Title 09, Commerce and Trade

§ 2440. Social Security number protection (a) This section shall be known as the Social Security Number Protection Act. (b) Except as provided in subsection (c) of this section, a business may not do any of the following: (1) intentionally communicate or otherwise make available …

§ 2443. Definitions As used in this subchapter: (1) “Covered information” means personal information or material, or information that is linked to personal information or material, in any media or format that is: (A)(i) not publicly available; or (ii) made publicly available purs…

§ 2443a. Operator prohibitions (a) An operator shall not knowingly do any of the following with respect to its site, service, or application: (1) Engage in targeted advertising on the operator’s site, service, or application or target advertising on any other site, service, or ap…

§ 2443b. Operator duties An operator shall: (1) implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information and designed to protect that covered information from unauthorized access, destruction, use, modification, or d…

§ 2443c. Permissive use or disclosure An operator may use or disclose covered information of a student under the following circumstances: (1) if other provisions of federal or State law require the operator to disclose the information and the operator complies with the requiremen…

§ 2443d. Operator actions that are not prohibited This subchapter does not prohibit an operator from doing any of the following: (1) using covered information to improve educational products if that information is not associated with an identified student within the operator’s si…

§ 2443e. Applicability This subchapter does not: (1) limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or under a court order; (2) limit the ability of an operator to use student data, including covered info…

§ 2443f. Enforcement [Effective January 1, 2027; see also § 2443f effective until January 1, 2027, set out above] (a) A person who violates a provision of this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title. (b) The Attorney …

§ 2444a. Registration [Effective January 1, 2027] (a) Definitions. As used in this section: (1)(A) “Educational technology product” and “product” mean any software, application, or platform that may collect, process, or transmit student data and that is used for teaching and lear…

§ 2445. Safe destruction of documents containing personal information (a) As used in this section: (1) “Business” means sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate…

§ 2446. Data brokers; annual registration [Effective January 1, 2027; see also § 2446 effective until January 1, 2027, set out above] (a) Registration. A person, not more than 30 days after meeting the definition of a data broker and then once annually thereafter on or before Jul…

§ 2447. Data broker duty to protect information; standards; technical requirements (a) Duty to protect personally identifiable information. (1) A data broker shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily…

§ 2449a. Definitions [Effective January 1, 2027] As used in this subchapter: (1)(A) “Affiliate” means a legal entity that shares common branding with another legal entity or controls, is controlled by, or is under common control with another legal entity. (B) As used in subdivisi…

§ 2449b. Exclusions [Effective January 1, 2027] This subchapter does not apply to: (1) a federal, state, tribal, or local government entity in the ordinary course of its operation; (2) protected health information that a covered entity or business associate processes in accordanc…

§ 2449c. Minimum duty of care [Effective January 1, 2027] (a) A covered business that processes a covered minor’s data in any capacity owes a minimum duty of care to the covered minor. (b) As used in this subchapter, “a minimum duty of care” means the use of the personal data of …

§ 2449d. Required default privacy settings and tools [Effective January 1, 2027] (a) Default privacy settings. (1) A covered business shall configure all default privacy settings provided to a covered minor through the online service, product, or feature to the highest level of p…

§ 2449e. Transparency [Effective January 1, 2027] A covered business shall prominently and clearly provide on their website or mobile application: (1) the covered business’s privacy information, terms of service, policies, and community standards; (2) the purpose of each algorith…

§ 2449f. Prohibited data and design practices [Effective January 1, 2027] (a) Data privacy. A covered business shall not: (1) collect, sell, share, or retain any personal data of a covered minor that is not necessary to provide an online service, product, or feature with which th…

§ 2449g. Age assurance privacy [Effective January 1, 2027] (a) Privacy protections for age assurance data. During the process of conducting age assurance, covered businesses and processors shall: (1) only collect personal data of a user that is strictly necessary for age assuranc…

§ 2449h. Enforcement [Effective January 1, 2027] (a) A covered business or processor that violates this subchapter or rules adopted pursuant to this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title. (b) The Attorney General sha…

§ 2449i. Limitations [Effective January 1, 2027] Nothing in this subchapter shall be interpreted or construed to: (1) impose liability in a manner that is inconsistent with 47 U.S.C. § 230; or (2) prevent or preclude any covered minor from deliberately or independently searching …

§ 2449j. Rights and freedoms of covered minors [Effective January 1, 2027] It is the intent of the General Assembly that nothing in this subchapter may be construed to infringe on the existing rights and freedoms of covered minors or be construed to discriminate against the cover…