Technology (Consumer Data Protection)

HB 1309 restricts online services from collecting or using personal data of users under 16 years old in South Dakota. It requires operators (like apps or websites) to delete such data within 14 days of identifying a minor user, unless parental consent is obtained for 13- to 15-year-olds or the processing is strictly necessary for essential purposes like security, legal compliance, or providing requested services. The law bans data use for advertising, marketing, or third-party sharing without consent and allows the state Attorney General to enforce it through fines up to $5,000 per violation. This directly affects minors under 16 and online platforms targeting them or collecting their data within South Dakota.

SB 110 requires broadband internet providers in South Dakota to obtain explicit customer permission ("opt-in consent") before using, sharing, or selling most types of personal customer data, including location, health details, device identifiers, and financial information. It directly affects broadband service providers (like local internet companies) and their customers by mandating clear consent mechanisms that are easy to understand and use. Key provisions include prohibiting providers from charging higher prices or denying service based on a customer’s refusal to consent, and requiring that consent requests be conspicuous, non-misleading, and available at no extra cost. The law applies specifically to "broadband internet access service providers" as defined in the bill, covering data collected through the customer-provider relationship.

SB 111 requires social media companies operating in South Dakota to give users access to their collected personal data upon request and maintain transparent, publicly available technical standards (open protocols) that allow different social media platforms to share user data. It directly affects social media companies by mandating data access for users and requiring interoperability interfaces that are free from licensing fees or patent restrictions. Key provisions define "personal data" as information linked to an identifiable individual (excluding de-identified or public data) and specify that interoperability must enable data exchange between platforms via open protocols. The bill focuses on concrete policy changes: user data access and standardized data-sharing mechanisms, without specifying enforcement or penalties.

South Dakota's SB 49 requires direct-to-consumer genetic testing companies to protect consumers' genetic data and privacy. It mandates clear privacy policies, separate express consent for each data use (including research, marketing, or sharing with third parties), and security programs to prevent unauthorized access. Companies must also allow consumers to access, delete their data, or request destruction of biological samples within 30 days of revoking consent. This law directly affects South Dakota residents using these services and genetic testing companies operating in the state.