Technology (Consumer Data Protection)

Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data. Provides that, under the Consumer Data Protection Act, no consumer, controller, processor, or affiliate of the controller or processor shall process biometric data, defined separately in the bill, concerning an individual without obtaining the individual's consent, or, in the case of the processing of biometric data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act.

Consumer Data Protection Act; online device pricing; prohibition. Provides that no controller or processor shall, in connection with a consumer transaction, generate, in whole or in part, a price offered to a consumer through the consumer's online device based on (i) the hardware or hardware state of the online device, as those terms are defined in the bill, (ii) the presence or absence of any software on the online device, or (iii) precise geolocation data of the online device when used to set a price based on inferences about the consumer made from such data. The bill provides for exemptions in certain instances.

Consumer Data Protection Act; social media platforms and operators; interoperability interfaces. Requires social media platforms and operators, defined in the bill, to implement third-party interoperability interfaces to allow users to share social graph data, defined in the bill, and contextual data associated with artificial intelligence systems, defined in the bill, as the user designates. The bill has a delayed effective date of July 1, 2027.