CONSUMER INFO & DATA PROTECTION ACT

Added 26 new definitions including specific meanings for terms like 'affiliate', 'biometric data', 'consumer health data', 'dark pattern', 'geofence', 'precise geolocation data', 'sensitive data', and 'targeted advertising'.

Established new consumer rights including the right to confirm data processing, access data, correct inaccuracies, delete data, obtain portable copies, and opt out of targeted advertising, data sales, and profiling.

Added requirements for controllers to provide clear privacy notices, establish secure means for consumers to exercise rights, and respond to consumer requests within 45 days (with one 45-day extension allowed).

Created new protections for children under 18, including restrictions on targeted advertising, data sales, and profiling, plus requirements for parental consent and data protection assessments for services targeting minors.

Added new requirements for data protection assessments when processing data for targeted advertising, data sales, profiling, sensitive data, or activities posing heightened risk of harm to consumers.

Established new rules for processor-controller relationships, requiring written contracts that specify data processing instructions, confidentiality obligations, and compliance requirements.

Added specific protections for consumer health data, reproductive or sexual health data, and geofencing restrictions near mental health and reproductive health facilities.

Created new limitations on processing personal data for purposes not reasonably necessary or compatible with disclosed purposes, unless consumer consent is obtained.

Added requirements prohibiting discrimination against consumers who exercise their rights under the act, including prohibitions on denying goods or services or charging different prices.

Established new rules for de-identified and pseudonymous data, allowing controllers to avoid certain consumer rights obligations when data cannot be reasonably re-identified.

Added new provisions protecting data in federal agency possession, requiring consent before sharing sensitive data and allowing the attorney general to intervene in unauthorized disclosures.

Created new limitations section allowing certain processing activities that would otherwise violate the act, including compliance with federal laws, law enforcement cooperation, security incident response, and scientific research.

Added new provisions protecting free speech rights and exempting purely personal or household activities from the act's requirements.

Established new severability provisions ensuring that if any part of the act is found unconstitutional, the remaining provisions remain in force.

Empowered the attorney general to investigate violations and impose civil penalties of up to $10,000 per violation, with authority to seek injunctions and recover attorney fees.

Removed original formatting elements including page numbers, committee attribution, and original short title language, replacing them with the new comprehensive structure.