Technology (Consumer Data Protection)

SB 223 prohibits businesses from setting different prices for goods or services based on "surveillance data" about consumers, such as tracking online behavior or inferred personal information. It directly affects businesses that use automated systems to adjust prices based on personal data, banning this practice except for cost-based pricing, standard discounts (like student or senior rates), or insurance-related decisions. The law allows consumers to sue for damages up to $3,000 per violation and authorizes the Attorney General to enforce penalties of up to $10,000 per violation. It includes specific safeguards for de-identified data and exempts insurers from the prohibition.

HB 28, the Artificial Intelligence Transparency Act, requires businesses in New Mexico using AI for major decisions (like loans, jobs, housing, or healthcare) to notify consumers before AI influences those decisions. It mandates clear explanations for negative outcomes - including reasons, data used, and human oversight - and provides consumers a chance to correct data or appeal decisions reviewed by humans. The bill also forces AI chatbots ("companion products") to disclose their AI nature at the start of each conversation and prohibits misleading claims about being human. These requirements apply to all businesses operating in New Mexico using AI for consequential decisions, effective July 1, 2026.

SB 192, the Data Broker Privacy Act, regulates companies that collect and sell personal data without a direct relationship to consumers (data brokers). It requires data brokers to register with New Mexico's Economic Development Department, pay fees funding a privacy fund, and disclose specific practices like whether they collect sensitive data (reproductive health, location, or minors' information). The bill establishes a public website and a centralized deletion tool allowing New Mexico residents to request removal of their personal data from all registered brokers with one request, including protections for accessibility and multilingual access. Data brokers must also annually report on how they handle deletion requests, including reasons for denials.

SB 40, the "Driver Privacy and Safety Act," limits how law enforcement and private entities can share automated license plate reader (ALPR) data. It prohibits sharing ALPR information for immigration enforcement, investigating protected health care activities (like reproductive or gender-affirming care), or targeting constitutionally protected speech. The law makes ALPR data confidential (not public record), requires court orders for private data sales, and mandates quarterly reports to the attorney general on out-of-state data requests. Violations can result in $10,000 fines per incident.

SB 53, the Community and Health Information Safety and Privacy Act, establishes new privacy standards for businesses operating in New Mexico that collect consumer data. It directly affects online service providers, health-related businesses, and other "covered entities" that handle personal or biometric data of New Mexico residents. Key provisions prohibit businesses from using consumer data for targeted advertising without consent, ban "dark patterns" that manipulate user choices, and require clear opt-out mechanisms for data sharing. The law also protects consumers' rights to access, correct, or delete their data and prohibits retaliation for exercising these rights. It specifically excludes certain health data used for medical treatment under federal law from its requirements.

HB 214, the Consumer Information and Data Protection Act, creates new rules for businesses handling personal data in New Mexico. It directly affects New Mexico residents ("consumers") by granting them rights to access, correct, or delete their personal data, and requiring businesses to obtain clear, affirmative consent for data processing - prohibiting "dark patterns" that trick users. Key provisions include special protections for children's data, sensitive health information (like reproductive or mental health data), and biometric data, while banning the use of precise location tracking without consent. Businesses must also implement security measures and cannot use de-identified data for re-identification. The bill does not apply to publicly available information or de-identified data.