Read the full stored bill text
26.303.21 101st Legislative Session 1309
2026 South Dakota Legislature
House Bill 1309
Introduced by: Representative Shubeck
Underscores indicate new language.
Overstrikes indicate deleted language.
An Act to restrict the processing of online personal data of individuals sixteen years 1
of age or younger. 2
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF SOUTH DAKOTA: 3
Section 1. That a NEW SECTION be added to a NEW CHAPTER in title 26: 4
Terms used in this chapter mean: 5
(1) "Covered user," a user of a mobile application, online application, online service, 6
or website in the state who is: 7
(a) Actually known by the operator of the application, service, or website to be 8
sixteen years of age or younger; or 9
(b) A user of an application, service, or website targeted to individuals sixteen 10
years of age or younger; 11
(2) "Operator," a person who operates a mobile application, online application, online 12
service, or website on the internet, and: 13
(a) Collects or maintains, either directly or through another person, personal 14
data from or about a user of the application, service, or website; 15
(b) Integrates with another application, service, or website and directly collects 16
personal data from a user of that application, service, or website; 17
(c) Allows another person to collect personal data directly from a user of the 18
application, service, or website; or 19
(d) Allows a user of the application, service, or website to publicly disclose the 20
user's personal data; 21
(3) "Personal data," any information that identifies or could reasonably be linked with 22
a specific individual, including an individual's: 23
(a) First and last name; 24
(b) Home or other physical address; 25
(c) Email address; 26
26.303.21 2 1309
Underscores indicate new language.
Overstrikes indicate deleted language.
(d) Telephone number 1
(e) Social Security number; and 2
(f) Information generated from the measurement or technological processing 3
of the individual's biological, physical, or physiological characteristics; and 4
(4) "Processing," the access, analysis, creation, collection, de -identification, deletion 5
derivation, destruction, disclosure, disposal, generation, licensing, modification, 6
monetization, organization, recording, retention, sale, sharing, storage, 7
structuring, transmission, or use of personal data, or any other operation or set of 8
operations performed on personal data. 9
Section 2. That a NEW SECTION be added to a NEW CHAPTER in title 26: 10
Except as provided for in section 3 of this Act, an operator may not process, or 11
allow a third party to process, the personal data of a covered user collected through the 12
use of a mobile application, online application, online service, or website, unless: 13
(1) The covered user is twelve years of age or younger and the processing is permitted 14
under 15 U.S.C. § 6502 (January 6, 2025) and its implementing regulations; 15
(2) The covered user is at least thirteen years of age but under the age of sixteen and 16
consent for the processing is obtained from the covered user's parent or legal 17
guardian; or 18
(3) The processing is strictly necessary for an activity set forth in section 3 of this Act. 19
Section 3. That a NEW SECTION be added to a NEW CHAPTER in title 26: 20
The processing of personal data of a covered user is permissible if the processing 21
is strictly necessary to: 22
(1) Provide or maintain a specific product or service requested by the covered user; 23
(2) Conduct the operator's internal business operations, if the operations do not 24
include any activities related to marketing, targeted advertising, or providing 25
products or services to a third party, or prompting covered users to use the mobile 26
application, online application, online service, or website when it is not in use; 27
(3) Identify and repair a technical error that impairs existing or intended functionality; 28
(4) Protect against malicious, fraudulent, or illegal activity; 29
(5) Investigate, establish, exercise, prepare for, or defend a legal claim; 30
(6) Comply with federal, state, or local laws, rules, or regulations; 31
(7) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or 32
summons by a federal, state, local, or other governmental authority; or 33
26.303.21 3 1309
Underscores indicate new language.
Overstrikes indicate deleted language.
(8) Detect, respond to, or prevent a security incident or threat. 1
Section 4. That a NEW SECTION be added to a NEW CHAPTER in title 26: 2
Within fourteen days of determining a user is a covered user, an operator shall: 3
(1) Destroy, or delete all personal data of the covered user, unless processing the 4
personal data is permitted under section 2 of this Act; and 5
(2) Notify any third party to whom the personal data was disclosed, and any third party 6
the operator allowed to process the personal data, that the user is a covered user. 7
Section 5. That a NEW SECTION be added to a NEW CHAPTER in title 26: 8
Whenever it appears to the attorney general, either upon complaint or otherwise, 9
that any person, within or outside the state, has violated the provisions of this chapter, 10
the attorney general may: 11
(1) Bring a civil action in the name and on behalf of the state to enjoin and restrain 12
the continuation of the violation; or 13
(2) Impose a civil penalty against the person in an amount not exceeding five thousand 14
dollars for each violation. The attorney general shall forward any civil penalty 15
collected under this section to the state treasurer, for deposit in the general fund. 16
The attorney general shall provide written notice of any alleged violation of this 17
chapter to the operator at least sixty days before initiating any action pursuant to this 18
section. If the operator fails to cure the violation within sixty days of receipt of the notice, 19
the attorney general may bring an action pursuant to this section. 20
The provisions of this chapter are enforceable solely by the attorney general. 21
Nothing in this chapter may be construed to create a private right of action. 22