Georgia General Assembly · Full text

SB 495: "Age-Appropriate Design Code Act"; enact

Introduced version, the latest LegiScan holds · Last action February 12, 2026 · Introduced

The text as LegiScan holds it, read from the PDF the legislature publishes with its margin line numbers, running heads, and page footers removed. Line breaks are joined into paragraphs here; no word is changed.

Underlined words are what the bill adds to current law and struck-through words are what it removes, as the printed bill shows them.

Copy for LLM, View as markdown, and Send to AI use the Markdown version: this text, then the summaries under a heading that names them as ours. View raw is the text alone.

Back to the summary

Senate Bill 495

By: Senators Harrell of the 40th, Still of the 48th, Setzler of the 37th, Hatchett of the 50th, Harbin of the 16th and others

A BILL TO BE ENTITLED

AN ACT

To amend Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other trade practices, so as to enact the "Age-Appropriate Design Code Act"; to provide restrictions on high-risk data practices relating to minors; to provide for requirements on covered entities; to prohibit certain high-risk data practices or design features relating to minors; to provide for enforcement by the Attorney General; to provide for rules and regulations; to require such rules and regulations to be updated biennially; to provide for risk assessments prior to certain design changes; to require documentation and retention of such risk assessments; to require independent auditing of risk assessments; to require certain default settings; to require that algorithmic feeds provided to minors meet certain criteria; to require the ability for a minor to request the deletion of any personal data held by covered entities; to require covered entities to provide public notice of privacy information, terms of service, and community standards; to provide for enforcement of this article under the "Fair Business Practices Act"; to provide for penalties; to provide for exclusions; to provide for statutory construction; to provide for definitions; to provide for effective dates; to provide for related matters; to repeal conflicting laws; and for other purposes.

BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:

SECTION 1.

Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other trade practices, is amended by adding a new article to read as follows: "ARTICLE 38

10-1-970.

This article shall be known and may be cited as the 'Age-Appropriate Design Code Act.'

10-1-971.

As used in this article, the term:

(1) 'Adult' means a consumer who is not a minor.

(2) 'Affiliate' means a legal entity that controls, is controlled by, is under common control with, or shares common branding with another legal entity. As used in this paragraph, the term 'control' or 'controlled' means ownership of, or the power to vote on, more than 50 percent of the outstanding shares of any class of voting securities of a covered entity, control in any manner over the election of a majority of the directors or of individuals exercising similar functions, or the power to exercise a controlling influence over the management of a covered entity.

(3) 'Age status' means one of the following age categories:

(A) Zero to five years of age, or preliterate and early literacy;

(B) Six to nine years of age, or core primary school years;

(D) Thirteen to 15 years of age, or early teens; and

(E) Sixteen and 17 years or age, or approaching adulthood.

(4) 'Algorithmic feed' means a component of an online service, product, or feature that displays or delivers a stream or list of media that is selected, ranked, or arranged in whole or in part by an algorithmic recommendation system.

(5) 'Algorithmic recommendation system' means a computational process used to determine the selection, order, rank, relative prioritization, or relative prominence of media provided to a consumer through an online service, product, or feature, including search results, ranking, recommendations, display, or any other method of automated selection. Such term shall not include a computational process which:

(A) Enables consumers to find specific other consumers on a covered entity's online service, product, or feature, such as by entering an individual's information as a search query or uploading a list of contacts;

(B) Returns media responsive to a consumer's search query, so long as the system does not process other personal data of the consumer to determine the selection, order, rank, relative prioritization, or relative prominence of the media; or

(6) 'Biometric data' means data generated from the technological processing of a person's unique biological, physical, or physiological characteristics that allow or confirm the unique identification of the consumer.

(7) 'Collect' means buying, renting, gathering, obtaining, receiving, or accessing any personal data pertaining to a consumer by any means. This includes receiving data from the consumer, either actively or passively, or by observing the consumer's behavior.

(8) 'Compulsive use' means a pattern of repetitive use of a covered entity's product or service that is engrossing and irresistible for a consumer and that materially disrupts the daily life of a consumer.

(9) 'Consumer' means a natural person residing in this state. Such term shall not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the covered entity occur solely within the context of the individual's role with the company, partnership, sole proprietorship, nonprofit, or government agency.

(10) 'Covered entity' means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that conducts business in this state and is organized or operated for the profit or financial benefit of its shareholders or other owners and which:

(A) Generates a majority of its annual revenue from online services, products, or features;

(B) Operates or develops online products, services, or features which are reasonably likely to be accessed by a minor; and

(C) Collects consumers' personal data or has consumers' personal data collected on its behalf by a processor and determines, jointly or solely, the purpose and means of the processing of consumers' personal data.

(11) 'Default' means a preselected option adopted by the covered entity for its online service, product, or feature.

(12) 'De-identified data' means information that does not identify and cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or to a device linked to such individual, or linked to one or more identifiable individuals in a household, provided that the covered entity possessing the data:

(A) Takes reasonable measures to ensure that the data cannot be associated with a natural person, including the de-identification requirements set forth in 45 C.F.R. Section 164.514;

(B) Publicly commits to maintain and use the data only in a de-identified fashion and not attempt to re-identify the data; and

(13) 'Derived data' means data created by the derivation of information, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or other sources of information or data about a minor or a minor's device. (14)(A) 'Design' or 'design feature' means any aspect of an online service, product, or feature that a covered entity develops or creates, in whole or in part, to facilitate use of the online service, product, or feature. Such term shall include, in whole or in part, any:

(i) Algorithmic recommendation system;

(ii) Algorithmic feed;

(iii) Consumer interface;

(iv) Notification or push alert system;

(v) Processing of personal data; and

(vi) Reward or incentive system.

(B) Such term shall not include any:

(i) Media generated by a consumer;

(ii) Content moderation policy; or

(iii) Component of an algorithmic recommendation system that enforces the covered entity's content moderation policies.

(15) 'Direct messaging' means sending a private single or group message to one or more other consumers that is separate from public posts.

(16) 'Genetic data' means any data, regardless of its format, that results from the analysis of a biological sample of a person, or from another source enabling equivalent information to be obtained, and includes genetic material, including deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), epigenetic markers, uninterpreted data that result from analysis of a biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

(17) 'Media' means any text, image, video, or audio recording.

(18) 'Minor' means a consumer who a covered entity knows or should reasonably know is under the age of 18 years.

(19) 'Online service, product, or feature' means a digital product that is accessible to the public via the internet, including a website or mobile application. For the purpose of this paragraph, the following are not included:

(A) Telecommunications service, as defined in 47 U.S.C. Section 153;

(B) A broadband service, as defined in 47 C.F.R. Section 54.400; or

(20) 'Personal data' means any information, including derived data and unique identifiers, that is linked or could reasonably be linked, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies or is linked to one or more identifiable individuals in a household. Such term shall not include de-identified data or publicly available information.

(21) 'Process' or 'processing' means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, modification, or other handling of personal data.

(22) 'Processor' means a person who processes personal data on behalf of a covered entity, another processor, or a federal, state, tribal, or local government entity. (23)(A) 'Publicly available information' means information that:

(i) Is made available through federal, state, or local government records or to the general public from widely distributed media; or

(ii) A covered entity has a reasonable basis to believe the consumer has lawfully made available to the general public.

(B) Such term shall not include:

(i) Biometric data collected by an entity about a consumer without the consumer's knowledge or consent;

(ii) Information collated and combined to create a consumer profile that is made available to a consumer of a publicly available website, either in exchange for payment or free of charge;

(iii) Information made available for sale;

(iv) An inference generated from the information described in subparagraph (A) of this paragraph;

(v) Any obscene visual depiction, as defined in 18 U.S.C. Section 1460;

(vi) Personal data created through the combination of personal data with publicly available information;

(vii) Genetic data, unless otherwise made publicly available by the consumer to whom the information pertains;

(viii) Information provided by a consumer on a website or online service made available to all members of the public, for free or for a fee, where the consumer has maintained a reasonable expectation of privacy in the information, such as by restricting the information to a specific audience; or

(ix) Intimate images, whether authentic or computer generated, known or reasonably believed to be nonconsensual.

(24) 'Reasonable alternative design' means an alternative design feature for which the risk of causing compulsive use in consumers who are minors is lowered.

(25) 'Reasonably likely to be accessed' means an online service, product, or feature that is reasonably believed to be accessed by a minor based on any of the following indicators:

(A) The online service, product, or feature is directed to children, as defined by the Children's Online Privacy Protection Act, 15 U.S.C. Section 6501, et seq., and the Federal Trade Commission's rules implementing such act;

(B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by an audience that is composed of at least 2 percent minors; or

(C) The covered entity knew or should have reasonably known that at least 2 percent of the audience of the online service, product, or feature is composed of minors, provided that, in making this assessment, the covered entity shall not collect or process any personal data that are not reasonably necessary to provide an online service, product, or feature with which a minor is actively and knowingly engaged.

(26) 'Third party' means a person, public authority, agency, or body that is not a minor or a covered entity.

10-1-972.

(a) A covered entity shall not engage in or use any of the following high-risk data practices or design features:

(1) Collect, sell, share, or retain any personal data of a consumer that is not necessary to provide an online service, product, or feature with which a consumer is actively and knowingly engaged;

(2) Use previously collected personal data of a consumer for any purpose other than a purpose for which the personal data was collected, unless necessary to comply with any obligation under this article;

(3) Permit any person, including a parent or guardian, to monitor the online activity of a consumer or to track the location of a consumer without providing a conspicuous signal to the consumer when the consumer is being monitored or tracked;

(4) Use the personal data of the consumer to select, recommend, or prioritize media for the consumer in an algorithmic feed, unless the consumer has explicitly requested to receive media from a specific account, specific category, or related media;

(5) Use the personal data of the consumer to select, recommend, or prioritize media for the consumer in an algorithmic feed, unless the personal data are:

(A) Consumer selected privacy or accessibility settings;

(B) The consumer's location, but only to determine whether the consumer is within this state for purposes of complying with this Code section;

(C) The consumer's age status, but only to implement the covered entity's policies regarding media appropriate for minors; or

(D) A search query, provided the search query is used only to select and prioritize media in response to the search;

(6) Send push notifications to the consumer between the hours of 12:00 Midnight and 6:00 A.M.; or

(7) Use any design feature or component of a design feature that:

(A) Automatically plays a video, unless the video is the next in a series and the consumer chose to play a prior video in the series;

(B) Uses intermittent, variable reward schedules;

(C) Continuously and seamlessly loads new media in an algorithmic feed and absent a specific request from the consumer, such as an infinite scroll feed;

(D) Is intended to cause compulsive use; or

(E) Has been identified and declared by the Attorney General as a prohibited data practice or design feature pursuant to subsection (c) of this Code section.

(b) A covered entity may engage in any of the high-risk data practices or design features listed in subsection (a) of this Code section if:

(1) The consumer explicitly requests the practice or feature; and

(2) The covered entity has used a commercially reasonable and technically feasible age-assurance method to determine that the consumer is not a minor.

(c) The Attorney General shall adopt rules and regulations pursuant to this article that prohibit a covered entity from engaging in or using any data practices or design features that:

(1) Carry a risk of compulsive use that is not substantially outweighed by any benefits provided by the practice or feature to consumers; or

(2) Subvert or impair consumer autonomy, decision making, or choice while using the covered entity's online service, product, or feature.

(d) The Attorney General shall, at least once every two years, review and update the rules and regulations promulgated under subsection (c) of this Code Section to keep pace with emerging technology.

10-1-973.

(a) Prior to deploying any new design, or making a material change to an existing design that will be deployed to consumers, a covered entity shall assess the risk that the design will cause compulsive use in minors.

(b) For any design that carries a reasonably foreseeable risk of causing compulsive use in minors, a covered entity shall:

(1) Determine if there is a reasonable alternative design; and

(2) Provide the reasonable alternative design that carries the lowest risk of compulsive use as a default to each consumer, until:

(A) The consumer explicitly requests the original design; and

(B) The covered entity determines, using a commercially reasonable and technically feasible age-assurance method, that the consumer is not a minor.

(c) Notwithstanding subsection (b) of this Code section, a covered entity shall not deploy any design to consumers if its assessed risk of causing compulsive use to minors outweighs the assessed benefit of the design to minors, unless:

(1) The consumer explicitly requests the design; and

(2) The covered entity determines, using a commercially reasonable and technically feasible age-assurance method, that the consumer is not a minor.

(d) A covered entity shall assess all existing design and mitigate the risk of causing compulsive use in minors as described in this Code section.

(e) A covered entity shall document each step taken in accordance with subsections (a), (b), and (c) of this Code section, along with any experiments, evidence, and data that support the assessments and determinations made, and retain such documents for a period of ten years. All data collected about individual consumers to comply with this subsection shall be de-identified and made anonymous.

(f) A covered entity shall submit annually all records related to the assessments and determinations made in accordance with subsections (a), (b), and (c) of this Code section to an independent auditor who shall assess the records for compliance with this Code section and recommend any changes that would bolster compliance.

(g) Nothing in this Code section shall require a covered entity to:

(1) Assess any media for the risk of causing compulsive use; or

(2) Limit any consumer's access to any specific consumer generated content or category of consumer generated content.

(h) The provisions of this Code section shall not apply to a covered entity that qualifies as a small business. To qualify as a small business, a covered entity shall meet the following criteria for the three preceding calendar years, or for the covered entity's period of existence if the covered entity is less than three years old:

(1) The covered entity's average annual gross revenues during the three-year period did not exceed $25 million, as adjusted annually based on the Consumer Price Index as reported by the Bureau of Labor Statistics of the United States Department of Labor; and

(2) The covered entity, on average, did not annually collect, process, retain, or transfer the personal data of more than 50,000 people during the three-year period for any purpose other than initiating, rendering, billing for, finalizing, completing, or otherwise collecting payment for a requested service or product.

10-1-974.

(a) A covered entity shall configure all default privacy settings provided to a minor through its online service, product, or feature to the highest level of privacy.

(b) A covered entity shall provide the following settings by default to all minors:

(1) Do not use an algorithmic recommendation system to recommend to adult consumers that they connect to a minor as a friend, follower, or contact on an online service;

(2) Do not use an algorithmic recommendation system to recommend to adult consumers that they follow a minor's media, unless the minor's account was connected to the known adult's account as a friend, follower, or contact prior to the recommendation;

(3) Do not use an algorithmic recommendation system to recommend to adult consumers that they communicate with a minor through direct messaging, unless the minor's account was connected to the known adult's account as a friend, follower, or contact prior to the recommendation;

(4) Do not use an algorithmic recommendation system to recommend to minors that they communicate with a known adult through direct messaging, unless the minor's account was connected to the adult's account as a friend, follower, or contact prior to the recommendation;

(5) Do not display a minor's friends, followers, or contacts; and

(6) Disable search engine indexing of a minor's account profile and media.

(c) A covered entity shall not display the location of any minor to another consumer by default; provided, however, that a covered entity may display a minor's location to another consumer when the minor has explicitly chosen to share his or her location with a specific consumer.

(d) A covered entity shall not send push notifications to any minor by default or provide a single setting that enable all push notifications.

(e) A covered entity shall provide minors with settings to enable or disable each specific category of push notification offered by the covered entity's online service, product, or feature, such as marketing notifications, direct message notifications, media interaction notifications, and any other category of notification pushed by the product or service.

(f) A covered entity shall:

(1) Disable by default all interaction counts, including counts of reactions and comments, on all of a minor's media;

(2) Offer settings to minors to enable or disable specific types of interaction counts, such as comments, reactions, reshares, or other categories of interactions; and

(3) Offer to minors a single setting to enable all interaction counts at once only if the settings to enable specific interactions are equally or more prominent and accessible.

(g) A covered entity shall not undermine consumer autonomy in settings by:

(1) Providing a minor with a single setting that makes more than one default privacy setting less protective at once; or

(2) Requesting or prompting a minor to make any setting less protective, unless the change is strictly necessary for the minor to access a service, product, or feature explicitly requested by the minor.

(h)(1) A covered entity that facilitates communications between consumers shall provide a prominent, accessible, and responsive tool that gives minors the option to block specific consumers from taking, at minimum, each of the following actions:

(A) Accessing the minor's media;

(B) Interacting with the minor's media;

(D) Communicating with the minor through direct messaging; and

(E) Communicating with the minor through any other means offered by the covered entity through its product or service.

(2) The tool described in paragraph (1) of this subsection shall provide a minor with the option to prevent media from a blocked consumer from appearing in the minor's feed.

(3) The tool described in paragraph (1) of this subsection shall, at a minimum, be accessible from a feature located:

(A) Proximate to every instance of another consumer's username or avatar;

(B) On all media shared by another consumer;

(D) In a first-level settings menu labeled 'Blocked Users.'

(4) The features listed in subparagraphs (A), (B), and (C) of paragraph (3) of this subsection shall provide a minor with the ability to:

(A) Block the other consumer, which shall trigger all of the settings in paragraphs (1) and (2) of this subsection; or

(B) Go to the settings feature to select more granular block settings for the other consumer.

(i) A covered entity offering an algorithmic feed to a minor that uses the minor's personal data to select, recommend, or prioritize media in the feed shall provide a prominent and accessible interface that enables the minor to:

(1) Explicitly communicate preferences about the types of media to be recommended and to be blocked in the output of the relevant algorithmic recommendation system;

(2) Access, review, and make changes to any personal data the covered entity uses to determine the output of the relevant algorithmic recommendation system; and

(3) Ensure that the relevant algorithmic recommendation system is informed by these preferences.

(j) A covered entity offering an algorithmic feed to a minor that uses the minor's personal data to select, recommend, or prioritize media in the feed shall provide the minor with the choice of an algorithmic feed that only selects media from sources the minor affirmatively chose to follow or otherwise include in the feed.

(k)(1) A covered entity shall provide a prominent and accessible tool to allow:

(A) A minor to request that the covered entity delete any account profiles, media, and personal data provided by, or obtained about, the minor, including personal data the minor provided to the covered entity, personal data the controller obtained from another source, and derived data; and

(B) The parent or legal guardian of a minor to make such a request on the minor's behalf.

(2) A request made pursuant to this subsection shall be honored no later than 15 days after a covered entity receives the request.

10-1-975.

A covered entity shall prominently and clearly provide on its website or mobile application:

(1) The covered entity's privacy information, terms of service, policies, and community standards;

(2) The purpose of the feed and the algorithmic recommendation system used to determine the feed for each algorithmic feed in use by the covered entity;

(3) For each algorithmic recommendation system in use by the covered entity:

(A) The purpose of the system;

(B) A description of any personal data of minors that is used as an input or to inform an input;

(D) The purpose of using the personal data; and

(E) How each personal data input is measured and determined, if it is derived data and is weighed relative to the other inputs reported in this paragraph, and if it is categorized into one of four quartile groups according to the input's relative importance in contributing to the system's output; and

(4) For every other feature of the product or service that uses the personal data of minors, descriptions of:

(A) The purpose of the feature;

(B) The personal data collected by the feature;

(D) How the personal data are used by the feature;

(E) Any personal data transferred to or shared with a processor or third party by the feature, the identity of the processor or third party, and the purpose of the transfer or sharing; and

(F) How long personal data are retained.

10-1-976.

(a) During the process of conducting age assurance, covered entities and processors shall:

(1) Only collect personal data of a consumer that is strictly necessary for determining a consumer's age status;

(2) Immediately upon determining that a consumer is a minor, delete any personal data collected of such consumer for age assurance, except the determination of the consumer's age status;

(3) Not use any personal data of a consumer collected for age assurance for any other purpose;

(4) Not combine personal data of a consumer collected for age assurance, except the determination of the consumer's age status, with any other personal data of the consumer;

(5) Not disclose personal data of a consumer collected for age assurance to a third party that is not a processor; and

(6) Implement a review process to allow consumers to appeal age status determinations.

(b) A covered entity or processor that complies with all of the provisions of this article shall not be liable for any inaccuracies in a consumer's age status.

(1) Identifying commercially reasonable and technically feasible methods for covered entities and processors to determine if a consumer is a minor;

(2) Describing the appropriate review process for consumers appealing age status determinations;

(3) Describing transparency measures that would increase consumer trust in age-assurance methods; and

(4) Providing any additional privacy protections for personal data collected for age assurance.

(d) The Attorney General shall periodically review and update such rules and regulations as necessary to keep pace with emerging technology.

(e) In adopting such rules and regulations, the Attorney General shall:

(1) Prioritize consumer privacy and accessibility;

(2) Consider the size, financial resources, and technical capabilities of covered entities and processors;

(3) Consider the costs and effectiveness of available age-assurance methods;

(4) Consider the impact of age-assurance methods on consumers' safety, utility, and experience;

(5) Consider the efficacy of requiring covered entities and processors to use previously collected data to determine the age status of some or all consumers or adopting interoperable age assurance methods; and

(6) Provide consumers with multiple options for age assurance.

10-1-977.

(a) A violation of this article shall constitute an unfair or deceptive act or practice in the conduct of consumer transactions under Part 2 of Article 15 of this chapter, the 'Fair Business Practices Act of 1975,' and the enforcement against any such violation shall be by public enforcement by the Attorney General and shall be enforceable through private action.

(b) Whenever it may appear to the Attorney General that any covered entity is using or has used any method, act, or practice declared by this article to be unlawful and that proceedings would be in the public interest, the Attorney General may bring action in a court of competent jurisdiction. Upon a showing by the Attorney General that a covered entity has violated this article, the court may enter or grant any or all of the relief provided for in Code Section 10-1-397.

(c) Any person who suffers injury or damages as a result of a violation of this article may bring an action individually against the person or persons engaged in such violation under the rules of civil procedure to seek equitable injunctive relief and to recover his or her general and exemplary damages sustained as a consequence thereof in any court having jurisdiction over the defendant. Such relief may include:

(1) Restitution to any person or persons adversely affected by a defendant's actions in violation of this article;

(2) Punitive damages in an amount equal to $50,000.00 or three times the combined total of damages, costs, and fees, whichever is greater;

(3) Expenses of litigation, including reasonable attorney's fees; and

(4) Other relief as the court deems just and equitable.

(d) A covered entity that has violated a provision of this article shall be liable for damages of $5,000 per violation, as adjusted annually to reflect an increase in the Consumer Price Index, or actual damages, whichever is greater;

(e) Except as otherwise provided, this article is cumulative with other laws and is not exclusive.

10-1-978.

(a) Nothing in this article shall be interpreted or construed to:

(1) Impose liability in a manner that is inconsistent with 47 U.S.C. Section 230;

(2) Impose liability in a manner that is inconsistent with the First Amendment to the United States Constitution;

(3) Force any consumer to undergo age assurance as a condition of accessing the online services, products, or features of a covered entity;

(4) Prevent any consumer from accessing any consumer generated media; or

(5) Preempt or otherwise affect any right, claim, remedy, presumption, or defense available at law or in equity, including but not limited to antidiscrimination, consumer protection, labor, and civil rights laws.

10-1-979.

This article shall not apply to:

(1) Any federal, state, tribal, or local government entity in the ordinary course of its operation;

(2) Protected health information that a covered entity or its affiliate processes in accordance with the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996, P.L. 104-191, or documents that a covered entity or its affiliate creates for the purpose of complying with HIPAA;

(3) Information used only for public health activities and purposes described in 45 C.F.R. Section 164.512;

(4) Information that identifies a consumer with:

(A) Activities that are subject to the federal policy for the protection of human subjects as set forth in 45 C.F.R. Part 46;

(B) Research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;

(D) Research conducted in accordance with the requirements set forth in subparagraphs (A) through (C) of this paragraph or otherwise in accordance with state or federal law;

(5) Any entity whose primary purpose is journalism and has a majority of its workforce consisting of persons engaging in journalism; or

(6) Any financial institution subject to Title V of the federal Gramm-Leach-Bliley Act, P.L. 106-102, and regulations adopted to implement that act.

10-1-980.

A covered entity shall not discriminate or retaliate against any consumer, including denying products or services, charging different prices or rates for products or services, or providing lower quality products or services to the consumer, for receiving any of the protections contained in this chapter, for exercising any of the rights contained in this article, for refusing to change privacy and safety settings, or for refusing to agree to the collection or processing of personal data or to the use of any design feature."

SECTION 2.

It is the intent of the General Assembly that nothing in this article may be construed to infringe on the existing rights and freedoms of minors or be construed to discriminate against minors based on race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin.

SECTION 3.

This Act shall become effective upon its approval by the Governor or upon its becoming law without such approval for purposes of promulgating rules and regulations and shall become effective on January 1, 2027, for all other purposes.

SECTION 4.

All laws and parts of laws in conflict with this Act are repealed.