Consumer Protection

Plain English Breakdown

The bill summary does not provide specific details on enforcement mechanisms.

Consumer Data Protection Act

This bill allows consumers to designate someone else to manage their personal data privacy settings and requires companies to make it easier for people to opt out of having their data used for advertising or sold.

What This Bill Does

• Allows a consumer to choose another person, like a friend or family member, to act on behalf of the consumer when managing personal data privacy settings.
• Requires companies that handle personal information to follow requests from authorized agents if they can confirm who the agent is representing and their authority.
• Mandates clear links on company websites for consumers to opt out of targeted advertising or having their data sold.
• By January 1, 2026, allows consumers to use technology that meets certain standards to opt out of data processing without needing a website link.
• Requires companies to inform consumers if opting out affects any loyalty programs or discounts and to show terms for financial incentives related to personal data.

Who It Names or Affects

• Consumers who want more control over their personal data privacy settings.
• Companies that process consumer data, such as tech firms and advertisers.
• Authorized agents chosen by consumers to manage their data privacy on their behalf.

Terms To Know

Controller

A company or organization that decides how personal information is used and processed.

Opt-out preference signal

A method, like a technology tool, that allows consumers to indicate they do not want their data used for targeted advertising or sold.

Limits and Unknowns

• The bill does not specify what happens if a company cannot verify the identity of an authorized agent.
• It is unclear how companies will implement these changes by the January 1, 2026 deadline.
• The effectiveness and enforcement mechanisms are not detailed in the summary.

Official Summary Text

CONSUMER RIGHTS

Present law authorizes a consumer to
invoke
certain
consumer rights

at any time by submitting a request to a controller specifying the consumer rights the consumer wishes t
o invoke.
A "controller" is
the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information
.
A known child's parent or legal guardian may invoke the
child's
consumer
rights.
A controlle
r
must
comply with an authenticated consumer request to exercise
certain rights, including opting
out of a controller's processing of personal information for purposes of (i)
s
elling personal information about the consumer; (ii)
t
argeted advertising; or (i
ii)
p
rofiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

DESIGNATED AGENT

This bill authorizes a
consumer
to
designate another person to serve as the consumer's authorized agent and act on th
e consumer's behalf to opt out of the processing of the consumer's personal data
for the purposes of
(i)
s
elling personal information about the consumer;

(ii)
t
argeted advertising; or

(iii)
p
rofiling in furtherance of decisions that produce legal or simila
rly significant effects concerning the consumer.

The consumer may designate an authorized agent using a technology, including a link to an internet website, an internet browser setting or extension, or a global setting on an electronic device, that allows
the consumer to indicate the consumer's intent to opt out of such processing.
A
controller
must
comply with an opt-out request received from an authorized agent if the controller is able to verify, with commercially reasonable effort, the identity of the
consumer and the authorized agent's authority to act on the consumer's behalf.

OPT-OUT METHODS

This bill requires opt-out methods
to
provide a clear and conspicuous link on the controller's internet website to an internet web page that enables a consum
er, or a consumer's authorized agent, to opt out of the targeted advertising or sale of the consumer's personal data.

On or before January 1, 2026, this bill authorizes a consumer to opt out of any processing of the consumer's personal data for the purpo
ses of targeted advertising, or any sale of such personal data through an opt-out preference signal sent with the consumer's consent, to the controller by a platform, technology, or mechanism that meets all of the following requirements:



Must not unfairly disadvantage another controller
.



Must not make use of a default setting, but must require the consumer to make an affirmative, freely given, and unambiguous choice to indicate the consumer's intent to opt out of any processing of a consumer's personal data
.



Must be consumer-friendly and easy to use by the average consumer
.



Must be consistent with any federal or state law or rule
.



Must allow the controller to accurately determine whether the consumer is a resident of this state and whether the consumer has made a legitimate request to opt out of any sale of a consumer's personal data or targeted advertising.

INCENTIVE DISCLOSURES

If a consumer's decision to opt out of any personal data processing for the purposes of targeted advertising, or any sale o
f personal data, conflicts with the consumer's existing controller-specific privacy setting or voluntary participation in a controller's bona fide loyalty, rewards, premium features, discounts, or club card program, then
this bill requires
the controller
t
o
comply with the consumer's opt-out preference signal but may notify the consumer of the conflict and provide the choice to confirm controller-specific privacy settings or participation in such a program.

If a controller responds to consumer opt-out requ
ests by informing the consumer of a charge for the use of any product or service, then the controller
must
present the terms of any financial incentive offered for the retention, use, sale, or sharing of the consumer's personal data.

Current Bill Text

SENATE BILL 663
By Campbell

HOUSE BILL 630
By Clemmons

HB0630
001991
- 1 -

AN ACT to amend Tennessee Code Annotated, Title 47,
Chapter 18, relative to consumer data.

BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF TENNESSEE:
SECTION 1. Tennessee Code Annotated, Section 47-18-3304, is amended by adding
the following new subsection:
(d)
(1) A consumer may designate another person to serve as the
consumer's authorized agent and act on the consumer's behalf to opt out of the
processing of the consumer's personal data under subdivisions (a)(2)(E)(i)-(iii).
The consumer may designate an authorized agent using a technology, including
a link to an internet website, an internet browser setting or extension, or a global
setting on an electronic device, that allows the consumer to indicate the
consumer's intent to opt out of such processing.
(2) A controller shall comply with an opt-out request received from an
authorized agent under this subsection (d) if the controller is able to verify, with
commercially reasonable effort, the identity of the consumer and the authorized
agent's authority to act on the consumer's behalf.
(3) Opt-out methods must:
(A) Provide a clear and conspicuous link on the controller's
internet website to an internet web page that enables a consumer, or a
consumer's authorized agent, to opt out of the targeted advertising or sale
of the consumer's personal data; and

- 2 - 001991

(B) On or before January 1, 2026, allow a consumer to opt out of
any processing of the consumer's personal data for the purposes of
targeted advertising, or any sale of such personal data through an opt-out
preference signal sent with the consumer's consent, to the controller by a
platform, technology, or mechanism that:
(i) Must not unfairly disadvantage another controller;
(ii) Must not make use of a default setting, but must
require the consumer to make an affirmative, freely given, and
unambiguous choice to indicate the consumer's intent to opt out of
any processing of a consumer's personal data;
(iii) Must be consumer-friendly and easy to use by the
average consumer;
(iv) Must be consistent with any federal or state law or
rule; and
(v) Must allow the controller to accurately determine
whether the consumer is a resident of this state and whether the
consumer has made a legitimate request to opt out of any sale of
a consumer's personal data or targeted advertising.
(4)
(A) If a consumer's decision to opt out of any processing of the
consumer's personal data for the purposes of targeted advertising, or any
sale of personal data, through an opt-out preference signal sent in
accordance with subdivision (d)(3) conflicts with the consumer's existing
controller-specific privacy setting or voluntary participation in a controller's
bona fide loyalty, rewards, premium features, discounts, or club card

- 3 - 001991

program, then the controller shall comply with the consumer's opt-out
preference signal but may notify the consumer of the conflict and provide
the choice to confirm controller-specific privacy settings or participation in
such a program.
(B) If a controller responds to consumer opt-out requests received
in accordance with subdivision (d)(3) by informing the consumer of a
charge for the use of any product or service, then the controller shall
present the terms of any financial incentive offered pursuant to
subdivision (d)(3) for the retention, use, sale, or sharing of the consumer's
personal data.
SECTION 2. This act takes effect July 1, 2025, the public welfare requiring it.