a written explanation and retain the request and explanation for appeal purposes.

Employers, public entities, and vendors must keep individual data accurate, notify individuals of significant changes, provide at least annual access and correction/removal rights, and retain written explanations of any denied correction for use in later appeals.

Employers must, upon worker request, provide a copy of the most recent 12 months of the worker's own data primarily used by an ADS for a discipline, termination, or deactivation decision. Workers may make one such request per 12-month period. Data provided must anonymize any customer, other worker, or individual personal information.

Designers, developers, and deployers of automated systems must seek and respect New York residents' decisions regarding the collection, use, access, transfer, and deletion of their data in all appropriate ways and to the fullest extent possible. Where honoring such decisions is not possible, alternative privacy-by-design safeguards must be implemented.

Employers must ensure employee data used by an AEDT is accurate and kept up to date for three years. Current and former employees have the right to request and receive, at no cost and within 14 calendar days, a copy of their own data used by the AEDT, in English or the employee's primary language. Former employees are limited to one request per year. Employers that do not monitor the relevant data have no obligation to provide it.

Employers must investigate correction requests, and if the data is inaccurate, must (1) promptly correct it and inform the employee, (2) review and adjust employment decisions based on the inaccurate data and inform the employee, and (3) notify and direct correction by third parties with whom the data was shared. If the employer determines the data is accurate, it must inform the employee of that decision, the verification steps taken, and the supporting evidence.

Employers using authorized automated wage-setting systems must develop and publish reasonable procedures to (1) ensure the accuracy of all data considered by the automated decision system, (2) allow employees to correct or challenge data accuracy, and (3) enable employees to request and receive information about what data was considered and how the system used it to set their particular wages.

Employers must ensure employee data used by AEDTs is accurate and kept up to date for three years, and must provide current or former employees with a copy of their own data used by an AEDT within 14 calendar days of request, at no cost, in the employee's primary language.

Employers must investigate employee requests to correct inaccurate AEDT data and, if inaccuracy is confirmed, must (1) correct the data, (2) review and adjust any employment decisions based on the inaccurate data, and (3) notify and direct correction by third parties that shared or supplied the data. If the data is determined to be accurate, employers must explain the verification steps and supporting evidence.

Employers must ensure electronically monitored data used for employment decisions is accurate and up to date. Current and former employees have the right to request a copy of their own monitored data and aggregated peer data (former employees limited to one request per year). Employers must respond within seven calendar days at no cost to the employee, in the employee's primary language, and may not take adverse action against employees who make such requests.

Employers must provide employees with the opportunity to review and request correction of electronically monitored data both at collection and after. Upon receiving a correction request, employers must investigate, and if data is inaccurate, must (1) promptly correct it and inform the employee, (2) review and adjust any employment decisions based on the inaccurate data, and (3) notify and direct correction by any third parties that received or provided the data. If data is found accurate, the employer must explain the verification steps and evidence to the employee.

Employers using automated decision systems for wage-setting under the safe harbor must develop and publish reasonable procedures, as specified by the attorney general, to (1) ensure data accuracy, (2) allow employees to correct or challenge data used by the system, and (3) enable employees to request and receive information about what data is considered and how the system used it to set their wages.

State education agencies and local school districts must provide parents, within thirty days of request, a complete record of all data elements collected or maintained on their child and must honor requests to correct or delete inaccurate or unnecessary data.

Social media platforms must, upon request from a qualified individual (parent/guardian or adult former-minor), provide the ability to correct or delete personal information collected from or about the individual when they were a minor, complete deletion within 30 days of the request, and provide written confirmation of deletion within 90 business days. Prior parental consent to collect is an absolute defense to enforcement of the deletion obligation.

Persons intending to use an automated decision system to inform worker wages must, at least 180 days before commencing such use, publicly publish in a conspicuous and accessible format reasonable procedures that include (1) a process for ensuring data accuracy, (2) disclosure to all affected workers of what data the system considers and how it uses that data when setting wages, and (3) a procedure for workers to correct or challenge data accuracy.

Employers must, within seven days of receiving an employee's request to correct potential errors, either: (1) correct the erroneous data and provide the employee with a plain-language notice explaining the correction steps taken, or (2) provide the employee with a notice explaining that the data was not corrected and describing the verification steps taken to assess accuracy.

Employers must provide any employee, upon request, with all data relating to that employee that was produced or utilized by electronic monitoring or an automated decision system used by the employer.

Entities must develop, implement, and maintain a comprehensive security program to protect consumer genetic data against unauthorized access, use, or disclosure. Entities must also provide consumers with a process to: (1) access their genetic data; (2) delete their genetic data; (3) revoke any consent previously provided; and (4) request and obtain the destruction of their biological sample.

Controllers that sell personal data to third parties or process personal data for targeted advertising must clearly and conspicuously disclose such activity and the manner in which consumers may opt out.

Any person who has collected, recorded, or shared neural data must honor an individual's written revocation of consent at any time. The revocation process must be at least as easy as initial consent. Upon receiving revocation, the person must destroy all records of the individual's neural data within 10 days. If consent to share is revoked, the person must immediately cease all third-party sharing and notify all third parties with whom the data was shared that consent has been revoked.

Deployers must provide subjects with a reasonable opportunity to opt out of the use of a covered ADS before a consequential decision is finalized. A deployer may deny an opt-out request only if the deployer is subject to the Gramm-Leach-Bliley Act and the ADS makes a financial services decision, or if the subject is having a medical emergency; in either case the deployer must explain the basis for the denial.

Covered entities must allow consumers to opt out of surveillance pricing and, upon request, provide the consumer with a non-personalized baseline price for the goods or services.

Manufacturers and operators must allow owners to revoke consent to any coordinated surveillance feature at any time, with revocation taking effect within 24 hours.

Chatbot providers must not discriminate or retaliate against a user for refusing to consent to the use of chat logs or personal data for training purposes, including by denying products or services, charging different prices or rates, or providing lower quality products or services.

Deployers must, before collecting any personal data of an applicant or employee for processing in an automated employment-related decision process, provide written notice disclosing: (1) the purpose of the data collection, (2) the categories of personal data to be collected, (3) the data retention period, (4) the categories of persons who will have access to the data, and (5) information about the right to opt out of personal data processing under § 42-518.

Covered entities offering algorithmic feeds to minors that use the minor's personal data must provide a prominent control surface letting the minor set content preferences (recommend/block), access and correct the personal data feeding the recommendation system, and ensure the system honors those preferences. The covered entity must also offer minors a follow-only feed option that ranks content solely from sources the minor affirmatively chose.

Persons or entities possessing a biometric identifier captured for a commercial purpose must provide a method for the individual to revoke consent to the storage and transmission of the biometric identifier at any time. Upon receiving a revocation of consent, the person must immediately destroy the biometric identifier, unless maintaining it is required by another law.

Covered entities must allow consumers to opt out of surveillance pricing and, upon request, must provide the consumer with a non-personalized baseline price for the goods or services.

Entities must provide consumers with the ability to (1) access their neurotechnology data, (2) request and obtain its destruction, and (3) revoke any previously provided consent. These rights may be waived for clinical research conducted under express informed written consent meeting specified conditions, including ICH-GCP compliance, a 14-day waiting period for secondary research use, separate consent, readable format, disclosure of data retention policies, and notice of rights waiver.

Employers that manage covered individuals through an automated decision system must allow each covered individual to opt out of automated management and instead be managed by a human manager who is able to make employment-related decisions with respect to that individual.

Chatbot providers must not discriminate against or retaliate against a user for refusing to consent to the use of chat logs or personal data for training purposes.

Covered entities and service providers must provide individuals with clear, conspicuous, easy-to-execute means to withdraw consent and to opt out of covered data transfers, at least as easy as the means to provide consent, and accessible near the privacy policy. Opt-out requests must be propagated to third parties, and no account creation may be required to exercise these rights.

Covered entities and service providers that engage in profiling for automated decisions producing legal or similarly significant effects must provide individuals with a clear, conspicuous opt-out mechanism and must honor opt-out designations in a commercially reasonable timeframe, including notifying downstream profiling and advertising partners of the individual's opt-out decision.

Covered entities and service providers must honor verified requests from authorized agents — including those designated via browser settings, extensions, or global device settings — to exercise data subject rights, withdraw consent, or opt out of data processing on an individual's behalf.

Controllers must allow consumers to opt out of collection and processing of personal data for targeted advertising, sale of personal data, and profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

Controllers must provide at least two secure mechanisms for consumers to exercise data rights, including a clear opt-out link on their website and, within 18 months of the effective date, support for consumer-initiated opt-out preference signals for targeted advertising and data sales. The opt-out signal overrides conflicting controller-specific settings.

Employers must not require employees or candidates to consent to the use of an automated employment decision tool as a condition of being considered for an employment decision, and must not discipline or disadvantage anyone who requests accommodation.

Consumer reporting agencies must provide alternative, nonalgorithmic assessment options for consumers who opt out of automated decision making.

At least 30 days before implementing an electronic monitoring tool or automated decisions tool, employers must provide written notice of the tool's use to all employees. Employers must also include the notice in every job posting, post it on the employer's website, provide it directly to every applicant, and make it available in accessible formats accounting for the applicant's first language (if not English) and any disability. The notice must provide covered individuals with the ability to opt out. If a covered individual opts out, the employer must not use the tool for any employment-related decisions concerning that individual.

At least 30 days before implementing a monitoring or automated decisions tool, employers must give written notice to all employees, include it in every job posting, on the website, and directly to applicants in accessible language- and disability-appropriate formats, and must let workers opt out — and may not use the tool to make any employment-related decision about a worker who opts out.

Covered online platforms must provide an accessible user interface enabling users to expressly communicate their preferences regarding the types of items recommended and blocked by the platform's algorithmic recommender systems, and must take all reasonable steps to ensure algorithmic output is consistent with those preferences.

Employers must allow workers to opt out of being subject to an automated decision system whenever reasonable alternatives to the ADS exist.

Employers must obtain affirmative written consent from workers before subjecting them to electronic monitoring, and must allow workers to opt out of monitoring when reasonable alternatives exist.

Covered businesses must provide an accessible user interface enabling users to expressly and unambiguously specify the types of items recommended and blocked by the platform's algorithmic recommender systems, and must take all reasonable steps to ensure recommender output is consistent with those preferences.

Employers must allow workers to opt out of electronic monitoring when reasonable alternatives to the monitoring tool exist.

Employers must allow workers to opt out of being subject to an automated decision system when reasonable alternatives to its use exist.

Private entities must not charge different prices or rates for goods or services, or provide a different level of quality of goods or services, to any individual who exercises their rights under the Biometric Information Privacy Act.

Designers, developers, and deployers of automated systems must seek and respect New York residents' decisions regarding the collection, use, access, transfer, and deletion of their data in all appropriate ways and to the fullest extent possible. Where honoring such decisions is not possible, alternative privacy-by-design safeguards must be implemented.

Employers must not require employees or candidates to consent to AEDT use as a condition of being considered for an employment decision, and must not discipline or disadvantage any employee or candidate who requests accommodation.

Employers must not require employees or candidates to consent to AEDT use as a condition of being considered for an employment decision, and must not discipline or disadvantage anyone for requesting accommodation.

State education agencies and local school districts must allow parents to opt out of any nonessential data collection or data linkage and to opt out of inclusion in any research study, predictive analytics model, artificial intelligence training dataset, or cross-agency workforce linkage.

The State Department of Education must develop a standardized Parent Data Opt-Out Form (electronic and paper). Upon receipt of a completed form, the local school district must exclude the student's records from longitudinal and cross-agency linkage, using only de-identified or aggregate data for state reporting. No student may be penalized, denied enrollment, or suffer academic disadvantage for opting out.

Chatbot providers must not discriminate or retaliate against a user for refusing to consent to the use of chat logs or personal data for training purposes. Prohibited discrimination includes denying products or services, charging different prices or rates, or providing lower quality products or services.

School entities must allow parents to revoke consent for any AI-based tool, assignment, or assessment at any time, and must ensure that a student who opts out is not academically penalized or denied access to core instructional content.

Chatbot providers must not discriminate or retaliate against a user for refusing to consent to the use of chat logs or personal data for training purposes, including by denying products or services, charging different prices, or providing lower quality products or services.

Providers of covered online platforms must offer minor users an easy option to switch between the personalized recommendation system and an input-transparent algorithm.

Providers of covered online platforms must offer minor users an option to limit the type or category of recommendations from the personalized recommendation system.

Employers that manage a covered individual through an automated decision system must enable the individual to opt out of ADS-based management and be managed by a human manager who can make employment-related decisions.

Controllers must honor consumer opt-out requests transmitted via authorized third-party universal opt-out mechanisms (browser settings, extensions, global device settings). When an opt-out conflicts with a consumer's existing privacy settings or loyalty program, the controller must comply but may notify the consumer and allow confirmation of preferred settings. Controllers charging fees for opt-out mechanisms must disclose the fee.

Chatbot providers must not discriminate or retaliate against any user — including by denying products or services, charging different prices, or providing lower-quality services — for refusing to consent to the use of chat logs or personal data for training purposes.

Controllers must limit personal data collection to what is adequate, relevant, and reasonably necessary for the disclosed processing purposes.

Controllers must not process personal data for purposes that are neither reasonably necessary to nor compatible with the purposes disclosed to the consumer, unless the controller obtains consumer consent.

Covered online services must collect and use only the minimum amount of a covered minor's personal data necessary to provide the specific service elements with which the minor has knowingly engaged, and must not use such data for other purposes.

Covered online services that collect personal data for age verification must use that data solely for age verification and must delete it immediately after verification is complete.

Covered online services must retain a covered minor's personal data only as long as necessary to provide the specific service elements with which the minor has knowingly engaged.

Covered online services must not profile a covered minor unless profiling is necessary to provide a service the minor has requested, and only with respect to the service aspects with which the minor is actively and knowingly engaged.

Covered online services must collect and use only the minimum personal data necessary to provide the specific elements of the service with which the covered minor has knowingly engaged, must not use such data for other purposes, and must retain it only as long as necessary for that purpose.

Covered online services must not profile covered minors unless profiling is necessary to provide a service the minor has requested, and only with respect to aspects of the service with which the minor is actively and knowingly engaged.

Licensed professionals must maintain the confidentiality of all records and all communications between an individual seeking therapy or psychotherapy services and the licensed professional. Disclosure is permitted only as authorized under R.I. Gen. Laws § 40.1-5-26.

Generation services must not require an individual to disclose personally identifiable information beyond what is reasonably necessary to verify the individual's identity and obtain valid consent.

Suppliers of mental health chatbots must not sell or share with any third party any individually identifiable health information or user input of Vermont users. Limited exceptions apply for: (1) health care provider requests with user consent; (2) health plan requests at the user's request; and (3) sharing necessary for chatbot functionality with contractual partners, provided both parties comply with HIPAA privacy and security requirements (45 C.F.R. Parts 160 and 164) as if the supplier were a covered entity and the partner a business associate.

Operators must limit the collection, use, and retention of a minor's personal data to what is reasonably necessary to operate the conversational AI service and ensure safety and security, and must use heightened data minimization and security safeguards for a minor's sensitive data.

Commercial entities must ensure that any third party conducting anonymous age verification: (1) does not retain personal identifying information after age verification is complete; (2) does not use age verification personal identifying information for any other purpose; (3) keeps all age verification personal identifying information anonymous and does not share or communicate it to any person; and (4) protects age verification personal identifying information from unauthorized or illegal access, destruction, use, modification, or disclosure through reasonable security procedures and practices appropriate to the nature of the information.

Deployers must limit collection, use, retention, and sharing of personal information from subjects of consequential decisions to what is reasonably necessary and proportionate to achieve the purposes for which the information was collected, or for another compatible disclosed purpose, and must not further process it in an incompatible manner.

Businesses offering an artificial intelligence health model must comply with all CMIA confidentiality requirements as a deemed provider of health care, including maintaining the same standards of confidentiality required of health care providers with respect to medical information and limiting use of medical information to purposes necessary to provide health care services.

Covered providers must not collect, use, or retain personal information from users of their disclosure verification tool, or from content submitted to the tool, beyond what is reasonably necessary for user authentication.

Covered providers must not condition access to their GenAI system or disclosure verification tool on providing personal information beyond what is strictly necessary for the provenance-data consent purposes described in § 22757.2(a)(3)(B).

Operators must not sell, share, or use for any purpose not expressly authorized by this chapter the personal information of a child.

AI use in psychotherapy records must comply with the confidentiality requirements of Civil Code § 56.104. No company or entity may share, sell, store, or train AI models on any data obtained from psychotherapy.

Providers must limit the collection, use, and retention of a minor's personal data to what is reasonably necessary to operate the AI companion system and ensure safety and security.

Providers must not collect or process sensitive data of a minor — including data revealing mental or emotional state, health information, or biometric identifiers — unless necessary for system safety or accessibility, and must apply heightened data minimization and security safeguards.

App store providers must limit collection and processing of age category data and verification data to what is necessary for age verification, parental consent, and compliance records, and must transmit age category data using industry-standard encryption.

Developers must not request age category data more than once per 12-month period for purposes of verifying the accuracy of age category data or continued account use within the age category.

Operators must limit the collection of personal data to what is reasonably necessary and proportionate to satisfy the requirements of this subtitle.

Covered operators must use age-verification data collected under section 7(2)(a) solely to determine user age and must delete it immediately after the age-determination attempt, except where retention is required by other applicable laws.

Covered operators must use parental-consent data collected under section 7(2)(b) solely to obtain verifiable parental consent and must delete it immediately after the consent attempt, except where retention is required by other applicable laws.

Business entities must not sell, lease, trade, share, or otherwise profit from information obtained through the business entity's use of a biometric surveillance system on a consumer. This is an absolute prohibition with no exceptions.

Chatbot operators must not use age verification data for any purpose other than determining whether a user is a covered minor and must delete such data immediately after the verification attempt, except where retention is required by applicable law.

Manufacturers and operators must not use footage captured by an owner's networked camera device for algorithm training, product development, or any purpose other than providing services directly requested by the owner, without separate affirmative consent.

Manufacturers and operators must not retain footage captured by a networked camera device for more than 72 hours unless the owner has activated a paid subscription, completed affirmative owner setup, or affirmatively elected longer retention.

Social media platforms must not (1) collect or retain personal information beyond what is necessary to provide the service or feature the minor is actively and knowingly engaged with, or (2) use a minor's personal information for any purpose other than the purpose for which it was collected, unless the platform demonstrates a compelling reason that the collection, retention, or use does not pose substantial harm or privacy risk to minors.

Social media platforms must not collect precise geolocation data of minors unless strictly necessary for the requested service and only for the limited time necessary, and must provide an obvious sign to the minor for the duration of any geolocation data collection.

Social media platforms must not use personal information collected for age estimation for any other purpose or retain it longer than necessary to estimate age, and the age estimate must be proportionate to the risks and data practices of the service.

Social media companies must not retain any identifying information of an individual after access to the social media platform has been granted following reasonable age verification.

Operators must not use personal information collected for age estimation for any other purpose and must delete it — other than the estimated age or age range — once age estimation is complete.

Social media platforms must not collect or retain a known minor Alaska resident's personal data beyond the extent reasonably necessary to provide the social media platform to the minor, and must not collect, retain, or share precise location data of the minor.

Covered entities must collect and store only information that does not conflict with a trusted party's best interests and that is (1) sufficient to fulfill a legitimate purpose of the covered entity, (2) relevant to the legitimate purpose of the covered entity, and (3) the minimum amount of information needed for the legitimate purpose of the covered entity.

Healthcare insurers must ensure AI algorithms leverage federated data-sharing models to protect enrollee privacy, comply with FHIR and USCDI interoperability standards, align AI training and validation data with Trusted Exchange Framework privacy standards, and obtain explicit enrollee consent before using health data in AI development and validation.

Chatbot providers must not process personal data to inform a chatbot output unless processing is necessary to fulfill an express request made by the user and the user has provided affirmative consent. Affirmative consent must meet the statutory standard: a clear affirmative act in response to a stand-alone disclosure, with an equally prominent option to decline, that cannot be inferred from inaction or continued use.

Chatbot providers must not process a user's chat log to determine whether to display an advertisement, to determine which product or service to advertise, or to customize an advertisement for presentation to the user. This is a categorical prohibition — no consent mechanism can override it.

Chatbot providers must not process an adult user's chat log and personal data for training purposes unless the chatbot provider first obtains affirmative consent from the user.

Chatbot providers must not process a user's chat log and personal data to engage in profiling beyond what is necessary to fulfill an express request, and must not profile a user based on any classification or designation of the user's personality or behavioral characteristics beyond what is necessary to fulfill an express request made by the user.

Chatbot providers must take the necessary physical, administrative, and technical measures to prevent de-identified data from being re-identified and to process, retain, and transfer de-identified data without any reasonable means of re-identification.

Employers and vendors acting on their behalf must collect and process worker data only as strictly necessary to administer the employment relationship and fulfill specific employment-related or legal obligations, and must not use worker data to train AI systems to replicate, automate, or replace a worker's job.

Employers must limit electronic monitoring to six enumerated purposes (quality assurance, performance assessment, legal compliance, employee health and safety, facility/network security, and wage/benefit administration), narrowly tailor monitoring to the intended purpose in the least invasive manner, and maintain reasonable data security practices to protect employee information confidentiality.

Employers must not require employees to wear a monitoring device or install an application on the employee's personal device for purposes of location tracking.

Employers must not sell, transfer, or disclose employee information collected through electronic monitoring to any other person or entity, except where required by state or federal law or to comply with a high-risk AI impact assessment.

Employers must not operate any electronic surveillance device or system for the purpose of recording or monitoring employees in personal-comfort areas (restrooms, locker rooms, lounges) or on any property owned or leased by an employee, including the employee's residence or vehicle.

Covered entities must not collect, sell, share, or retain any consumer personal data that is not necessary to provide a service the consumer is actively and knowingly engaged with, and must not reuse previously collected personal data for any purpose other than the original collection purpose.

Providers must limit the collection, use, and retention of a minor's personal data to what is reasonably necessary to operate the AI companion system and ensure safety and security.

Providers must not collect or process sensitive data of a minor unless necessary for system safety or accessibility, and must apply heightened data minimization and security safeguards to any such collection.

Deployers must limit the collection and storage of user information collected by the chatbot to what is necessary to fulfill the deployer's stated purpose for making the chatbot publicly available.

Deployers must limit the collection and storage of user information collected by the public-facing chatbot to what is necessary to fulfill the deployer's purpose for making the chatbot publicly available.

Device companies must not (1) allow AI to access types of private data not authorized in the initialization agreement, (2) use private data in ways not stated in the statement of purpose, or (3) maintain, disseminate, or delete transferred private data inconsistently with the statement of purpose.

Developers must not (1) allow their application to access types of private data not authorized in the initialization agreement, (2) use private data in ways not stated in the application's statement of purpose, or (3) maintain, disseminate, or delete transferred private data inconsistently with the application's statement of purpose.

Deployers must limit the collection and storage of user information collected by the chatbot to what is necessary to fulfill the deployer's purpose for making the chatbot publicly available.

Employers must not use customer ratings as the sole or primary input data for an automated decision system to make employment-related decisions.

When providing employee data pursuant to this chapter, employers must anonymize the personal information of any customer, employee, or other individual contained in the data.

Private entities must not sell, lease, trade, or otherwise profit from an individual's biometric data.

If a biometric identifier originally captured for the purpose of training an AI system is subsequently used for a commercial purpose not covered by the AI training or security/fraud exemptions in subsection (7), the person possessing the biometric identifier becomes subject to all of the statute's possession, destruction, and penalty provisions as if the identifier had been captured for a commercial purpose from the outset.

Insurers that possess neurotechnology data (or genetic testing information) must not release it to third parties except as specifically authorized under the Act.

Direct-to-consumer neurotechnology data providers must not share neurotechnology data, genetic test information, or other personally identifiable information about a consumer with any health or life insurance company without written consumer consent.

Employers must not use neurotechnology data (or genetic information) in workplace wellness programs unless (1) health, genetic, or neurotechnology services are offered by the employer, (2) the employee provides written authorization, (3) only the employee and licensed health care professionals receive individually identifiable results, and (4) the employer receives only aggregate data. Employers must not penalize employees who decline to participate or disclose neurotechnology data.

Entities must treat neurotechnology data and information derived from it as confidential and privileged, releasing it only to the measured individual and persons specifically authorized in writing by that individual.

Entities must obtain separate express consent for (1) third-party transfers or disclosures (identifying the third party by name), (2) uses beyond the primary purpose and inherent contextual uses, and (3) post-purpose data retention; informed express consent for research disclosures; and express consent for marketing based on neurotechnology data, third-party marketing, and sale of neurotechnology data.

Entities must not disclose neurotechnology data to law enforcement or any other government agency without a consumer's express consent unless pursuant to a search warrant or investigative subpoena issued on a finding of probable cause.

Deployers must either (1) inform the user in writing that AI will retain training data indefinitely and obtain the user's express written consent before training on and retaining the user's covered information, or (2) set the default to prohibit training on user data and permit training only after the user is notified and affirmatively opts in.

Deployers must not disclose a user's covered information to any third party unless the deployer first obtains express written consent from the user for that specific disclosure.

Covered AI tool providers must not collect or retain any personal information from a person who uses the provenance label reading tool, except that voluntary contact information from feedback submitters may be retained. The reading tool must not output any personal provenance data detected in submitted content. Providers must not retain content submitted to the reading tool for longer than is necessary to comply with this Act.

Large online platforms must not retain any personal provenance data from content shared on the platform.

School districts currently in possession of student biometric information must destroy that information within 30 days after the effective date of the Act and must provide certified documentation of the destruction to the State Board of Education.

School districts that have contracted with a third party to obtain, collect, or store student biometric information must, within 30 days after the effective date of the Act, require the third party to destroy all student biometric information in its possession and confirm the completion of the destruction in writing to the school district.

During the 30-day destruction period, school districts must not sell, lease, or otherwise disclose student biometric information to any person or entity, unless the individual with legal custody (or the student if 18 or older) consents or the disclosure is required by court order.

The Chicago school district, if currently in possession of student biometric information, must destroy that information within 30 days after the effective date of the Act and provide certified documentation of the destruction to the State Board of Education.

The Chicago school district, if it has contracted with a third party to obtain, collect, or store student biometric information, must within 30 days after the effective date of the Act require the third party to destroy the biometric information and confirm the destruction in writing to the district.

During the 30-day destruction period, the Chicago school district must not sell, lease, or otherwise disclose student biometric information to any person or entity, unless the individual with legal custody (or the student if 18 or older) consents or the disclosure is required by court order.

Operators must not sell or rent a student's information or data, including covered information or any other person's information collected by the operator for K–12 school purposes. An exception applies for corporate acquisitions if the successor entity complies with the Act regarding previously acquired student information.

Operators must not permit artificial intelligence to train on covered information unless the training is for K–12 school purposes or in furtherance of improving operability and functionality of the operator's service.

Operators must not disclose covered information to third parties for the purpose of training artificial intelligence that is not for K–12 school purposes, even where the disclosure would otherwise be permitted to improve operability and functionality of the operator's service.

Operators must not permit their AI model to train on a student's covered information and retain the training data indefinitely unless the operator first (1) provides written notice to the student or parent that the AI model will retain training data indefinitely, and (2) obtains written consent from the student or parent. Absent this affirmative opt-in consent, indefinite retention of AI training data derived from student covered information is prohibited.

Employers must ensure that the use of an automated decision system output is designed for the purpose of making the specific employment-related decision at issue. Output from systems designed for other purposes may not be repurposed for employment decisions.

Covered entities must protect the confidentiality of age information provided by users for age verification by limiting the collection, processing, use, and storage of such information to what is strictly necessary to verify a user's age, obtain verifiable parental consent, or maintain compliance records.

Covered online services must collect and use only the minimum amount of a covered minor's personal data necessary to provide the specific service elements the minor has knowingly engaged with, must not use the data for other purposes, and must retain it only as long as necessary for those elements.

Covered online services must not be required to collect personal data to comply with this section. Any personal data collected for age verification must not be used for other purposes and must be deleted after use for age verification.

Covered entities must (1) limit collection of personal data to what is minimally necessary for age verification or compliance, (2) prevent unauthorized access to age-verification data, (3) transmit age-verification data only using industry-standard encryption, (4) prohibit the sale, transfer, or sharing of age-verification data, and (5) retain verification data no longer than reasonably necessary.

Employers must not use an ADS to collect worker data for any purpose that was not disclosed in the pre-use written notice required under R.S. 23:972.

Employers must provide worker data in a manner that anonymizes the personal information of customers, other workers, and other individuals when required to share worker data under this Part.

AI technology companies in possession of deidentified data must (1) take reasonable measures to prevent reidentification, (2) maintain and use data in deidentified form, (3) contractually bind recipients to comply with these requirements, and (4) implement business processes to prevent inadvertent release of deidentified data.

Chatbot providers must not process personal data other than input data to inform chatbot outputs unless the processing is necessary to fulfill an express user request and the user has provided affirmative consent.

Chatbot providers must not process a user's chat logs for any advertising purpose, including determining whether to display ads, selecting ad categories, or customizing ad presentation.

Chatbot providers must obtain affirmative consent before using adult users' chat logs or personal data for training purposes, and must not engage in profiling beyond what is necessary to fulfill an express user request.

Chatbot providers must not use any classification or designation of a user's personality or behavioral characteristics created through profiling beyond what is necessary to fulfill an express user request.

Operators must not sell to or share with any third party any individually identifiable health information of a user or the user's input. Exceptions apply only when: (1) individually identifiable health information is requested by a healthcare provider with the user's consent, (2) information is provided to the user's health plan at the user's request, or (3) information is shared to ensure effective functionality of the chatbot with another party under contract with the operator. When sharing under any exception, the operator and the receiving entity must comply with all applicable HIPAA privacy and security provisions (45 CFR Parts 160 and 164, Subparts A and E) as if the operator were a covered entity and the receiving party a business associate.

Operators must not use a user's input to: (1) determine whether to display an advertisement for a product or service to the user (unless the advertisement is for the mental health chatbot itself), (2) determine a product, service, or category of product or service to advertise to the user, or (3) customize how an advertisement is presented to the user.

Covered entities and service providers must not collect or process sensitive covered data (including neural data) unless such collection or processing is strictly necessary to provide or maintain a specific product or service requested by the individual.

Controllers must limit collection of personal data to what is reasonably necessary and proportionate to provide the requested product or service, must not process data inconsistent with consumer expectations, and must not collect or process sensitive data unless strictly necessary to provide the requested product or service.

Controllers in possession of de-identified data must implement technical re-identification safeguards, publicly commit not to re-identify the data, contractually bind recipients to the same obligations, and monitor downstream compliance with those contractual commitments.

Controllers must extend all chapter protections for precise geolocation data to non-residents whose geolocation data reveals they are or were present in Massachusetts, treating such data identically to that of Massachusetts consumers.

Employers must not use employee data collected via electronic monitoring for any purpose other than those specified in the notice provided to employees.

Employee data collected for impact assessments must be processed and stored to protect privacy, comply with commissioner-specified retention and security requirements, and must not be shared with the employer or any other entity unless strictly necessary for completing the impact assessment.

Employers must not use an electronic monitoring tool to collect employee information unless the tool is primarily used for one of six enumerated legitimate purposes (facilitating essential job functions, ensuring quality, periodic performance assessment, legal compliance, health/safety/security, or wage/benefit administration). The tool's type and activated capabilities must be narrowly tailored to accomplish the stated purpose, customized and implemented in the manner least invasive to employees, limited to the smallest number of workers, collecting the least amount of data no more frequently than necessary, with data deleted once the purpose is achieved. Data not necessary for the stated purpose must not be disclosed to the employer and must be promptly disposed of by the vendor. Employee data must not be collected when the employee is off-duty. Necessary data must be stored consistent with the commonwealth's data and cyber privacy laws, promptly disposed of when no longer needed, and not used by the employer, vendor, or any third party for any unauthorized reason.

Employers must not use employee data collected via electronic monitoring for purposes other than those specified in the notice provided to employees.

Employers must not sell, transfer, or disclose employee data collected via electronic monitoring to any other entity unless required by federal or state law, or necessary to comply with an impact assessment of an automated employment decision tool.

Private entities must not disclose, redisclose, or otherwise disseminate any person's or customer's biometric identifier or biometric information unless one of the following applies: (1) the individual or their legally authorized representative provides written consent, (2) the disclosure completes a financial transaction requested or authorized by the individual, (3) the disclosure is required by state, federal, or municipal law, or (4) the disclosure is required by a valid warrant or subpoena from a court of competent jurisdiction.

Manufacturers must collect only the minimum child user data necessary for the core functionality of the artificial intelligence toy and must encrypt all collected child user data.

Employers must not use an electronic monitoring tool or automated decisions tool to collect a covered individual's data except for the following enumerated purposes: (a) to allow an employee to accomplish or facilitate an essential job function, (b) to monitor production processes or quality, (c) to periodically assess employee performance, (d) to ensure or facilitate compliance with state or federal labor or employment law, (e) to protect the health, safety, or security of covered individuals, (f) to administer wages and benefits using only data regarding the covered individual's work city and cost of living, or (g) to accomplish any other purpose that enables business operations as determined by the Department of Labor and Economic Opportunity.

Employers using an electronic monitoring tool or automated decisions tool must: (a) provide written notice to all covered individuals subject to the tool; (b) obtain written consent from each covered individual; (c) ensure that collected data is accurate and up to date; (d) allow covered individuals to correct inaccurate data about themselves; (e) use the tool in a narrowly tailored manner to accomplish only a permitted purpose; (f) use the tool through the least invasive means possible; (g) ensure the tool applies to the smallest number of covered individuals, collects the least amount of data, and is used no more frequently than necessary; and (h) ensure the tool does not collect any employee data when the employee is off duty.

Employers must retain data collected through an electronic monitoring tool or automated decisions tool for no more than 3 years after the purpose for using the tool is achieved, unless otherwise specified by a collective bargaining agreement. If the employer does not use any specific data of a covered individual, the employer must delete that data immediately.

Employers must not sell or license a covered individual's data collected through an electronic monitoring tool or automated decisions tool, including deidentified or aggregated data.

Employers must not share data collected through electronic monitoring or automated decision tools with the state or a local unit of government unless necessary to (a) provide information to the Department of Labor and Economic Opportunity, (b) comply with federal, state, or local law requirements, or (c) comply with a court-issued subpoena, warrant, or order.

Persons collecting covered information under a safe-harbor discount, cost-based pricing, or loyalty program must use that information solely for offering or administering the applicable program and must not use it for any other purpose, including profiling, targeted advertising, or individualized price setting.

Persons must not augment or supplement personally identifiable information provided by a consumer for the purpose of receiving a discounted price with personally identifiable information obtained from a third party or by other means.

Employers must retain worker data collected via monitoring or automated decisions tools no longer than three years after the collection purpose is achieved, and must immediately delete any data they do not use.

Employers must not sell or license worker data (including deidentified or aggregated data) and must not share monitoring or automated-decision data with state or local government except to supply the department, comply with law, or respond to a subpoena, warrant, or order.

Any person who obtains biometric data must not sell, lease, or otherwise disclose it to another person, except where: (1) the individual consents to disclosure for identification purposes in the event of the individual's disappearance or death; (2) the disclosure completes a financial transaction the individual requested or authorized; (3) the disclosure is required or permitted by federal or state law; or (4) the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant.

Any person who obtains biometric data must delete and destroy it within a reasonable time, but no later than one year from the date the purpose for collecting the data expires. If a federal or state law requires a longer retention period, the data must be destroyed within a reasonable time but no later than one year after that statutory retention period expires. For employers who collect employee biometric data for security purposes, the collection purpose expires upon termination of the employment relationship.

Employers may use electronic monitoring tools only for six enumerated purposes (essential job functions, quality assurance, periodic performance assessment, legal compliance, health/safety/security, and wage/benefit administration), must specify the intended purpose, must narrowly tailor the tool's capabilities to that purpose, and must minimize the number of workers monitored and the frequency and volume of data collected.

Employers must not transfer, sell, or license worker data (including deidentified or aggregated data) to third parties unless the recipient is under contract to analyze the data, the contract prohibits resale, the recipient implements reasonable security procedures, and the recipient agrees to joint-and-several liability for data breaches. Employers must not share worker data with government unless required by law.

Employers and vendors must restrict worker data access to authorized personnel only, notify workers of data breach impacts as soon as possible, and — at the end of a vendor contract — vendors must return all worker data to the worker and employer in a user-friendly format and delete all remaining copies.

Any person who obtains biometric data must not sell, lease, or otherwise disclose the biometric data to another person, except where: (1) the individual consents to disclosure for identification in the event of disappearance or death; (2) the disclosure completes a financial transaction the individual requested or authorized; (3) the disclosure is required or permitted by federal or state law; or (4) the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant.

Any person who obtains biometric data must delete and destroy the biometric data within a reasonable time, but no later than one year from the date the purpose for collecting the data expires. If a federal or state law requires a longer retention period, the biometric data must be destroyed no later than one year from the date that retention period expires. For employers who collect employee biometric data for security purposes, the collection purpose expires upon termination of the employment relationship.

Employers may only use electronic monitoring tools for three enumerated purposes (quality assurance, legal compliance, and safety/security), must specify the intended purpose, limit use to that purpose, narrowly tailor the tool's capabilities, and minimize the scope of data collection and the number of workers monitored.

Employers must not transfer, sell, or license worker data (including deidentified or aggregated data) except to vendors under contract that prohibits resale, requires reasonable security, and imposes joint and several breach liability. Government sharing is prohibited absent a legal requirement. Employers and vendors must maintain data security, restrict access to authorized personnel, notify workers of breaches, and vendors must return all data and delete copies at contract end.

Private entities in possession of biometric identifiers or biometric information must not sell, lease, or trade any person's or customer's biometric identifier or biometric information.

Private entities in possession of biometric identifiers or biometric information must not disclose, redisclose, or otherwise disseminate any person's or customer's biometric identifier or biometric information unless one of four exceptions applies: (1) the person or their legally authorized representative provides written release to the disclosure; (2) the disclosure completes a financial transaction requested or authorized by the person or their representative; (3) the disclosure is required by state, federal, or municipal law; or (4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Private entities must not condition the provision of any good or service on the collection, use, disclosure, transfer, sale, retention, or processing of a biometric identifier unless the biometric identifier is strictly necessary to provide the good or service.

Covered entities must establish, implement, and maintain reasonable data security for age verification data, including: (1) limiting collection of personal data to what is minimally necessary to verify a user's age or maintain compliance; (2) protecting age verification data against unauthorized access; (3) transmitting such data only using industry-standard encryption protocols; (4) retaining such data no longer than reasonably necessary to verify age or maintain compliance; and (5) not sharing, transferring, or selling age verification data to any other entity.

Any verification or age-confirmation system used for compliance with this section must comply with data minimization and privacy-by-design principles.

Third parties must not retain or sell biometric, facial recognition, or identification data collected for compliance purposes under this section.

The statewide digital privacy agreement must incorporate and comply with state statutes governing data minimization, secondary use limitations, targeted advertising prohibitions, security safeguards, privacy notices, breach response, retention and deletion, and directory-information protections.

Vendors must not collect, store, or analyze biometric identifiers, behavioral or emotional signals, voiceprints or keystroke dynamics, or precise geolocation unless strictly necessary for the educational purpose and disclosed in the digital privacy agreement.

Vendors must ensure software does not display commercial or sponsored content, use session replay, heat-mapping, or behavioral analytics, create persistent identifiers, or track students outside the educational purpose.

Vendors must use encryption for data in transit and at rest, store and process all student data within the United States, disclose all subprocessors and obtain contracting entity approval before use, and prohibit background data collection when software is minimized or inactive.

Vendors must not use camera, microphone, or system-level access unless strictly necessary for the educational function and disclosed in the digital privacy agreement, and must not condition access, features, pricing, or support on any form of usage quota or screen-time expectation.

Covered entities must establish, implement, and maintain reasonable data security for age verification data, including: (1) limiting collection of personal data to what is minimally necessary for age verification or compliance; (2) protecting age verification data against unauthorized access; (3) transmitting data only using industry-standard encryption; (4) retaining data no longer than reasonably necessary; and (5) not sharing, transferring, or selling age verification data to any other entity.

Employers must not share an applicant's video interview except with a service provider whose expertise or technology is necessary to evaluate the applicant's fitness for the position.

Employers and public entities must limit AEDS and EMT data collection and use to what is necessary for allowable purposes, use the least invasive means, collect data no more frequently than necessary, restrict access to authorized agents, and ensure that collected data is accessed only by authorized agents of the employer, the public entity, or the employee or their authorized representative.

Employers, public entities, and vendors must not sell, license, transfer, disclose, or share employee, applicant, or service beneficiary data or AEDS outputs with any third party without uncoerced written consent, except to the individual, their authorized representative, or law enforcement when required by law. Applicant data must be destroyed upon the applicant's request. Vendors must return and delete all data when the contract terminates.

Employers must not share an applicant's video interview except with a service provider whose expertise or technology is necessary to evaluate the applicant's fitness for the position.

Employers must not share an applicant's video interview recording with anyone except a service provider whose expertise or technology is necessary to evaluate the applicant's fitness for the position.

Employers, public entities, and vendors must restrict access to EMT- or AEDS-collected worker data to authorized agents of the employer or public entity and the affected employee or their authorized representative.

Public entities and vendors must restrict access to data used by an ABSDS to authorized agents of the public entity and the affected service beneficiary.

Employers must not use an ADS to (1) violate any federal, state, or local labor, employment, health and safety, or civil rights law, (2) infer a worker's protected status under the New York Human Rights Law, (3) identify, profile, predict, or take adverse action against a worker for exercising legal rights, or (4) collect worker data for purposes not disclosed in the pre-use notice.

Chatbot operators must not use information collected for the purpose of determining whether a covered user is a covered minor for any purpose other than making that determination, and must delete such information immediately after the determination attempt, except where retention is required for compliance with applicable New York state or federal law.

Utilities must handle data used in anomaly detection systems in accordance with applicable state and federal privacy laws and must use such data solely for billing integrity and consumer protection purposes.

Persons developing automated systems must protect New York residents from inappropriate or irrelevant data use in the design, development, and deployment of automated systems, and from the compounded harm of data reuse.

Persons developing automated systems must implement built-in privacy protections by default, ensure that data collection conforms to reasonable expectations, and collect only strictly necessary data for the specific context.

Persons developing automated systems must establish enhanced protections and restrictions for data and inferences related to sensitive domains. In sensitive domains, individual data and related inferences may only be used for necessary functions, safeguarded by ethical review and use prohibitions.

Employers must ensure that employee data collected for impact assessments is collected, processed, stored, and retained in a privacy-protective manner and in compliance with Commissioner-specified data retention and security requirements. Employee data provided to auditors must not be shared with the employer and must not be disclosed to any other person or entity unless strictly necessary for completing the assessment.

Private entities in possession of biometric identifiers or biometric information must not disclose, redisclose, or otherwise disseminate the data unless one of four conditions is met: (1) the subject or their legally authorized representative consents; (2) the disclosure completes a financial transaction requested or authorized by the subject; (3) the disclosure is required by federal, state, or local law or municipal ordinance; or (4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Employee data collected for impact assessments must be collected, processed, stored, and retained in a manner that protects employee privacy and complies with Commissioner-specified data retention and security requirements. Assessment data provided to auditors must not be shared with the employer or any other entity unless strictly necessary for the assessment.

Employers must limit electronic monitoring to enumerated lawful purposes, use the least invasive means strictly necessary, minimize the number of monitored workers and volume/frequency of data collection, delete data once the purpose is achieved, and must not use collected data for purposes beyond those specified in the employee notice.

Employers must not sell, transfer, or disclose employee data collected via electronic monitoring to any other entity, except where required by state or federal law or necessary to comply with an AEDT impact assessment.

Employee data collected for an impact assessment must be collected, processed, stored, and retained in a manner that protects employee privacy and complies with Commissioner-specified retention and security requirements. Data provided to auditors must not be shared with the employer or any other entity unless strictly necessary for completing the impact assessment.

State education agencies, local school districts, and their contractors must treat student data solely as held in custodial capacity, must not claim proprietary or ownership interests in it, and must not sell, trade, or license any student data for commercial purposes.

State education agencies and local school districts must not collect personally identifiable educational data unless expressly authorized by law and must obtain written parental consent before collecting political or religious beliefs, family income or tax data (beyond lunch eligibility), biometric/health/psychological data unrelated to special education, student social media identifiers or internet activity, or any data not directly necessary for instruction or accountability.

State education agencies and local school districts must not transfer personally identifiable student data to any federal or state agency, private contractor, or nonprofit organization without written parental consent (or student consent if age eighteen or older), unless otherwise authorized by law.

Deployers must collect and store only information that does not conflict with a trusting party's best interests. Information collected must be adequate (sufficient for a legitimate deployer purpose), relevant (linked to that legitimate purpose), and necessary (the minimum amount needed for that purpose).

Artificial intelligence technology companies in possession of de-identified data must (1) take reasonable measures to prevent re-association with individuals, (2) maintain data in de-identified form and not attempt re-identification except to test the de-identification process, (3) contractually require recipients to comply with these restrictions, and (4) implement safeguards against inadvertent release.

Social media platforms must not collect data from minor users unless the data is de-identified, must not use or process minor user data in a manner inconsistent with the best interests of the minor user, and must not display, send, or target advertisements to minor users or use data collected from minor users for advertising purposes.

Social media companies must not mine data related to a minor account holder, except for (1) age and location data for age-appropriate content recommendations, (2) data necessary to protect minors from harmful content, or (3) data that is adequate, relevant, and reasonably necessary for the disclosed processing purpose.

Social media platforms must not process a minor's precise geolocation information by default unless strictly necessary to provide a requested service, product, or feature and only for the duration necessary. When processing a minor's precise geolocation, the platform must provide a conspicuous signal to the minor for the duration of the processing.

Suppliers must not sell or share with any third party a consumer's individually identifiable health information or consumer input. Sharing is permitted only in two circumstances: (1) a health care provider requests access to the consumer's individually identifiable health information and the consumer provides written consent, or the consumer requests that a health plan receive access and provides written consent; or (2) the sharing is necessary for the chatbot's effective functionality with a contracted third party and the consumer provides written consent. When sharing under the functionality exception, the supplier and the third party must comply with all HIPAA security and privacy provisions (45 CFR Parts 160 and 164) as if the supplier were a HIPAA covered entity and the third party a business associate. Written consent must acknowledge that the consumer understands and agrees to the sharing.

Suppliers must not use consumer input to determine whether to display an advertisement (unless the advertisement is for the chatbot itself), determine what product, service, or category to advertise, or customize how an advertisement is presented to the consumer.

Covered providers must not collect or retain personal information from detection-tool users (except opt-in feedback contact info used only to improve the tool), must not retain submitted content beyond 24 hours absent express consent, and must not retain personal provenance data from submitted content.

Covered AI tool providers must not collect or retain personal information from users of the provenance-label reading tool (except voluntarily-submitted feedback contact info) and must not retain submitted content longer than necessary to comply with the act.

Employers must not use an electronic monitoring tool to collect employee information unless the tool is primarily used for one of six enumerated legitimate purposes: (1) accomplishing essential job functions, (2) ensuring quality of goods and services, (3) conducting periodic assessment of worker performance, (4) ensuring compliance with employment, labor, or other relevant laws, (5) protecting health, safety, or security of workers or security of employer facilities and networks, or (6) administering wages and benefits.

Employers must narrowly tailor the type and activated capabilities of any electronic monitoring tool to accomplish the employer's intended legitimate purpose. The tool must be customized and implemented in the manner least invasive to employees. Monitoring must be limited to the smallest number of workers, collect the least amount of data no more frequently than necessary, and data must be deleted once the purpose is achieved. Employee data not necessary for the legitimate purpose must not be disclosed to the employer and must be promptly disposed of by the vendor. Employee data must not be collected when the employee is off-duty. Data necessary for the legitimate purpose must be stored consistent with state data and cyber privacy laws, disposed of when no longer needed, and not used by the employer, vendor, or any third party for any other reason.

Employers must not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided to employees and candidates.

Employers must not sell, transfer, or disclose employee data collected via an electronic monitoring tool to any other entity unless required to do so under federal or state law, or necessary to comply with an impact assessment of an automated decision system used under this section.

Employers must not require employees to: (1) physically implant devices that collect or transmit data, including subcutaneous or clothing/accessory-incorporated devices, (2) install applications on personal devices that collect or transmit employee data, or wear or embed those devices, or (3) carry or use any device with location tracking enabled, unless the location tracking is conducted during work hours only and is strictly necessary to accomplish essential job functions and narrowly limited to only the activities and times required.

Chatbot providers must not process personal data to inform a chatbot output unless (1) processing is necessary to fulfill an express request made by the user and (2) the user provides affirmative consent. Affirmative consent requires a clear affirmative act in response to a specific, stand-alone, accessible, multilingual disclosure with equally prominent accept and decline options; it cannot be inferred from inaction, continued use, or broad terms of use.

Chatbot providers must not process a user's chat log to determine whether to display an advertisement, to determine what product or service to advertise, or to customize an advertisement for the user.

Chatbot providers must not use an adult user's chat log and personal data for training purposes unless the chatbot provider first obtains affirmative consent from the user.

Chatbot providers must not process a user's chat log and personal data for profiling beyond what is necessary to fulfill an express request, and must not profile a user based on personality traits or behavioral characteristics beyond what is necessary to fulfill the user's express request.

Chatbot providers must take the necessary physical, administrative, and technical measures to prevent deidentified data from being reidentified and to process, retain, and transfer deidentified data without any reasonable means of reidentification.

School entities must ensure that AI systems collect only the minimum student data necessary to achieve an approved educational purpose.

School entities must ensure that student data collected through AI (1) remains the property of the student and parent, (2) is not sold, shared, licensed, or used for commercial advertising or profiling, and (3) is deleted within a defined period unless retention is required by law.

Chatbot providers must not process personal data to inform chatbot output unless the processing is necessary to fulfill an express request made by the user and the user has provided affirmative consent. Affirmative consent must be obtained via a clear, conspicuous, stand-alone disclosure in easily understandable language, accessible to users with disabilities, in each language the chatbot is offered, with the option to decline at least as prominent as the option to consent. Consent may not be inferred from inaction or continued use.

Chatbot providers must not process a user's chat log to determine whether to display an advertisement, to determine which product or service to advertise, or to customize an advertisement for presentation to a user. This is an absolute prohibition — no consent mechanism overrides it.

Chatbot providers must not process an adult user's chat log and personal data for training purposes unless the chatbot provider first obtains affirmative consent from the user.

Chatbot providers must not process a user's chat log and personal data for profiling beyond what is necessary to fulfill an express request, and must not profile a user based on personality traits or behavioral characteristics beyond what is necessary to fulfill an express user request.

Chatbot providers must take necessary physical, administrative, and technical measures to prevent deidentified data from being reidentified and must process, retain, and transfer deidentified data without any reasonable means of reidentification.

Food retail establishments must not collect or use the data of any person under 17 years of age for targeted advertising or personalized algorithmic pricing.

Entities that capture biometric identifiers for AI training, processing, or storage must not repurpose those identifiers to a separate commercial purpose; if they do, they become subject to the full biometric identifier statute's possession, destruction, and penalty provisions. The AI exemption does not apply when biometric identifiers are used for the purpose of uniquely identifying a specific individual.

Persons who capture biometric identifiers for the commercial purpose of AI training, processing, or storage and who subsequently use those identifiers for a separate commercial purpose must comply with the statute's existing provisions for possession and destruction of biometric identifiers and are subject to the associated penalties.

Covered entities must limit the collection, processing, use, and storage of age verification information to what is strictly necessary to verify a user's age, obtain verifiable parental consent, or maintain compliance records.

Providers of covered platforms must not conduct market or product-focused research on users known to be minors unless the research is solely to improve platform privacy, security, transparency, or safety, or is necessary for legal compliance.

Covered entities must perform ongoing testing and evaluation of privacy risks and privacy-enhancing measures of each automated decision system or augmented critical decision process, including data minimization practices, retention periods, information security measures, use of privacy-enhancing technologies, and current and future impacts on consumer privacy, safety, and security.

Covered entities must limit the collection, processing, use, and storage of age verification information to what is strictly necessary to verify a user's age, obtain verifiable parental consent, or maintain compliance records.

Covered entities must (1) limit collection of age-verification personal data to what is minimally necessary, (2) protect such data against unauthorized access using industry-standard encryption, (3) retain the data no longer than reasonably necessary for verification or compliance, and (4) not share, transfer, or sell age-verification data to any other entity.

Deployers must not process any personal data of a known-minor user to generate, personalize, or otherwise affect an output unless the data was collected during the current session within the maximum permitted period of use to be established by FTC regulation.

Deployers must not process any personal data of a known-minor user for the purpose of profiling that user.

Deployers must not process or transfer a known-minor user's personal data for the purpose of training a covered algorithm, except for testing and identifying risks of harm to users or addressing identified risks of harm.

Deployers must not process any input data provided by a known-minor user for any purpose other than (1) generating outputs within the current session's FTC-established temporal window, (2) testing and identifying risks of harm, or (3) addressing identified risks of harm.

Covered entities that voluntarily collect personal data for compliance with this Act must not use that data for any other purpose and must not retain it longer than necessary for compliance or to demonstrate compliance.

Controllers with actual knowledge or willful disregard that a consumer is an adolescent (ages 13–15) must not process the adolescent's personal data for targeted advertising, sale, or consequential profiling, and must not process it beyond what is reasonably necessary or for undisclosed purposes, without obtaining consent from the adolescent. Precise geolocation collection from adolescents requires necessity, consent, and a visible collection indicator.

Employers must not engage in electronic monitoring of employees unless the monitoring serves one of seven enumerated purposes (assisting essential job functions, monitoring production, ensuring legal compliance, protecting health/safety/security, securing property, periodic performance assessment, or tracking time/output for compensation). The specific monitoring form must be necessary and used exclusively for the stated purpose, must be the least invasive means available, must be applied to the smallest number of employees and collect the smallest amount of data no more frequently than necessary, and must be restricted so that only authorized persons access the data and use it only for the noticed purpose and duration.

Employers must not require employees to install monitoring applications on personal devices or wear/attach/embed monitoring devices on clothing unless the monitoring is necessary for the employee's essential job function and limited to the times and activities necessary for those functions. Location tracking must be disabled outside essential-job-function activity times. Employers must not under any circumstances require an employee to physically implant a device on the employee's body for monitoring purposes.

Employers, any person that develops, operates, or maintains electronic monitoring or an ADS on an employer's behalf, and any person who collects, stores, analyzes, interprets, disseminates, or otherwise uses monitoring or ADS data must implement reasonable security procedures and practices appropriate to the nature of the data to protect employees' personal information from unauthorized or illegal access, destruction, use, modification, or disclosure.

Any person that develops, operates, or maintains electronic monitoring or an ADS on an employer's behalf, and any person who collects, stores, analyzes, or uses monitoring or ADS data, must upon termination of the contract with the employer: (1) return all data and ADS outputs to the employer, and (2) destroy all data and ADS outputs in the person's possession.

Providers must use reasonable care to avoid any heightened risk of harm to a minor caused by processing of personal data in the course of providing the social media platform to minors, where heightened risk includes unfair or deceptive treatment, financial or physical injury, unintended disclosure, or intrusion upon seclusion.

Providers must limit the use of a minor's personal identifying information to the purpose for which the information was collected.

Chatbot providers must not process personal data other than input data to inform chatbot outputs unless the processing is necessary to fulfill an express user request and the user has provided affirmative consent.

Chatbot providers must not process a known or reasonably known minor user's chat log or personal data without the affirmative consent of that user's parent or legal guardian. Chatbot providers must not process a known or reasonably known minor user's chat log or personal data for training purposes under any circumstances — parental consent does not override this prohibition.

Chatbot providers must not process an adult user's chat log or personal data for training purposes unless the provider first obtains the user's affirmative consent.

Chatbot providers must not process a user's chat log or personal data for profiling, nor use any personality or behavioral classification derived from profiling, beyond what is necessary to fulfill an express user request.

Employers must limit electronic monitoring to five enumerated purposes (assisting essential job functions, monitoring production, ensuring legal compliance, protecting health/safety, or tracking time/output for compensation), and must use the least invasive means with the smallest scope and number of employees necessary, restricting data access to authorized persons for the noticed purpose and duration only.

Employers must not require employees to install monitoring applications on personal devices or wear monitoring devices unless the monitoring is necessary for essential job functions and limited to only the times and activities required. Location tracking must be disabled outside of work-activity periods.

Entities must develop, implement, and maintain a comprehensive security program to protect consumer genetic data against unauthorized access, use, or disclosure. Entities must also provide consumers with a process to: (1) access their genetic data; (2) delete their genetic data; (3) revoke any consent previously provided; and (4) request and obtain the destruction of their biological sample.

Entities must not store genetic data or biological samples of West Virginia residents within the territorial boundaries of any country sanctioned by the United States Office of Foreign Asset Control or designated as a foreign adversary under 15 CFR 7.4(a). Genetic data or biometric data of West Virginia residents may only be transferred or stored outside the United States with the consent of the resident.

Private entities in possession of biometric identifiers or biometric information must not sell, lease, trade, or otherwise profit from a person's or customer's biometric identifier or biometric information.

Private entities in possession of biometric identifiers or biometric information must not disclose, redisclose, or otherwise disseminate a person's or customer's biometric identifier or biometric information except in four circumstances: (1) the subject or legally authorized representative consents; (2) the disclosure completes a financial transaction requested or authorized by the subject or representative; (3) disclosure is required by state or federal law or municipal ordinance; or (4) disclosure is required by a valid warrant or subpoena.

Controllers must not process personal data in violation of antidiscrimination laws and must not discriminate against consumers for exercising their data privacy rights, subject to a safe harbor for bona fide loyalty and rewards programs.

Employers must not use electronic monitoring to threaten employee health or safety, monitor employees who are not performing work-related tasks, collect medical history, collect biometric identifiers, obtain protected-class information, or punish employees for engaging in protected activity.

Persons or entities possessing a biometric identifier captured for a commercial purpose must not sell, lease, or otherwise disclose the biometric identifier to another person, except where: (1) the individual consents for identification in the event of the individual's disappearance or death; (2) the disclosure completes a financial transaction the individual requested or authorized; (3) the disclosure is required or permitted by state or federal law; or (4) the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant.

Employers that use predictive data analytics in employment decisions must not consider an applicant's race or zip code (when used as a proxy for race) to reject an applicant in recruiting, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or terms, privileges, or conditions of employment.

Persons or entities that rely partially or fully on predictive data analytics to determine a consumer's creditworthiness must not use information that assigns specific risk factors to the consumer's race or zip code resulting in rejection of credit or other adverse credit-related action.

Auto insurers must not refuse, renew, place, or price a policy — through any classification plan, rating tier, scoring model, or algorithm — using sex, marital status, race, creed, national origin, religion, age, occupation, education, home ownership, credit information, prior-insurance status, price elasticity of demand, ZIP code (or smaller geography), or income/wealth. Years of driving experience remains permissible.

Auto insurers must not use territory or any other geographic characteristic in underwriting decisions (sell, refuse, cancel, non-renew, or terms), and any permitted territorial rating factor must not change the premium by more than 25% from what would otherwise be charged.

Insurers must not seek or use neurotechnology data (or genetic testing information) for nontherapeutic purposes in connection with accident and health insurance policies, except where the individual voluntarily submits data that is favorable to the individual.

Insurers must not use or disclose protected health information that is neurotechnology data (or genetic information) for underwriting purposes, including eligibility determinations, premium computation, pre-existing condition exclusions, or contract creation or renewal. Exception: long-term care policies excluding nursing home fixed indemnity plans.

Employers, employment agencies, labor organizations, and licensing agencies must not solicit, request, require, or purchase neurotechnology data of a person or family member, or require the use of a neurotechnology, as a condition of employment, preemployment application, labor organization membership, or licensure.

Employers, employment agencies, labor organizations, and licensing agencies must not take adverse employment actions (termination, modified terms, segregation, or classification) against any person because of genetic testing, genetic information, or neurotechnology data relating to the employee or family member.

Agreements offering employment, labor organization membership, licensure, or pay or benefits in return for an individual using a neurotechnology or taking a genetic test are prohibited.

Employers must not use neurotechnology data (or genetic information) in workplace wellness programs unless (1) health, genetic, or neurotechnology services are offered by the employer, (2) the employee provides written authorization, (3) only the employee and licensed health care professionals receive individually identifiable results, and (4) the employer receives only aggregate data. Employers must not penalize employees who decline to participate or disclose neurotechnology data.

No person may knowingly sell to or interpret for an employer, employment agency, labor organization, or licensing agency (or its employees, agents, or members) a genetic test or neurotechnology data of an employee, member, license holder, or prospective employee, member, or license holder, except under defined statutory exceptions.

Covered insurers must not use credit scores, protected-class characteristics, social media or online behavioral data, or consumer purchasing data as input variables in algorithmic decision systems for homeowners insurance underwriting or rating in Louisiana, regardless of actuarial justification.

For commercial lines insurance, covered insurers must not use protected-class characteristics as ADS input variables. Other enumerated presumptive proxy variables may be used only upon demonstration to the Commissioner of actuarial justification and absence of disparate impact.

Covered entities and service providers must not process sensitive covered data (including neural data) for the purposes of targeted advertising.

Controllers must not sell precise geolocation data, must not sell or transfer other sensitive data without affirmative consent (or COPPA compliance for children), and must establish and maintain reasonable administrative, technical, and physical data security practices including a retention schedule requiring deletion when data is no longer necessary.

Covered entities must not use biometric data to help make decisions that produce legal effects or similarly significant effects concerning end users. Prohibited decisions include denial or degradation of financial or lending services, housing, insurance, educational enrollment, criminal justice, employment opportunities, health care services, and access to basic necessities such as food and water.

Behavioral health care providers using AI for administrative support tasks must (1) ensure compliance with all applicable federal and state patient confidentiality and health records security laws, and (2) execute a written agreement with the AI system owner ensuring that protected health information will be kept confidential and that information accessed through the AI may not be used to train any AI system.

Employers using electronic monitoring tools or automated decisions tools must not: (a) collect health, medical, lifestyle, or wellness information; qualified characteristics; or information related to workplace activities (including HR information, productivity data, workplace communications, device usage, geolocation, audio-video or sensor data including biometric recognition, automated tool inputs/outputs linked to individuals, or online activity); (b) identify, punish, or obtain data about a covered individual engaged in activity protected under state or federal labor or employment law; or (c) monitor bathrooms, locker rooms, changing areas, breakrooms, smoking areas, cafeterias, lounges, lactation areas, or prayer areas — including monitoring frequency of use of those areas and monitoring a workplace in an employee's residence, personal vehicle, or personal property.

Employers must not use an automated decision system that uses individualized worker data to set compensation unless the employer can demonstrate that: (1) the input data is directly related to the worker's ability to complete the task (e.g., education, training, experience, seniority); (2) the inputs are clearly communicated to the worker so the worker knows compensation is a function of those attributes; and (3) the ADS is used either no more than once per six-month period per worker, or only in conjunction with a meaningful change in work duties such as hiring or promotion.

Employers must not use electronic monitoring tools to infer sensitive personal attributes (immigration status, religious/political beliefs, health/reproductive status, emotional state, neural data, sexual orientation, disability, criminal record, or credit history), to make predictions unrelated to essential job functions, to identify or retaliate against workers exercising legal rights, to deploy facial/gait/emotion recognition, to monitor off-duty workers or private areas, to monitor worker residences or personal vehicles, or to collect data for undisclosed purposes.

Employers must not use an automated decision system with individualized worker data to set compensation unless (1) the input data is directly related to the worker's ability to complete the task, (2) the inputs are clearly communicated to the worker, and (3) the system is used no more than once per six months per worker or only upon a meaningful change in work duties.

Employers, public entities, and vendors must not transfer or disclose biometric, health, or wellness data to third parties or government entities except as required by law; must not use such data in employment or public-benefit decisions; and must delete such data for applicants not hired, former employees after employment ends, and former service beneficiaries after services end.

Employers, public entities, and vendors must not disclose biometric, health, or wellness data to third parties or government except as required by law, must not use such data in employment or benefit decisions, and must not retain it after employment ends or the beneficiary stops receiving services.

Employers must not use an ADS to (1) violate any federal, state, or local labor, employment, health and safety, or civil rights law, (2) infer a worker's protected status under the New York Human Rights Law, (3) identify, profile, predict, or take adverse action against a worker for exercising legal rights, or (4) collect worker data for purposes not disclosed in the pre-use notice.

Persons developing automated systems must establish enhanced protections and restrictions for data and inferences related to sensitive domains. In sensitive domains, individual data and related inferences may only be used for necessary functions, safeguarded by ethical review and use prohibitions.

Controllers with actual knowledge or willful disregard that a consumer is an adolescent (ages 13–15) must not process the adolescent's personal data for targeted advertising, sale, or consequential profiling, and must not process it beyond what is reasonably necessary or for undisclosed purposes, without obtaining consent from the adolescent. Precise geolocation collection from adolescents requires necessity, consent, and a visible collection indicator.

Employers must not use any automated decision system outputs regarding an employee's physical or mental health in relation to an employment-related decision.

Employers must not use any automated decision system outputs regarding an employee's physical or mental health in relation to an employment-related decision.

Entities must not disclose a consumer's genetic data to any entity offering health insurance, life insurance, or long-term care insurance, or to any employer of the consumer, without the consumer's express consent.

Operators must comply with Part 13 of Article 1 of Title 6 (Colorado's minor privacy protections) regarding the privacy and data of minor account holders and minor users.

Covered online services must collect and use only the minimum personal data necessary to provide the specific elements of the service with which the covered minor has knowingly engaged, must not use such data for other purposes, and must retain it only as long as necessary for that purpose.

Commercial entities must ensure that any third party conducting anonymous age verification: (1) does not retain personal identifying information once age has been verified; (2) does not use age-verification personal identifying information for any other purpose; (3) keeps all age-verification personal identifying information anonymous and does not share it with any person; and (4) protects age-verification personal identifying information from unauthorized access, destruction, use, modification, or disclosure through reasonable security procedures appropriate to the nature of the information.

When conducting age assurance, covered entities and processors must: (1) collect only data strictly necessary to determine age status; (2) immediately delete the data on minor determination, retaining only the age-status outcome; (3) not reuse, combine, or disclose age-assurance data outside the processor relationship; and (4) provide a consumer appeals process for age-status determinations.

Controllers must provide an effective consent revocation mechanism at least as easy as the consent mechanism, cease processing within 15 days of revocation, must not use minor personal data for targeted or first-party advertising or sales when the controller knows or willfully disregards the consumer is a minor, and must not discriminate or retaliate against consumers exercising their data rights.

Manufacturers must provide parents or legal guardians with the ability to easily access, review, download, and delete all child user data and to disable data collection without disabling the core functionality of the artificial intelligence toy.

Covered entities must protect the confidentiality of age-verification information by limiting its collection, processing, use, and storage to what is strictly necessary for age verification, obtaining parental consent, or maintaining compliance records.

Social media platforms must not use personalized recommendation systems for minor users unless the minor has affirmatively opted in to the use of search and watch history for recommendations.

When conducting age verification, covered entities must (1) collect only age verification data strictly necessary to verify age, (2) use that data only for age verification, (3) not sell, rent, share, or disclose it to any third party except a service provider performing age verification under a contract prohibiting further disclosure, (4) not combine it with any other personal data about the user, (5) delete it within 24 hours of completing verification (except that the entity may retain a record that the user is a minor), and (6) provide a simple process for a user to appeal or correct an age-verification decision.

Covered entities must, when conducting age verification: (1) collect only the age verification data strictly necessary to verify age; (2) use age verification data only for age verification; (3) not sell, rent, share, or disclose age verification data to any third party except a service provider performing age verification under a contract prohibiting further disclosure; (4) not combine age verification data with any other personal data about the user; (5) delete age verification data within 24 hours of completing verification (except the entity may retain a record that the user has been verified as a minor); and (6) provide a simple process for a user to appeal or correct an age-verification decision.

Covered entities must provide parents with the ability to set the number of inputs or period of time the chatbot may use a child or teen's personal data and inputs to generate outputs, after which such data must be deleted from chatbot memory.

Covered entities must provide parents with pre-set tiered options for governing data retention settings that balance protectiveness and chatbot effectiveness.

Operators must not train the underlying model of a companion chatbot with a minor's inputs unless the minor's parent or guardian has affirmatively provided written consent to the operator to use the minor's personal information for that specific purpose.

Controllers must obtain consumer consent before processing sensitive data, or in the case of data from a known child, process the data in accordance with the federal Children's Online Privacy Protection Act.

Controllers must obtain consumer consent before collecting automatic content recognition data.

Entities must not treat the existence of an individual's biometric identifiers in publicly available images or media on the Internet as evidence of the individual's informed consent for capture or storage of those identifiers for a commercial purpose, unless the individual themselves made the image or media publicly available.

If a biometric identifier originally captured for AI training purposes is subsequently used for a commercial purpose outside the security and fraud-prevention exemptions, the person possessing the identifier must comply with all biometric identifier possession and destruction requirements of § 503.001, including informed consent and retention limitations, and is subject to associated penalties.

Any person must, before collecting or recording an individual's neural data gathered from a brain-computer interface, provide the individual with a written notice explaining how the neural data will be used and obtain written informed consent from the individual.

Any person must, before sharing an individual's neural data gathered from a brain-computer interface with a third party, provide the individual with a written request identifying the third party by name and address and the purposes of sharing, and obtain written informed consent from the individual to share.

Private entities must not collect, capture, purchase, receive through trade, or otherwise obtain any person's biometric identifier or biometric information unless the entity first: (1) informs the subject or their legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject or their legally authorized representative in writing of the specific purpose and length of term for which the biometric data is being collected, stored, and used; and (3) receives a written release executed by the subject or the subject's legally authorized representative.

Manufacturers and operators must not enable any coordinated surveillance feature as a default setting; coordinated surveillance features may be offered only upon the owner's affirmative opt-in consent, obtained separately from general terms of service.

Private entities must not collect, capture, purchase, or otherwise obtain an individual's biometric data unless, prior to receiving it, the entity provides written notice to the subject (or their legal representative) that (1) the entity intends to collect their biometric data, and (2) the purposes and length of time for which the entity intends to retain it.

Any person must provide written notice to an individual and obtain the individual's affirmative consent before capturing the individual's biometric identifier (retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose. Consent cannot be inferred from the mere existence of an image or other media containing one or more biometric identifiers on the internet or other publicly available source, unless the individual themselves made the image or media publicly available.

Entities must obtain initial express consent from the consumer, parent, guardian, or power of attorney before collecting, using, or disclosing neurotechnology data, including a clear description of intended uses, categories of individuals with access, and how data may be shared.

Entities must obtain separate express consent for (1) third-party transfers or disclosures (identifying the third party by name), (2) uses beyond the primary purpose and inherent contextual uses, and (3) post-purpose data retention; informed express consent for research disclosures; and express consent for marketing based on neurotechnology data, third-party marketing, and sale of neurotechnology data.

Operators must not permit their AI model to train on a student's covered information and retain the training data indefinitely unless the operator first (1) provides written notice to the student or parent that the AI model will retain training data indefinitely, and (2) obtains written consent from the student or parent. Absent this affirmative opt-in consent, indefinite retention of AI training data derived from student covered information is prohibited.

Covered entities and service providers must not transfer an individual's sensitive covered data (including neural data) to a third party unless the individual provides affirmative consent before each specific transfer, or the transfer falls within narrow exceptions for federal legal obligations or imminent injury.

Covered entities must not: (1) process or transfer biometric data in any manner not consented to by the end user; (2) sell biometric data to a third party; (3) disclose biometric data except as consistent with the duties of loyalty, care, and confidentiality; or (4) disclose or share biometric data with any other person unless that person enters into a contract imposing on them the same duties of care, loyalty, and confidentiality toward the end user as are imposed on the covered entity. Consent must be freely given, specific, informed, and unambiguous for a narrowly defined purpose; bundled terms of use and passive interactions do not constitute consent.

Covered entities must not (1) process or transfer biometric data in any manner not consented to by the end user, (2) sell biometric data to any third party, (3) disclose biometric data to any person or entity except as consistent with the duties of loyalty, care, and confidentiality, or (4) disclose or share biometric data with any person unless that person enters into a contract imposing the same duties of care, loyalty, and confidentiality toward the end user as are imposed on the covered entity. Consent must be freely given, specific, informed, and unambiguous for a narrowly defined purpose — acceptance of general terms of use does not qualify.

Private entities must, before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining any biometric identifier or biometric information, (1) provide written notice to the individual or their legally authorized representative that a biometric identifier or biometric information is being collected or stored, (2) provide written notice of the specific purpose and length of term for which the biometric identifier or biometric information is being collected, stored, and used, and (3) obtain informed written consent from the individual or their legally authorized representative. Written consent may be obtained electronically.

Retail food stores that use biometric data for voluntary identity verification must (1) provide written notice to the consumer that biometric data is being collected, stored, or used, (2) disclose in writing the specific purpose and retention period, (3) disclose in writing the circumstances under which data is shared with law enforcement, (4) obtain a written release from the consumer authorizing collection, storage, or use, and (5) not sell or share biometric data with any third party.

Any person must obtain an individual's consent before collecting biometric data from that individual. Consent must be received prior to the collection occurring.

Retail food stores that use biometric data for voluntary consumer identity verification must (1) inform the consumer in writing that biometric data is being collected, stored, or used, (2) disclose the specific purpose, retention period, and law enforcement sharing circumstances in writing, (3) obtain a written release authorizing collection, and (4) not sell or share biometric data with third parties.

Any person must obtain an individual's consent before collecting biometric data from that individual. Consent must be received prior to the collection event.

Employers must obtain affirmative written consent from each worker or job applicant before subjecting them to an electronic monitoring tool.

Private entities must, before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining any person's biometric identifier or biometric information: (1) inform the person or their legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) inform the person or their representative of the specific purpose and length of term for which the biometric data is being collected, stored, and used; and (3) receive a written release executed by the person or their representative. A valid written release may not be secured through a general release or user agreement.

Vendors must not collect, store, or analyze biometric identifiers, behavioral or emotional signals, voiceprints or keystroke dynamics, or precise geolocation unless strictly necessary for the educational purpose and disclosed in the digital privacy agreement.

Business entities must provide clear and conspicuous notice to consumers before using any biometric surveillance system on them at the entity's physical premises, and must use the system only for a lawful purpose. Notice may be provided by posting a sign at the perimeter of the surveilled area. Use without notice is an unlawful practice.

Private entities must provide written notice and obtain a written release from the individual (or their legally authorized representative) before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining any biometric identifier or biometric information. The written notice must inform the subject (1) that a biometric identifier or biometric information is being collected or stored, and (2) of the specific purpose and length of term for which the data is being collected, stored, and used.

State education agencies and local school districts must not collect personally identifiable educational data unless expressly authorized by law and must obtain written parental consent before collecting political or religious beliefs, family income or tax data (beyond lunch eligibility), biometric/health/psychological data unrelated to special education, student social media identifiers or internet activity, or any data not directly necessary for instruction or accountability.

School entities and vendors must not collect, store, or analyze biometric data — including facial recognition data, voiceprints, or emotional analysis — without case-specific written parental consent.

Any person must obtain express, prior consent — a clear, affirmative, freely given, informed, and unambiguous act — from an individual before appropriating, using, collecting, processing, selling, or otherwise exploiting that individual's covered data, including for AI training or AI-generated outputs that imitate, replicate, or are substantially derived from the individual's data. Consent is invalid if obtained through coercion, deception, or as a condition of service beyond what is reasonably necessary.

Any person sharing covered data with third parties must specifically and clearly disclose each third party to the individual at the time consent is sought, in a standalone disclosure presented distinctly and separately from any privacy policy, terms of service, or other general agreement. The disclosure must be affirmatively presented so the individual sees and acknowledges it. Consent obtained solely through inclusion in general documents or via non-specific or passive disclosure is invalid.

Virtual assistant licensees and licensors must obtain freely given, specific, informed, and unambiguous affirmative consent from the user (or a user-authorized designee) before enabling voice purchasing on a smart speaker or smart display device. Consent may not be obtained through a user agreement or as a condition of operating the virtual assistant.

A person using a permitted equal-terms discount who gathers personally identifiable information in connection with that discount must (1) provide the consumer with clear and conspicuous written notice of the specific intended purposes for the PII before using it and (2) obtain the consumer's written affirmative consent for each stated purpose before using the PII.

Entities must obtain initial express consent from the consumer, parent, guardian, or power of attorney before collecting, using, or disclosing the consumer's genetic data. The consent must: (1) clearly describe the entity's use of the genetic data collected through the genetic testing product or service; (2) specify the categories of individuals within the entity that have access to test results; and (3) specify how the entity may share the genetic data.

Entities must obtain separate express consent from the consumer for each of the following: (1) transferring or disclosing genetic data or biological samples to any third party other than the entity's processors, including disclosure of the named third-party recipient; (2) using genetic data beyond the primary purpose of the genetic testing product or service; (3) retaining biological samples after completing the initial testing service; (4) transferring genetic data to third parties for research purposes or publication (informed express consent required); and (5) marketing to the consumer based on genetic data, third-party marketing based on the consumer's purchase of genetic testing, or sale of the consumer's genetic data for valuable consideration.

Private entities must provide written notice and obtain a written release from the individual (or the individual's legally authorized representative) before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining any biometric identifier or biometric information. The written notice must inform the subject that a biometric identifier or biometric information is being collected or stored and must specify the purpose and length of term for which it will be collected, stored, and used.

Commercial entities and third-party vendors must not retain any identifying information supplied for age verification, except for audit and testing purposes, and in no case for longer than 30 days after platform access is granted.

Chatbot providers must not retain a user's chat log for more than ten years, unless retention is necessary to comply with this article or otherwise required by law.

Chatbot providers must not retain a user's chat log for more than ten years, unless retention is necessary to comply with this Chapter or is otherwise required by law.

Employers must destroy all worker data collected, used, or produced by an automated decision system no later than 37 months after its most recent collection, production, or use, unless the worker has provided written and informed consent to continued retention.

Employers and public entities must retain accurate records for at least three years and destroy collected data no later than 37 months after collection unless the individual has given uncoerced written consent to retain it.

Covered providers must not collect or retain personal information from detection-tool users (except opt-in feedback contact info used only to improve the tool), must not retain submitted content beyond 24 hours absent express consent, and must not retain personal provenance data from submitted content.

Chatbot providers must not retain a user's chat log for more than ten years, unless retention is necessary to comply with this chapter or otherwise required by law.

Chatbot providers must not retain a user's chat log for more than ten years, unless retention is necessary to comply with this chapter or otherwise required by law.

Chatbot providers must not retain a user's chat log for longer than 10 years, unless retention is necessary to comply with this subchapter or otherwise required by law.

Chatbot providers must not sell a user's chat logs. This is a categorical prohibition with no consent override. The sell definition excludes disclosures to service providers processing on behalf of the chatbot provider, disclosures directed by users with affirmative consent, and disclosures of data users intentionally made public without audience restrictions.

AI technology companies must not sell or disclose personal information of users unless the information has been deidentified, except as required by law.

Chatbot providers must not sell a user's chat logs.

Manufacturers must not (1) sell, lease, or transfer child user data to third parties, (2) use child user data to train unrelated AI models or systems, (3) use child user data for targeted advertising, or (4) retain child user data for more than 12 months without renewed parental consent.

Employers, public entities, and vendors must not sell, license, transfer, disclose, or share EMT-collected data or AEDS outputs to third parties without the individual's uncoerced written consent, must destroy applicant information on request, and vendors must return and delete all data on contract termination.

Artificial intelligence technology companies must not sell or disclose personal information of users unless the information is de-identified data.

Suppliers must not sell or share individually identifiable health information or user input of Pennsylvania users with third parties, except (1) health care provider requests with user consent, (2) health plan requests at the user's request, or (3) sharing with contracted functionality partners who comply with HIPAA privacy and security requirements as if the supplier were a covered entity and the partner a business associate.

Chatbot providers must not sell a user's chat logs. Sale includes exchanging personal data or input data for monetary or other valuable consideration or making it available to a third party for consideration, but excludes processor disclosures, user-directed disclosures with affirmative consent, and data the user intentionally made public without audience restrictions.

School entities must ensure that student data collected through AI (1) remains the property of the student and parent, (2) is not sold, shared, licensed, or used for commercial advertising or profiling, and (3) is deleted within a defined period unless retention is required by law.

Chatbot providers must not sell a user's chat logs.

Chatbot providers must not process a user's chat log to determine whether to display an advertisement, to select a product or service to advertise, or to customize an advertisement or its presentation to the user.

Chatbot providers must not sell a user's chat logs.

Private entities in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information. Destruction must occur within a reasonable time, but no later than 60 days after the data is no longer necessary for the permissible purpose identified in the notice or for which the individual provided authorization, or within three years of the individual's last interaction with the private entity, whichever occurs first. The entity must comply with its established retention schedule and destruction guidelines absent a valid warrant or subpoena.

Private entities in possession of biometric data must develop a written policy establishing a retention and destruction schedule for biometric data. The policy must be publicly available. Biometric data must not be retained for more than three years after the subject's last interaction with the entity or until the collection purpose has been accomplished, whichever is longer.

Persons or entities possessing a biometric identifier captured for a commercial purpose must destroy the biometric identifier within a reasonable time, but no later than one year after the date the purpose for collecting the identifier expires. If the biometric identifier is used in connection with an instrument or document required by another law to be maintained for a longer period, the person must destroy it within a reasonable time but no later than one year after the date the instrument or document is no longer required to be maintained by law. Where an employer collects biometric identifiers for security purposes, the purpose is presumed to expire upon termination of the employment relationship.

Private entities in possession of biometric identifiers or biometric information must develop and make publicly available a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information. Destruction must occur when the initial purpose for collection has been satisfied or within one year of the individual's last interaction with the private entity, whichever comes first. The entity must comply with its retention and destruction policy absent a valid court order, warrant, subpoena, or governmental agency request.

Private entities in possession of biometric identifiers or biometric information must store, transmit, and protect from disclosure all biometric data using the reasonable standard of care within the entity's industry, and must protect biometric data in a manner that is the same as or more protective than the manner in which the entity protects other confidential and sensitive information.

Private entities must store, transmit, and protect biometric data using reasonable methods that are widely accepted within the entity's industry and that are equivalent to or more protective than the manner in which the entity protects passwords and other account-access information.

Persons or entities possessing a biometric identifier captured for a commercial purpose must store, transmit, and protect the biometric identifier from disclosure using reasonable care, in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses.

Covered entities must secure biometric data from unauthorized access in a manner that is at least as protective as the manner in which they secure other confidential and sensitive data, and must not engage in harmful data practices (processing or transfer that causes or is likely to cause financial, physical, reputational injury, offensive intrusion upon seclusion, or other substantial injury).

Private entities must store, transmit, and protect from disclosure all biometric identifiers and biometric information using (1) the reasonable standard of care within the entity's industry, and (2) protections that are the same as or more protective than those the entity applies to other confidential and sensitive information.

Any person who obtains biometric data must store, transmit, and protect the data from disclosure using reasonable care, in a manner that is at least as protective as the manner in which the person stores, transmits, and protects other confidential information in its possession.

Any person who obtains biometric data must store, transmit, and protect from disclosure the biometric data using reasonable care and in a manner that is at least as protective as the manner in which the person stores, transmits, and protects other confidential information the person possesses.

Employers and public entities must maintain reasonable administrative and physical data-security practices, notify the Department and affected individuals of any breach within 48 hours, and bear joint-and-several liability with vendors for fraud or theft enabled by a security failure.

Private entities in possession of biometric identifiers or biometric information must store, transmit, and protect from disclosure all such data using at least the reasonable standard of care within the entity's industry, and in a manner that is the same as or more protective than the manner in which the entity stores, transmits, and protects other confidential and sensitive information.