Technology (Consumer Data Protection)

SB 663 allows Tennessee consumers to appoint an authorized agent (like a family member or professional) to manage their data privacy requests on their behalf, directly affecting consumers and businesses (controllers) that collect personal data. It requires businesses to honor opt-out requests from these agents if they can verify both the consumer's identity and the agent's authority. The bill mandates clear opt-out links on business websites and requires a standardized, user-friendly "opt-out preference signal" by January 2026, which must be an active choice by the consumer, not a default setting. This law takes effect July 1, 2025, applying to all Tennessee businesses handling consumer data.

HB 1132 extends the time businesses have to respond to verified consumer data requests under Tennessee's Information Protection Act, increasing the deadline from 45 to 50 days. This change directly affects businesses (referred to as "controllers" in the law) that handle personal data and consumers who submit authenticated requests for data access or correction. The bill amends specific sections of Tennessee law to implement this 5-day extension, which applies to all covered requests. The change will take effect on July 1, 2025, as specified in the bill.