Technology (Data Privacy)

Department of Education; assessment; certified student support agencies; report. Requires the Department of Education (the Department) to assess the impact of developing a program to provide student support programs to students enrolled in a public elementary or secondary school through certified student support agencies, as defined in the bill. The bill requires the Department, in conducting such assessment, to consider (i) a framework by which a certified student support agency would enter into a memorandum of understanding with a school board for the purpose of providing student support programs, as defined in the bill, and suggested components of such memorandums of understanding, such as (a) documentation establishing the organization's nonprofit status, (b) a description of each student support program that such organization provides, (c) policies and procedures relating to privacy, background checks, mandated reporting, and the transmission, collection, use, and disposal of student personal information, and (d) consent forms and procedures to be used by such student support programs to obtain the necessary consent from the parent of any student under 18 years of age; (ii) the feasibility of establishing and administering a certification process for certified student support agencies; (iii) potential compliance monitoring and enforcement mechanisms and subsequent penalties for noncompliance to ensure that each certified student support agency complies with such program; (iv) policies and procedures for the secure disposal of a student's personal information upon such student's withdrawal from a student support program, upon the cessation of any such program, or upon such student's graduation or transfer from the school division; and (v) cost estimates, including staffing needs, for the development and implementation of such program. The bill requires the Department to submit a report on its findings to the Chairs of the Senate Committees on Finance and Appropriations and Education and Health and the House Committees on Appropriations and Education no later than November 1, 2026. This bill is identical to SB 190.

Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data. Provides that, under the Consumer Data Protection Act, no consumer, controller, processor, or affiliate of the controller or processor shall process biometric data, defined separately in the bill, concerning an individual without obtaining the individual's consent, or, in the case of the processing of biometric data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act.

Consumer Data Protection Act; online device pricing; prohibition. Provides that no controller or processor shall, in connection with a consumer transaction, generate, in whole or in part, a price offered to a consumer through the consumer's online device based on (i) the hardware or hardware state of the online device, as those terms are defined in the bill, (ii) the presence or absence of any software on the online device, or (iii) precise geolocation data of the online device when used to set a price based on inferences about the consumer made from such data. The bill provides for exemptions in certain instances.

Consumer Data Protection Act; social media platforms and operators; interoperability interfaces. Requires social media platforms and operators, defined in the bill, to implement third-party interoperability interfaces to allow users to share social graph data, defined in the bill, and contextual data associated with artificial intelligence systems, defined in the bill, as the user designates. The bill has a delayed effective date of July 1, 2027.