Section 1. Section 13-61-101 is amended to read:13-61-101. Definitions.As used in this chapter:(1)"Account" means the Consumer Privacy Restricted Account established in Section 13-61-403.(2)"Affiliate" means an entity that:(a)controls, is controlled by, or is under common control with another entity; or(b)shares common branding with another entity.(3)"Aggregated data" means information that relates to a group or category of consumers:(a)from which individual consumer identities have been removed; and(b)that is not linked or reasonably linkable to any consumer.(4)"Air carrier" means the same as that term is defined in 49 U.S.C. Sec. 40102.(5)"Authenticate" means to use reasonable means to determine that a consumer's request to exercise the rights described in Section 13-61-201 is made by the consumer who is entitled to exercise those rights.(6)(a)"Biometric data" means data generated by automatic measurements of an individual's unique biological characteristics.(b)"Biometric data" includes data described in Subsection (6)(a) that are generated by automatic measurements of an individual's fingerprint, voiceprint, eye retinas, irises, or any other unique biological pattern or characteristic that is used to identify a specific individual.(c)"Biometric data" does not include:(i)a physical or digital photograph;(ii)a video or audio recording;(iii)data generated from an item described in Subsection (6)(c)(i) or (ii);(iv)information captured from a patient in a health care setting; or(v)information collected, used, or stored for treatment, payment, or health care operations as those terms are defined in 45 C.F.R. Parts 160, 162, and 164.(7)"Business associate" means the same as that term is defined in 45 C.F.R. Sec. 160.103.(8)"Child" means an individual younger than 13 years old.(9)"Consent" means an affirmative act by a consumer that unambiguously indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.(10)(a)"Consumer" means an individual who is a resident of the state acting in an individual or household context.(b)"Consumer" does not include an individual acting in an employment or commercial context.(11)"Control" or "controlled" as used in Subsection (2) means:(a)ownership of, or the power to vote, more than 50% of the outstanding shares of any class of voting securities of an entity;(b)control in any manner over the election of a majority of the directors or of the individuals exercising similar functions; or(c)the power to exercise controlling influence of the management of an entity.(12)"Controller" means a person doing business in the state who determines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the determination alone or with others.(13)"Covered entity" means the same as that term is defined in 45 C.F.R. Sec. 160.103.(14)(a)"Deidentified data" means data that:(i)cannot reasonably be linked to an identified individual or an identifiable individual; and(ii)are possessed by a controller who:(A)takes reasonable measures to ensure that a person cannot associate the data with an individual;(B)publicly commits to maintain and use the data only in deidentified form and not attempt to reidentify the data; and(C)contractually obligates any recipients of the data to comply with the requirements described in Subsections (14)(b)(i) and (ii).this Subsection (14)(a).(b)"Deidentified data" includes synthetic data.(15)"Director" means the director of the Division of Consumer Protection.(16)"Division" means the Division of Consumer Protection created in Section 13-2-1.(17)"Governmental entity" means the same as that term is defined in Section 63G-2-103.(18)"Health care facility" means the same as that term is defined in Section 26B-2-201.(19)"Health care provider" means the same as that term is defined in Section 78B-3-403.(20)"Identifiable individual" means an individual who can be readily identified, directly or indirectly.(21)"Institution of higher education" means a public or private institution of higher education.(22)"Local political subdivision" means the same as that term is defined in Section 11-14-102.(23)"Motor vehicle" means the same as that term is defined in Section 41-1a-102.(24)"Motor vehicle manufacturer" means a person who manufactures or assembles motor vehicles for sale or lease.(25)"Nonprofit corporation" means:(a)the same as that term is defined in Section 16-6a-102; or(b)a foreign nonprofit corporation as defined in Section 16-6a-102.(24)(26)(a)"Personal data" means information that is linked or reasonably linkable to an identified individual or an identifiable individual.(b)"Personal data" does not include deidentified data, aggregated data, or publicly available information.(25)(27)"Process" means an operation or set of operations performed on personal data, including collection, use, storage, disclosure, analysis, deletion, or modification of personal data.(26)(28)"Processor" means a person who processes personal data on behalf of a controller.(27)(29)"Protected health information" means the same as that term is defined in 45 C.F.R. Sec. 160.103.(28)(30)"Pseudonymous data" means personal data that cannot be attributed to a specific individual without the use of additional information, if the additional information is:(a)kept separate from the consumer's personal data; and(b)subject to appropriate technical and organizational measures to ensure that the personal data are not attributable to an identified individual or an identifiable individual.(29)(31)"Publicly available information" means information that a person:(a)lawfully obtains from a record of a governmental entity;(b)reasonably believes a consumer or widely distributed media has lawfully made available to the general public; or(c)if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.(30)(32)"Right" means a consumer right described in Section 13-61-201.(31)(33)(a)"Sale," "sell," or "sold" means the exchange of personal data for monetary consideration by a controller to a third party.(b)"Sale," "sell," or "sold" does not include:(i)a controller's disclosure of personal data to a processor who processes the personal data on behalf of the controller;(ii)a controller's disclosure of personal data to an affiliate of the controller;(iii)considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a third party if the purpose is consistent with a consumer's reasonable expectations;(iv)the disclosure or transfer of personal data when a consumer directs a controller to:(A)disclose the personal data; or(B)interact with one or more third parties;(v)a consumer's disclosure of personal data to a third party for the purpose of providing a product or service requested by the consumer or a parent or legal guardian of a child;(vi)the disclosure of information that the consumer:(A)intentionally makes available to the general public via a channel of mass media; and(B)does not restrict to a specific audience; or(vii)a controller's transfer of personal data to a third party as an asset that is part of a proposed or actual merger, an acquisition, or a bankruptcy in which the third party assumes control of all or part of the controller's assets.(32)(34)(a)"Sensitive data" means:(i)personal data that reveals:(A)an individual's racial or ethnic origin;(B)an individual's religious beliefs;(C)an individual's sexual orientation;(D)an individual's citizenship or immigration status; or(E)information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional;(ii)the processing of genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual; or(iii)specific geolocation data.(b)"Sensitive data" does not include personal data that reveals an individual's:(i)racial or ethnic origin, if the personal data are processed by a video communication service; or(ii)if the personal data are processed by a person licensed to provide health care under Title 26B, Chapter 2, Part 2, Health Care Facility Licensing and Inspection, or Title 58, Occupations and Professions, information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional.(33)(35)(a)"Specific geolocation data" means information derived from technology, including global position system level latitude and longitude coordinates, that directly identifies an individual's specific location, accurate within a radius of 1,750 feet or less.(b)"Specific geolocation data" does not include:(i)the content of a communication; or(ii)any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.(34)(36)"Synthetic data" means data that has been generated by computer algorithms or statistical models and does not contain personal data.(35)(37)(a)"Targeted advertising" means displaying an advertisement to a consumer where the advertisement is selected based on personal data obtained from the consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests.(b)"Targeted advertising" does not include advertising:(i)based on a consumer's activities within a controller's website or online application or any affiliated website or online application;(ii)based on the context of a consumer's current search query or visit to a website or online application;(iii)directed to a consumer in response to the consumer's request for information, product, a service, or feedback; or(iv)processing personal data solely to measure or report advertising:(A)performance;(B)reach; or(C)frequency.(36)(38)"Third party" means a person other than:(a)the consumer, controller, or processor; or(b)an affiliate or contractor of the controller or the processor.(37)(39)"Trade secret" means information, including a formula, pattern, compilation, program, device, method, technique, or process, that:(a)derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from the information's disclosure or use; and(b)is the subject of efforts that are reasonable under the circumstances to maintain the information's secrecy.(40)"Vehicle data collection system" means a technology system or device installed in or on a motor vehicle that collects, transmits, or stores a consumer or occupant's personal data.

Section 2. Section 13-61-102 is amended to read:13-61-102. Applicability.(1)This chapter applies to:(a) any controller or processor who:(a)(i)(i)(A)conducts business in the state; or(ii)(B)produces a product or service that is targeted to consumers who are residents of the state;(b)(ii)has annual revenue of $25,000,000 or more; and(c)(iii)satisfies one or more of the following thresholds:(i)(A)during a calendar year, controls or processes personal data of 100,000 or more consumers; or(ii)(B)derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.; or(b)a motor vehicle manufacturer who:(i)manufactures motor vehicles that are sold or leased in the state; and(ii) collects, transmits, or stores personal data through a vehicle data collection system.(2)This chapter does not apply to:(a)a governmental entity or a third party under contract with a governmental entity when the third party is acting on behalf of the governmental entity;(b)a tribe;(c)an institution of higher education;(d)a nonprofit corporation;(e)a covered entity;(f)a business associate;(g)information that meets the definition of:(i)protected health information for purposes of the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et seq., and related regulations;(ii)patient identifying information for purposes of 42 C.F.R. Part 2;(iii)identifiable private information for purposes of the Federal Policy for the Protection of Human Subjects, 45 C.F.R. Part 46;(iv)identifiable private information or personal data collected as part of human subjects research pursuant to or under the same standards as:(A)the good clinical practice guidelines issued by the International Council for Harmonisation; or(B)the Protection of Human Subjects under 21 C.F.R. Part 50 and Institutional Review Boards under 21 C.F.R. Part 56;(v)personal data used or shared in research conducted in accordance with one or more of the requirements described in Subsection (2)(g)(iv);(vi)information and documents created specifically for, and collected and maintained by, a committee but not a board or council listed in Section 26B-1-204;(vii)information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. Sec. 11101 et seq., and related regulations;(viii)patient safety work product for purposes of 42 C.F.R. Part 3; or(ix)information that is:(A)deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. Part 164; and(B)derived from any of the health care-related information listed in this Subsection (2)(g);(h)information originating from, and intermingled to be indistinguishable with, information under Subsection (2)(g) that is maintained by:(i)a health care facility or health care provider; or(ii)a program or a qualified service organization as defined in 42 C.F.R. Sec. 2.11;(i)information used only for public health activities and purposes as described in 45 C.F.R. Sec. 164.512;(j)(i)an activity by:(A)a consumer reporting agency, as defined in 15 U.S.C. Sec. 1681a;(B)a furnisher of information, as set forth in 15 U.S.C. Sec. 1681s-2, who provides information for use in a consumer report, as defined in 15 U.S.C. Sec. 1681a; or(C)a user of a consumer report, as set forth in 15 U.S.C. Sec. 1681b;(ii)subject to regulation under the federal Fair Credit Reporting Act, 15 U.S.C. Sec. 1681 et seq.; and(iii)involving the collection, maintenance, disclosure, sale, communication, or use of any personal data bearing on a consumer's:(A)credit worthiness;(B)credit standing;(C)credit capacity;(D)character;(E)general reputation;(F)personal characteristics; or(G)mode of living;(k)a financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. Sec. 6801 et seq., and related regulations;(l)personal data collected, processed, sold, or disclosed in accordance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. Sec. 2721 et seq.;(m)personal data regulated by the federal Family Education Rights and Privacy Act, 20 U.S.C. Sec. 1232g, and related regulations;(n)personal data collected, processed, sold, or disclosed in accordance with the federal Farm Credit Act of 1971, 12 U.S.C. Sec. 2001 et seq.;(o)data that are processed or maintained:(i)in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent the collection and use of the data are related to the individual's role;(ii)as the emergency contact information of an individual described in Subsection (2)(o)(i) and used for emergency contact purposes; or(iii)to administer benefits for another individual relating to an individual described in Subsection (2)(o)(i) and used for the purpose of administering the benefits;(p)an individual's processing of personal data for purely personal or household purposes; or(q)an air carrier.(3)A controller is in compliance with any obligation to obtain parental consent under this chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C. Sec. 6501 et seq., and the act's implementing regulations and exemptions.(4)This chapter does not require a person to take any action in conflict with the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et seq., or related regulations.

Section 3. Section 13-61-501 is enacted to read:5. Motor Vehicle Data Privacy13-61-501. Definitions.As used in this part:(1)"Connected device" means a consumer's mobile phone, tablet, or similar personal electronic device that connects to a motor vehicle through the in-vehicle interface for purposes of accessing the device's applications, contacts, or other data through the vehicle's display.(2)"In-vehicle interface" means a display screen, control panel, or other interactive system in a motor vehicle through which an individual may access or control motor vehicle functions or settings.(3)"Readily accessible data" means personal data that:(a)a consumer directly inputs into or provides to the motor vehicle from a connected device through a motor vehicle's in-vehicle interface; and(b)is stored locally on the motor vehicle and accessible through the in-vehicle interface.

Section 4. Section 13-61-502 is enacted to read:13-61-502. Motor vehicle manufacturer requirements.(1)Except as provided in Subsection (2), a motor vehicle manufacturer shall, for a motor vehicle with a model year 2030 or later, provide in-vehicle privacy controls that allow a consumer to:(a)view the categories of personal data the vehicle data collection system collects;(b)view the categories of third parties with whom the motor vehicle manufacturer shares personal data;(c)opt out of the sale of personal data or processing for targeted advertising; and(d)delete readily accessible data.(2)A motor vehicle manufacturer is not required to comply with Subsection (1) for a specific motor vehicle model if the manufacturer demonstrates that the model is not technologically capable of providing the privacy controls described in Subsection (1).(3)A motor vehicle manufacturer shall make the in-vehicle privacy controls described in Subsection (1):(a)accessible through the motor vehicle's in-vehicle interface;(b)accessible to any individual operating the motor vehicle; and(c)clearly labeled and easy to locate within the in-vehicle interface.(4)The settings selected by a consumer using the in-vehicle privacy controls shall remain in effect until the consumer changes the settings.(5)A motor vehicle manufacturer may provide the consumer with access to privacy controls through a website or mobile application in addition to the in-vehicle privacy controls required by this section, but may not require the consumer to use a website or mobile application to exercise the rights described in this section.(6)If a motor vehicle manufacturer receives a court order requiring deletion or a request that includes a copy of a legally issued protective order, the motor vehicle manufacturer shall delete all personal data within five business days after the day on which the motor vehicle manufacturer receives the court order or request.

Section 5. Section 13-61-503 is enacted to read:13-61-503. Exemptions for motor vehicle manufacturers.(1)A motor vehicle manufacturer may collect personal data for the purpose of improving the motor vehicle manufacturer's product if the motor vehicle manufacturer:(a)collects only the minimum personal data necessary to accomplish the purpose; and(b)uses the personal data only for internal product improvement purposes.(2)Personal data collected in accordance with Subsection (1) is not subject to the consent requirements of Section 13-61-302.(3)Section 13-61-302 does not apply to personal data that a vehicle data collection system:(a)collects solely for the purpose of:(i)vehicle safety, including airbag deployment, operational safety, passenger safety, collision avoidance, or other safety features required by federal law;(ii)vehicle operation, including engine control, battery level, transmission operation, or other mechanical functions necessary to operate the motor vehicle; or(iii)compliance with a federal or state law, rule, or regulation; or(b)processes temporarily and does not transmit outside the motor vehicle or store for longer than necessary.

Section 6. Section 13-61-504 is enacted to read:13-61-504. Motor Vehicle Division notification requirements.The Motor Vehicle Division, created in Section 41-1a-106, shall provide information on the division's website regarding the data privacy rights of motor vehicle owners under this part.

Section 7. Effective Date.This bill takes effect on January 1, 2027.