Mississippi Consumer Data Privacy Act; enact.

S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~ G1/2
26/SS36/R408
PAGE 1 (ens\tb)

To: Judiciary, Division A
MISSISSIPPI LEGISLATURE REGULAR SESSION 2026

By: Senator(s) Turner-Ford

SENATE BILL NO. 2015

AN ACT TO CREATE THE "MISSISSIPPI CONSUMER DATA PRIVACY ACT"; 1
TO AUTHORIZE CONSUMERS TO REQUEST THAT BUSINESSES DISCLOSE CERTAIN 2
INFORMATION; TO AUTHORIZE CONSUMERS TO REQUEST THAT BUSINESSES 3
DELETE PERSONAL INFORMATION COLLECTED BY BUSINESSES; TO REQUIRE 4
BUSINESSES TO DISCLOSE CERTAIN INFORMATION TO CONSUMERS, TO INFORM 5
CONSUMERS OF THEIR RIGHT TO REQUEST THAT PERSONAL INFORMATION BE 6
DELETED, AND TO DELETE PERSONAL INFORMATION COLLECTED ABOUT 7
CONSUMERS UPON REQUEST; TO AUTHORIZE CONSUMERS TO INSTRUCT 8
BUSINESSES TO NOT SELL THE CONSUMERS' PERSONAL INFORMATION; TO 9
AUTHORIZE CONSUMERS TO BRING CIVIL ACTIONS AGAINST BUSINESSES THAT 10
VIOLATE THIS ACT; TO AUTHORIZE THE ATTORNEY GENERAL TO BRING CIVIL 11
ACTIONS AGAINST BUSINESSES THAT VIOLATE THIS ACT; TO REQUIRE THE 12
ATTORNEY GENERAL TO ADOPT REGULATIONS TO FURTHER THE PURPOSES OF 13
THIS ACT; AND FOR RELATED PURPOSES. 14
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI: 15
SECTION 1. This act shall be known as the "Mississippi 16
Consumer Data Privacy Act." 17
SECTION 2. (1) The Legislature finds: 18
(a) That it is an important and substantial state 19
interest to protect the private, personal data in Mississippi; 20
(b) That with the increasing use of technology and data 21
in everyday life, there is an increasing amount of private, 22
personal data being shared by consumers with businesses as a part 23
of everyday transactions and online and other activities; 24
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 2 (ens\tb)

(c) That the increasing collection, storage, use and 25
sale of personal data creates increased risks of identity theft, 26
financial loss, and other misuse of private personal data; and 27
(d) That many consumers do not know, understand, or 28
have appropriate authority over the distribution, use, sale or 29
disclosure of their personal data. 30
(2) Therefore, it is the intent of the Legislature to 31
further Mississippians' right to privacy by recognizing that 32
Mississippi consumers have the following rights: 33
(a) To know what personal information is being 34
collected about them; 35
(b) To know whether their personal information is sold 36
or disclosed and to whom; 37
(c) To decline or opt-out of the sale of their personal 38
information; 39
(d) To access their personal information that has been 40
collected; and 41
(e) To receive equal service and price, even if they 42
exercise their above rights. 43
SECTION 3. As used in this act: 44
(a) "Business" means: 45
(i) A sole proprietorship, partnership, limited 46
liability company, corporation, association, or other legal entity 47
that is organized or operated for the profit or financial benefit 48
of its shareholders or other owners, that collects consumers' 49
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 3 (ens\tb)

personal information, or on the behalf of which such information 50
is collected and that alone, or jointly with others, determines 51
the purposes and means of the processing of consumers' personal 52
information, that does business in Mississippi, and that satisfies 53
one or more of the following thresholds: 54
1. Has annual gross revenues in excess of Ten 55
Million Dollars ($10,000,000.00); 56
2. Alone or in combination, annually buys, 57
receives for the business' commercial purposes, sells, or shares 58
for commercial purposes, alone or in combination, the personal 59
information of fifty thousand (50,000) or more consumers, 60
households, or devices; and 61
3. Derives fifty percent (50%) or more of its 62
annual revenues from selling consumers' personal information; 63
(ii) Any entity that controls or is controlled by 64
a business, as defined in subparagraph (i) of this section, and 65
that shares common branding with the business; 66
1. For this subparagraph (ii), "control" or 67
"controlled" means ownership of, or the power to vote, more than 68
fifty percent (50%) of the outstanding shares of any class of 69
voting security of a business; control in any manner over the 70
election of a majority of the directors, or of individuals 71
exercising similar functions; or the power to exercise a 72
controlling influence over the management of a company; and 73
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 4 (ens\tb)

2. "Common branding" means a shared name or 74
trademark. 75
(b) (i) "Personal information" means information that 76
identifies, relates to, describes, is capable of being associated 77
with, or could reasonably be linked, directly or indirectly, with 78
a particular consumer or household, including, but not limited to: 79
1. Identifiers such as a real name, alias, 80
postal address, unique personal identifier, online identifier 81
internet protocol address, email address, account name, social 82
security number, driver's license number, passport number, or 83
other similar identifiers; 84
2. Characteristics of protected 85
classifications under Mississippi or federal law; 86
3. Commercial information, including records 87
of personal property, products or services purchased, obtained, or 88
considered, or other purchasing or consuming histories or 89
tendencies; 90
4. Biometric information; 91
5. Internet or other electronic network 92
activity information, including, but not limited to, browsing 93
history, search history, and information regarding a consumer's 94
interaction with an internet website, application, or 95
advertisement; 96
6. Geolocation data; 97
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 5 (ens\tb)

7. Audio, electronic, visual, thermal, 98
olfactory, or similar information; 99
8. Professional or employment-related 100
information; 101
9. Education information, defined as 102
information that is not publicly available personally identifiable 103
information as defined in the Family Educational Rights and 104
Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99); and 105
10. Inferences drawn from any of the 106
information identified in this section to create a profile about a 107
consumer reflecting the consumer's preferences, characteristics, 108
psychological trends, preferences, predispositions, behavior, 109
attitudes, intelligence, abilities, and aptitudes. 110
(ii) "Personal information" does not include 111
publicly available information. For the purposes of this 112
subparagraph (ii), "publicly available" means information that is 113
lawfully made available from federal, state, or local government 114
records, as restricted by any conditions associated with such 115
information. "Publicly available" does not mean biometric 116
information collected by a business about a consumer without the 117
consumer's knowledge. Information is not "publicly available" if 118
that data is used for a purpose that is not compatible with the 119
purpose for which the data is maintained and made available in the 120
government records or for which it is publicly maintained. 121
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 6 (ens\tb)

"Publicly available" does not include consumer information that is 122
deidentified or aggregate consumer information. 123
SECTION 4. A consumer shall have the right: 124
(a) To request that a business that collects personal 125
information about the consumer disclose to the consumer the 126
following: 127
(i) The categories and specific pieces of personal 128
information that the business has collected about that consumer; 129
(ii) The categories of sources from which the 130
personal information is collected; 131
(iii) The business or commercial purpose for 132
collecting or selling personal information; and 133
(iv) The categories of third parties with whom the 134
business shares personal information; 135
(b) To request that a business that sells the 136
consumer's personal information, or that discloses it for a 137
business purpose, disclose to that consumer: 138
(i) The categories of personal information that 139
the business collected about the consumer; 140
(ii) The categories of personal information that 141
the business sold about the consumer and the categories of third 142
parties to whom the personal information was sold, by category or 143
categories of personal information for each third party to whom 144
the personal information was sold; and 145
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 7 (ens\tb)

(iii) The categories of personal information that 146
the business disclosed about the consumer for a business purpose; 147
and 148
(c) To request that a business delete any personal 149
information about the consumer which the business has collected 150
from the consumer. 151
SECTION 5. Upon receipt of a verifiable request from a 152
consumer, a business shall: 153
(a) Disclose the information specified in Section 4(a) 154
of this act to the consumer if the business collects personal 155
information about that consumer. This subparagraph (a) does not 156
require a business to: 157
(i) Retain any personal information about a 158
consumer collected for a single one-time transaction if, in the 159
ordinary course of business, that information about the consumer 160
is not retained; or 161
(ii) Reidentify or otherwise link any data that, 162
in the ordinary course of business, is not maintained in a manner 163
that would be considered personal information. 164
(b) Disclose the information specified in Section 4(b) 165
of this act to the consumer if the business sells personal 166
information about that consumer, or discloses that consumer's 167
personal information for a business purpose. 168
(c) Delete a consumer's personal information from its 169
records and direct any service providers to delete a consumer's 170
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 8 (ens\tb)

personal information from their records. A business or a service 171
provider shall not be required to comply with a consumer's request 172
to delete the consumer's personal information if it is necessary 173
for the business or service provider to maintain the consumer's 174
personal information in order to: 175
(i) Complete the transaction for which the 176
personal information was collected, provide a good or service 177
requested by the consumer, or reasonably anticipate within the 178
context of a business's ongoing business relationship with the 179
consumer, or otherwise perform a contract between the business and 180
the consumer; 181
(ii) Detect security incidents, protect against 182
malicious, deceptive, fraudulent, or illegal activity or prosecute 183
those responsible for that activity; 184
(iii) Debug to identify and repair errors that 185
impair existing intended functionality; 186
(iv) Exercise free speech, ensure the right of 187
another consumer to exercise his or her right of free speech, or 188
exercise another right provided for by law; 189
(v) Engage in public or peer-reviewed scientific, 190
historical, or statistical research in the public interest that 191
adheres to all other applicable ethics and privacy laws, when the 192
businesses' deletion of the information is likely to render 193
impossible or seriously impair the achievement of such research, 194
if the consumer has provided informed consent; 195
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 9 (ens\tb)

(vi) To enable solely internal uses that are 196
reasonably aligned with the expectations of the consumer based on 197
the consumer's relationship with the business; or 198
(vii) Comply with a legal obligation. 199
SECTION 6. A business that collects personal information 200
about consumers shall disclose, pursuant to Section 10 of this 201
act, the consumer's rights to request the deletion of the 202
consumer's personal information. 203
SECTION 7. (1) A consumer shall have the right, at any 204
time, to direct a business that sells personal information about 205
the consumer to third parties not to sell the consumer's personal 206
information. This right may be referred to as the right to opt 207
out. 208
(a) A business shall respect the consumer's decision to 209
opt out under this subsection (1) for at least twelve (12) months 210
before requesting that the consumer authorize the sale of the 211
consumer's personal information. 212
(b) A business shall use any personal information 213
collected from the consumer in connection with the submission of 214
the consumer's opt-out request solely for the purposes of 215
complying with the opt-out request. 216
(2) A business that sells consumers' personal information to 217
third parties shall provide notice to consumers that this 218
information may be sold and that consumers have the right to opt 219
out of the sale of their personal information. 220
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 10 (ens\tb)

(3) A business that has received direction from a consumer 221
not to sell the consumer's personal information or has not 222
received consent to sell a minor consumer's personal information 223
shall be prohibited from selling the consumer's personal 224
information after its receipt of the consumer's direction, unless 225
the consumer subsequently provides express authorization for the 226
sale of the consumer's personal information. 227
(4) Notwithstanding subsections (1) and (3) of this section, 228
a business shall not sell the personal information of consumers if 229
the business has actual knowledge that the consumer is less than 230
sixteen (16) years of age, unless the consumer, in the case of 231
consumers between thirteen (13) and sixteen (16) years of age, or 232
the consumer's parent or guardian, in the case of consumers who 233
are less than thirteen (13) years of age, has affirmatively 234
authorized the sale of the consumer's personal information. A 235
business that willfully disregards the consumer's age shall be 236
deemed to have had actual knowledge of the consumer's age. This 237
right may be referred to as the right to opt in. 238
SECTION 8. A third party shall not sell personal information 239
about a consumer that has been sold to the third party by a 240
business unless the consumer has received explicit notice and is 241
provided an opportunity to exercise the right to opt out as 242
provided in Section 7(1) of this act. 243
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 11 (ens\tb)

SECTION 9. (1) A business shall not discriminate against a 244
consumer when a consumer exercises any of the consumer's rights 245
under this act, including, but not limited to, by: 246
(a) Denying goods or services to the consumer; 247
(b) Charging different prices or rates for goods or 248
services, including through the use of discounts or other benefits 249
or imposing penalties; 250
(c) Providing a different level or quality of goods or 251
services to the consumer, if the consumer exercises the consumer's 252
rights under this act; or 253
(d) Suggesting that the consumer will receive a 254
different price or rate for goods or services or a different level 255
or quality of goods or services. 256
(2) Nothing in subsection (l) of this section prohibits a 257
business from charging a consumer a different price or rate, or 258
from providing a different level or quality of goods or services 259
to the consumer, if that difference is reasonably related to the 260
value provided to the consumer by the consumer's data. 261
SECTION 10. (1) In order to comply with the notice 262
requirements of the above sections, a business shall, in a form 263
that is reasonably accessible to consumers: 264
(a) Make available two (2) or more designated methods 265
for submitting requests for information required to be disclosed, 266
including, at a minimum, a toll-free telephone number, and if the 267
business maintains an internet website, a website address; 268
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 12 (ens\tb)

(b) Disclose and deliver the required information free 269
of charge within forty-five (45) days of receiving a verifiable 270
request from the consumer. The time period to provide the 271
required information may be extended once by an additional 272
forty-five (45) days when reasonably necessary, provided the 273
consumer is provided notice of the extension within the first 274
forty-five-day period; 275
(c) Provide a clear and conspicuous link on the 276
business's internet homepage, titled "Do Not Sell My Personal 277
Information," to an internet web page that enables a consumer, or 278
a person authorized by the consumer, to opt out of the sale of the 279
consumer's personal information. A business shall not require a 280
consumer to create an account in order to direct the business not 281
to sell the consumer's personal information; 282
(d) Include a description of a consumer's rights along 283
with a separate link to the "Do Not Sell My Personal Information" 284
internet web page in its online privacy policy or policies if the 285
business has an online privacy policy or policies or any 286
Mississippi-specific description of consumers' privacy rights; 287
(e) Ensure that all individuals responsible for 288
handling consumer inquiries about the business's privacy practices 289
are informed of all requirements in this act and how to direct 290
consumers to exercise their rights. 291
(2) Nothing in this section shall be construed to require a 292
business to include the required links and text on the homepage 293
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 13 (ens\tb)

that the business makes available to the public generally, if the 294
business maintains a separate and additional homepage that is 295
dedicated to Mississippi consumers and that includes the required 296
links and text, and the business takes reasonable steps to ensure 297
that Mississippi consumers are directed to the homepage for 298
Mississippi consumers and not the homepage made available to the 299
public generally. 300
SECTION 11. The obligations imposed on businesses by the 301
above sections shall not restrict a business's ability to: 302
(a) Comply with federal, state, or local laws; 303
(b) Comply with a civil, criminal, or regulatory 304
inquiry, investigation, subpoena, or summons by federal, state, or 305
local authorities; 306
(c) Cooperate with law enforcement agencies concerning 307
conduct or activity that the business, service provider, or third 308
party reasonably and in good faith believes may violate federal, 309
state, or local law; 310
(d) Exercise or defend legal claims; 311
(e) Collect, use, retain, sell, or disclose consumer 312
information that is deidentified or in the aggregate consumer 313
information; and 314
(f) Collect or sell a consumer's personal information 315
if every aspect of that commercial conduct takes place wholly 316
outside of Mississippi. For purposes of this act, commercial 317
conduct takes place wholly outside of Mississippi if the business 318
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 14 (ens\tb)

collected that information while the consumer was outside of 319
Mississippi, no part of the sale of the consumer's personal 320
information occurred in Mississippi, and no personal information 321
collected while the consumer was in Mississippi is sold. This 322
paragraph shall not permit a business from storing, including on a 323
device, personal information about a consumer when the consumer is 324
in Mississippi and then collecting that personal information when 325
the consumer and stored personal information is outside of 326
Mississippi. 327
SECTION 12. (1) (a) Any consumer whose nonencrypted or 328
nonredacted personal information is subject to an unauthorized 329
access and exfiltration, theft, or disclosure as a result of the 330
business' violation of the duty to implement and maintain 331
reasonable security procedures and practices appropriate to the 332
nature of the information to protect the personal information may 333
institute a civil action for any of the following: 334
(i) To recover damages in an amount not less than 335
One Hundred Dollars ($100.00) and not greater than Seven Hundred 336
Fifty Dollars ($750.00) per consumer per incident or actual 337
damages, whichever is greater; 338
(ii) Injunctive or declaratory relief; or 339
(iii) Any other relief the court deems proper. 340
(b) In assessing the amount of statutory damages, the 341
court shall consider any one or more of the relevant circumstances 342
presented by any of the parties to the case, including, but not 343
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 15 (ens\tb)

limited to, the nature and seriousness of the misconduct, the 344
number of violations, the persistence of the misconduct, the 345
length of time over which the misconduct occurred, the willfulness 346
of the defendant's misconduct, and the defendant's assets, 347
liabilities, and net worth. 348
(2) Actions pursuant to this section may be brought by a 349
consumer if all of the following requirements are met: 350
(a) Prior to initiating any action against a business 351
for statutory damages on an individual or class-wide basis, a 352
consumer shall provide a business thirty (30) days' written notice 353
identifying the specific provisions of this act the consumer 354
alleges have been or are being violated, but no notice shall be 355
required prior to an individual consumer initiating an action 356
solely for actual pecuniary damages suffered as a result of the 357
alleged violations of this act; and 358
(b) If a business continues to violate this act in 359
breach of the express written statement provided to the consumer 360
under this section, the consumer may initiate an action against 361
the business to enforce the written statement and may pursue 362
statutory damages for each breach of the express written 363
statement, as well as any other violation of the title that 364
postdates the written statement. 365
(3) In the event a cure is possible, if within the thirty 366
(30) days the business actually cures the noticed violation and 367
provides the consumer an express written statement that the 368
S. B. No. 2015 *SS36/R408* ~ OFFICIAL ~
26/SS36/R408
PAGE 16 (ens\tb)
ST: Mississippi Consumer Data Privacy Act;
enact.
violations have been cured and that no further violations shall 369
occur, no action for individual statutory damages or class-wide 370
statutory damages may be initiated against the business. 371
(4) A business shall be in violation of this act if it fails 372
to cure any alleged violation within thirty (30) days after being 373
notified of the alleged noncompliance. Any business, service 374
provider, or other person that violates this act shall be liable 375
for a civil penalty in a civil action brought in the name of the 376
people of Mississippi by the Attorney General of up to Seven 377
Thousand Five Hundred Dollars ($7,500.00) for each violation. 378
SECTION 13. Any business or third party may seek the opinion 379
of the Attorney General for guidance on how to comply with the 380
provisions of this act. 381
SECTION 14. This is a matter of statewide concern and this 382
act supersedes and preempts all rules, regulations, codes, 383
ordinances, and other laws adopted by a city, county, city and 384
county, municipality, or local agency regarding the collection and 385
sale of consumers' personal information by a business. 386
SECTION 15. Before September 1, 2026, the Attorney General 387
shall solicit broad public participation to adopt regulations to 388
further the purposes of this act. 389
SECTION 16. This act shall take effect and be in force from 390
and after July 1, 2026. 391