Data privacy; establishing consumer rights for processing of certain data. Effective date.

The definition of 'Affiliate' was restructured to clearly list three specific criteria for control: ownership of over 50% of voting securities, control over election of directors, or power to exercise controlling influence over management.

New definitions were added for 'Business associate' (referencing HIPAA), 'Health care provider' (referencing HIPAA), and 'Health record' to ensure consistency with federal healthcare privacy standards.

The definition of 'Biometric data' was clarified to explicitly exclude physical or digital photographs, videos, or audio recordings unless they are specifically generated to identify a specific individual.

New definitions were added for 'De-identified data' and expanded the list of covered categories under 'Decision that produces a legal or similarly significant effect' to include access to basic necessities like food and water.

The document header changed from 'FLOOR SUBSTITUTE' to 'ENGROSSED SENATE BILL' with new sponsor information including West (Josh) of the House, indicating the bill has moved through the House and been amended.

Changed from a floor amendment to a floor substitute, transforming the document from a limited amendment to a complete legislative bill.

Added comprehensive definitions for key terms including 'Affiliate', 'Controller', 'Consumer', 'Biometric data', 'Dark pattern', and others essential to the new privacy framework.

Removed specific list of personally identifiable information items (name, address, email, phone, SSN) that were previously being amended, as the new bill uses broader definitions.

Established new requirements for data privacy notices, consumer request procedures, data protection assessments, and controller responsibilities.

Created enforcement authority for the Attorney General, including penalties, fees, and website posting requirements for violations.

Updated the timestamp of the floor amendments filing from 3/4/2025 9:30 AM to 3/17/2025 4:35 PM, which is a procedural correction to the document metadata.

Added a specific list of personally identifiable information items (name, address, email, phone, SSN, contact identifiers) to clarify what data is protected under the privacy law.

Added a requirement that consumer data cannot be used for purposes not disclosed in the privacy notice, limiting how businesses can utilize collected information.

Changed the language around data sales from 'controls or processes' to 'engages in the sale of', narrowing the scope of activities that trigger privacy obligations.

Deleted the original language describing data sales practices on pages 30, lines 22-24, removing previous regulatory language about consumer data handling.

Added a new definition for 'Children's Online Privacy Protection Act of 1998' to clarify how COPPA regulations apply under this state law.

Expanded the definition of 'Consent' to explicitly exclude dark patterns, hovering, muting, or closing content as valid forms of consent.

Added a second sponsor (West from the House) to the bill header, indicating bipartisan support.

Reorganized the layout and formatting of the definitions section, renumbering and restructuring how terms are presented.