The bill defines “covered information” broadly to include personal data such as a consumer’s name, address, social security number, medical records, and financial information. However, the bill’s restrictions and requirements are principally focused on the use and disclosure of such information for advertising or marketing purposes, and generally would not apply to uses and disclosures of information collected for conducting a “transaction” or “operation” at the request of or under an agreement with the individual.
Although the bill requires the consumer’s consent before a company can collect, use, or disclose the consumer’s information, it generally assumes consent unless the consumer opts out. This means that if the individual consumer either affirmatively agrees to the use of their information or does not respond either way, then the company may use their information. Companies will only be prevented from using an individual consumer’s information if the consumer actively denies consent. This “opt out” consent does not apply in three situations. First, a company must get affirmative consent before collecting or disclosing sensitive information about the consumer. Sensitive information includes a consumer’s medical records, financial information, location, race, religion, or sexual orientation. Second, a company may not release any of the consumer’s data to another company without express consent. Third, and finally, a company cannot collect or disclose all or substantially all of a consumer’s online activity without express consent.
Under the proposed legislation, the Federal Trade Commission (FTC) would be responsible for enforcing the bill. The FTC would have the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. § 41 et seq.) were incorporated into the bill. The FTC would also be able to make rules as needed to carry out the bill. State attorneys general would also be able to enforce the bill through civil actions in federal court, subject to the intervention of the FTC. However, there would be no private right of action to enforce the bill.