SB495: SB495 "Age-Appropriate Design Code Act"; enact

26 LC 64 0032 Senate Bill 495 By: Senators Harrell of the 40th, Still of the 48th, Setzler of the 37th, Hatchett of the 50th, Harbin of the 16th and others A BILL TO BE ENTITLED AN ACT To amend Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling1 and other trade practices, so as to enact the "Age-Appropriate Design Code Act"; to provide2 restrictions on high-risk data practices relating to minors; to provide for requirements on3 covered entities; to prohibit certain high-risk data practices or design features relating to4 minors; to provide for enforcement by the Attorney General; to provide for rules and5 regulations; to require such rules and regulations to be updated biennially; to provide for risk6 assessments prior to certain design changes; to require documentation and retention of such7 risk assessments; to require independent auditing of risk asses sments; to require certain8 default settings; to require that algorithmic feeds provided to minors meet certain criteria; to9 require the ability for a minor to request the deletion of any personal data held by covered10 entities; to require covered entities to provide public notice of privacy information, terms of11 service, and community standards; to provide for enforcement of this article under the "Fair12 Business Practices Act"; to provide for penalties; to provide f or exclusions; to provide for13 statutory construction; to provide for definitions; to provide for effective dates; to provide14 for related matters; to repeal conflicting laws; and for other purposes.15 BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:16 S. B. 495 - 1 - 26 LC 64 0032 SECTION 1.17 Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other18 trade practices, is amended by adding a new article to read as follows:19 "ARTICLE 3820 10-1-970.21 This article shall be known and may be cited as the 'Age-Appropriate Design Code Act.'22 10-1-971.23 As used in this article, the term:24 (1) 'Adult' means a consumer who is not a minor.25 (2) 'Affiliate' means a legal entity that controls, is control led by, is under common26 control with, or shares common branding with another legal enti ty. As used in this27 paragraph, the term 'control' or 'controlled' means ownership of, or the power to vote on,28 more than 50 percent of the outstanding shares of any class of voting securities of a29 covered entity, control in any manner over the election of a majority of the directors or30 of individuals exercising similar functions, or the power to ex ercise a controlling31 influence over the management of a covered entity.32 (3) 'Age status' means one of the following age categories:33 (A) Zero to five years of age, or preliterate and early literacy;34 (B) Six to nine years of age, or core primary school years;35 (C) Ten to 12 years of age, or transition years;36 (D) Thirteen to 15 years of age, or early teens; and37 (E) Sixteen and 17 years or age, or approaching adulthood.38 S. B. 495 - 2 - 26 LC 64 0032 (4) 'Algorithmic feed' means a component of an online service, product, or feature that39 displays or delivers a stream or list of media that is selected, ranked, or arranged in whole40 or in part by an algorithmic recommendation system.41 (5) 'Algorithmic recommendation system' means a computational process used to42 determine the selection, order, rank, relative prioritization, or relative prominence of43 media provided to a consumer through an online service, product, or feature, including44 search results, ranking, recommendations, display, or any other method of automated45 selection. Such term shall not include a computational process which:46 (A) Enables consumers to find specific other consumers on a covered entity's online47 service, product, or feature, such as by entering an individual's information as a search48 query or uploading a list of contacts;49 (B) Returns media responsive to a consumer's search query, so long as the system does50 not process other personal data of the consumer to determine the selection, order, rank,51 relative prioritization, or relative prominence of the media; or52 (C) Associates the search query with the consumer after search results are returned.53 (6) 'Biometric data' means data generated from the technological processing of a person's54 unique biological, physical, or physiological characteristics t hat allow or confirm the55 unique identification of the consumer.56 (7) 'Collect' means buying, renting, gathering, obtaining, rec eiving, or accessing any57 personal data pertaining to a consumer by any means. This includes receiving data from58 the consumer, either actively or passively, or by observing the consumer's behavior.59 (8) 'Compulsive use' means a pattern of repetitive use of a co vered entity's product or60 service that is engrossing and irresistible for a consumer and that materially disrupts the61 daily life of a consumer.62 (9) 'Consumer' means a natural person residing in this state. Such term shall not include63 an individual acting in a commercial or employment context or as an employee, owner,64 director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit,65 S. B. 495 - 3 - 26 LC 64 0032 or government agency whose communications or transactions with the covered entity66 occur solely within the context of the individual's role with t he company, partnership,67 sole proprietorship, nonprofit, or government agency.68 (10) 'Covered entity' means a sole proprietorship, partnership, limited liability company,69 corporation, association, or other legal entity that conducts b usiness in this state and is70 organized or operated for the profit or financial benefit of its shareholders or other owners71 and which: 72 (A) Generates a majority of its annual revenue from online ser vices, products, or73 features;74 (B) Operates or develops online products, services, or features which are reasonably75 likely to be accessed by a minor; and76 (C) Collects consumers' personal data or has consumers' personal data collected on its77 behalf by a processor and determines, jointly or solely, the purpose and means of the78 processing of consumers' personal data.79 (11) 'Default' means a preselected option adopted by the cover ed entity for its online80 service, product, or feature.81 (12) 'De-identified data' means information that does not identify and cannot reasonably82 be used to infer information about, or otherwise be linked to, an identified or identifiable83 individual, or to a device linked to such individual, or linked to one or more identifiable84 individuals in a household, provided that the covered entity possessing the data:85 (A) Takes reasonable measures to ensure that the data cannot b e associated with a86 natural person, including the de-identification requirements se t forth in 45 C.F.R.87 Section 164.514;88 (B) Publicly commits to maintain and use the data only in a de-identified fashion and89 not attempt to re-identify the data; and90 (C) Contractually obligates any recipients of the data to comply with all provisions of91 this article.92 S. B. 495 - 4 - 26 LC 64 0032 (13) 'Derived data' means data created by the derivation of in formation, assumptions,93 correlations, inferences, predictions, or conclusions from facts, evidence, or other sources94 of information or data about a minor or a minor's device.95 (14)(A) 'Design' or 'design feature' means any aspect of an online service, product, or96 feature that a covered entity develops or creates, in whole or in part, to facilitate use of97 the online service, product, or feature. Such term shall include, in whole or in part, any:98 (i) Algorithmic recommendation system;99 (ii) Algorithmic feed;100 (iii) Consumer interface;101 (iv) Notification or push alert system;102 (v) Processing of personal data; and103 (vi) Reward or incentive system.104 (B) Such term shall not include any:105 (i) Media generated by a consumer;106 (ii) Content moderation policy; or107 (iii) Component of an algorithmic recommendation system that enforces the covered108 entity's content moderation policies.109 (15) 'Direct messaging' means sending a private single or group message to one or more110 other consumers that is separate from public posts.111 (16) 'Genetic data' means any data, regardless of its format, that results from the analysis112 of a biological sample of a person, or from another source enab ling equivalent113 information to be obtained, and includes genetic material, incl uding deoxyribonucleic114 acids (DNA), ribonucleic acids (RNA), genes, chromosomes, allel es, genomes,115 alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs),116 epigenetic markers, uninterpreted data that result from analysis of a biological sample or117 other source, and any information extrapolated, derived, or inferred therefrom.118 (17) 'Media' means any text, image, video, or audio recording.119 S. B. 495 - 5 - 26 LC 64 0032 (18) 'Minor' means a consumer who a covered entity knows or should reasonably know120 is under the age of 18 years.121 (19) 'Online service, product, or feature' means a digital product that is accessible to the122 public via the internet, including a website or mobile application. For the purpose of this123 paragraph, the following are not included: 124 (A) Telecommunications service, as defined in 47 U.S.C. Section 153;125 (B) A broadband service, as defined in 47 C.F.R. Section 54.400; or126 (C) The in-person sale, delivery, or use of a physical product.127 (20) 'Personal data' means any information, including derived data and unique identifiers,128 that is linked or could reasonably be linked, alone or in combi nation with other129 information, to an identified or identifiable individual or to a device that identifies or is130 linked to one or more identifiable individuals in a household. Such term shall not include131 de-identified data or publicly available information.132 (21) 'Process' or 'processing' means any operation or set of o perations performed,133 whether by manual or automated means, on personal data or on se ts of personal data,134 such as the collection, use, storage, disclosure, analysis, deletion, modification, or other135 handling of personal data.136 (22) 'Processor' means a person who processes personal data on behalf of a covered137 entity, another processor, or a federal, state, tribal, or local government entity.138 (23)(A) 'Publicly available information' means information that:139 (i) Is made available through federal, state, or local governm ent records or to the140 general public from widely distributed media; or141 (ii) A covered entity has a reasonable basis to believe the co nsumer has lawfully142 made available to the general public.143 (B) Such term shall not include:144 (i) Biometric data collected by an entity about a consumer wit hout the consumer's145 knowledge or consent;146 S. B. 495 - 6 - 26 LC 64 0032 (ii) Information collated and combined to create a consumer pr ofile that is made147 available to a consumer of a publicly available website, either in exchange for148 payment or free of charge;149 (iii) Information made available for sale;150 (iv) An inference generated from the information described in subparagraph (A) of151 this paragraph;152 (v) Any obscene visual depiction, as defined in 18 U.S.C. Section 1460;153 (vi) Personal data created through the combination of personal data with publicly154 available information;155 (vii) Genetic data, unless otherwise made publicly available b y the consumer to156 whom the information pertains;157 (viii) Information provided by a consumer on a website or onli ne service made158 available to all members of the public, for free or for a fee, where the consumer has159 maintained a reasonable expectation of privacy in the informati on, such as by160 restricting the information to a specific audience; or161 (ix) Intimate images, whether authentic or computer generated, known or reasonably162 believed to be nonconsensual.163 (24) 'Reasonable alternative design' means an alternative desi gn feature for which the164 risk of causing compulsive use in consumers who are minors is lowered.165 (25) 'Reasonably likely to be accessed' means an online service, product, or feature that166 is reasonably believed to be accessed by a minor based on any o f the following167 indicators:168 (A) The online service, product, or feature is directed to chi ldren, as defined by the169 Children's Online Privacy Protection Act, 15 U.S.C. Section 650 1, et seq., and the170 Federal Trade Commission's rules implementing such act;171 S. B. 495 - 7 - 26 LC 64 0032 (B) The online service, product, or feature is determined, bas ed on competent and172 reliable evidence regarding audience composition, to be routine ly accessed by an173 audience that is composed of at least 2 percent minors; or174 (C) The covered entity knew or should have reasonably known that at least 2 percent175 of the audience of the online service, product, or feature is c omposed of minors,176 provided that, in making this assessment, the covered entity shall not collect or process177 any personal data that are not reasonably necessary to provide an online service,178 product, or feature with which a minor is actively and knowingly engaged.179 (26) 'Third party' means a person, public authority, agency, or body that is not a minor180 or a covered entity.181 10-1-972.182 (a) A covered entity shall not engage in or use any of the following high-risk data practices183 or design features:184 (1) Collect, sell, share, or retain any personal data of a consumer that is not necessary to185 provide an online service, product, or feature with which a con sumer is actively and186 knowingly engaged;187 (2) Use previously collected personal data of a consumer for a ny purpose other than a188 purpose for which the personal data was collected, unless necessary to comply with any189 obligation under this article;190 (3) Permit any person, including a parent or guardian, to monitor the online activity of191 a consumer or to track the location of a consumer without providing a conspicuous signal192 to the consumer when the consumer is being monitored or tracked;193 (4) Use the personal data of the consumer to select, recommend, or prioritize media for194 the consumer in an algorithmic feed, unless the consumer has ex plicitly requested to195 receive media from a specific account, specific category, or related media;196 S. B. 495 - 8 - 26 LC 64 0032 (5) Use the personal data of the consumer to select, recommend, or prioritize media for197 the consumer in an algorithmic feed, unless the personal data are:198 (A) Consumer selected privacy or accessibility settings;199 (B) The consumer's location, but only to determine whether the consumer is within this200 state for purposes of complying with this Code section;201 (C) The consumer's age status, but only to implement the cover ed entity's policies202 regarding media appropriate for minors; or203 (D) A search query, provided the search query is used only to select and prioritize204 media in response to the search;205 (6) Send push notifications to the consumer between the hours of 12:00 Midnight206 and 6:00 A.M.; or207 (7) Use any design feature or component of a design feature that:208 (A) Automatically plays a video, unless the video is the next in a series and the209 consumer chose to play a prior video in the series;210 (B) Uses intermittent, variable reward schedules;211 (C) Continuously and seamlessly loads new media in an algorithmic feed and absent212 a specific request from the consumer, such as an infinite scroll feed;213 (D) Is intended to cause compulsive use; or214 (E) Has been identified and declared by the Attorney General a s a prohibited data215 practice or design feature pursuant to subsection (c) of this Code section.216 (b) A covered entity may engage in any of the high-risk data practices or design features217 listed in subsection (a) of this Code section if:218 (1) The consumer explicitly requests the practice or feature; and219 (2) The covered entity has used a commercially reasonable and technically feasible220 age-assurance method to determine that the consumer is not a minor.221 S. B. 495 - 9 - 26 LC 64 0032 (c) The Attorney General shall adopt rules and regulations pur suant to this article that222 prohibit a covered entity from engaging in or using any data pr actices or design features223 that:224 (1) Carry a risk of compulsive use that is not substantially outweighed by any benefits225 provided by the practice or feature to consumers; or226 (2) Subvert or impair consumer autonomy, decision making, or choice while using the227 covered entity's online service, product, or feature.228 (d) The Attorney General shall, at least once every two years, review and update the rules229 and regulations promulgated under subsection (c) of this Code Section to keep pace with230 emerging technology.231 10-1-973.232 (a) Prior to deploying any new design, or making a material change to an existing design233 that will be deployed to consumers, a covered entity shall asse ss the risk that the design234 will cause compulsive use in minors.235 (b) For any design that carries a reasonably foreseeable risk of causing compulsive use in236 minors, a covered entity shall:237 (1) Determine if there is a reasonable alternative design; and238 (2) Provide the reasonable alternative design that carries the lowest risk of compulsive239 use as a default to each consumer, until:240 (A) The consumer explicitly requests the original design; and241 (B) The covered entity determines, using a commercially reasonable and technically242 feasible age-assurance method, that the consumer is not a minor.243 (c) Notwithstanding subsection (b) of this Code section, a covered entity shall not deploy244 any design to consumers if its assessed risk of causing compulsive use to minors outweighs245 the assessed benefit of the design to minors, unless:246 (1) The consumer explicitly requests the design; and247 S. B. 495 - 10 - 26 LC 64 0032 (2) The covered entity determines, using a commercially reason able and technically248 feasible age-assurance method, that the consumer is not a minor.249 (d) A covered entity shall assess all existing design and miti gate the risk of causing 250 compulsive use in minors as described in this Code section.251 (e) A covered entity shall document each step taken in accordance with subsections (a),252 (b), and (c) of this Code section, along with any experiments, evidence, and data that253 support the assessments and determinations made, and retain such documents for a period254 of ten years. All data collected about individual consumers to comply with this subsection255 shall be de-identified and made anonymous.256 (f) A covered entity shall submit annually all records related to the assessments and257 determinations made in accordance with subsections (a), (b), and (c) of this Code section258 to an independent auditor who shall assess the records for comp liance with this Code259 section and recommend any changes that would bolster compliance.260 (g) Nothing in this Code section shall require a covered entity to:261 (1) Assess any media for the risk of causing compulsive use; or262 (2) Limit any consumer's access to any specific consumer generated content or category263 of consumer generated content.264 (h) The provisions of this Code section shall not apply to a covered entity that qualifies as265 a small business. To qualify as a small business, a covered entity shall meet the following266 criteria for the three preceding calendar years, or for the covered entity's period of existence267 if the covered entity is less than three years old: 268 (1) The covered entity's average annual gross revenues during the three-year period did269 not exceed $25 million, as adjusted annually based on the Consu mer Price Index as270 reported by the Bureau of Labor Statistics of the United States Department of Labor; and271 (2) The covered entity, on average, did not annually collect, process, retain, or transfer272 the personal data of more than 50,000 people during the three-year period for any purpose273 S. B. 495 - 11 - 26 LC 64 0032 other than initiating, rendering, billing for, finalizing, completing, or otherwise collecting274 payment for a requested service or product.275 10-1-974.276 (a) A covered entity shall configure all default privacy setti ngs provided to a minor277 through its online service, product, or feature to the highest level of privacy.278 (b) A covered entity shall provide the following settings by default to all minors:279 (1) Do not use an algorithmic recommendation system to recommend to adult consumers280 that they connect to a minor as a friend, follower, or contact on an online service;281 (2) Do not use an algorithmic recommendation system to recommend to adult consumers282 that they follow a minor's media, unless the minor's account was connected to the known283 adult's account as a friend, follower, or contact prior to the recommendation;284 (3) Do not use an algorithmic recommendation system to recommend to adult consumers285 that they communicate with a minor through direct messaging, unless the minor's account286 was connected to the known adult's account as a friend, follower, or contact prior to the287 recommendation;288 (4) Do not use an algorithmic recommendation system to recommend to minors that they289 communicate with a known adult through direct messaging, unless the minor's account290 was connected to the adult's account as a friend, follower, or contact prior to the291 recommendation;292 (5) Do not display a minor's friends, followers, or contacts; and293 (6) Disable search engine indexing of a minor's account profile and media.294 (c) A covered entity shall not display the location of any min or to another consumer by295 default; provided, however, that a covered entity may display a minor's location to another296 consumer when the minor has explicitly chosen to share his or her location with a specific297 consumer.298 S. B. 495 - 12 - 26 LC 64 0032 (d) A covered entity shall not send push notifications to any minor by default or provide299 a single setting that enable all push notifications.300 (e) A covered entity shall provide minors with settings to enable or disable each specific301 category of push notification offered by the covered entity's o nline service, product, or302 feature, such as marketing notifications, direct message notifi cations, media interaction303 notifications, and any other category of notification pushed by the product or service.304 (f) A covered entity shall:305 (1) Disable by default all interaction counts, including counts of reactions and comments,306 on all of a minor's media;307 (2) Offer settings to minors to enable or disable specific types of interaction counts, such308 as comments, reactions, reshares, or other categories of interactions; and309 (3) Offer to minors a single setting to enable all interaction counts at once only if the310 settings to enable specific interactions are equally or more prominent and accessible.311 (g) A covered entity shall not undermine consumer autonomy in settings by:312 (1) Providing a minor with a single setting that makes more th an one default privacy313 setting less protective at once; or314 (2) Requesting or prompting a minor to make any setting less p rotective, unless the315 change is strictly necessary for the minor to access a service, product, or feature explicitly316 requested by the minor.317 (h)(1) A covered entity that facilitates communications between consumers shall provide318 a prominent, accessible, and responsive tool that gives minors the option to block specific319 consumers from taking, at minimum, each of the following actions:320 (A) Accessing the minor's media;321 (B) Interacting with the minor's media;322 (C) Communicating with the minor through their media;323 (D) Communicating with the minor through direct messaging; and324 S. B. 495 - 13 - 26 LC 64 0032 (E) Communicating with the minor through any other means offer ed by the covered325 entity through its product or service.326 (2) The tool described in paragraph (1) of this subsection shall provide a minor with the327 option to prevent media from a blocked consumer from appearing in the minor's feed.328 (3) The tool described in paragraph (1) of this subsection sha ll, at a minimum, be329 accessible from a feature located:330 (A) Proximate to every instance of another consumer's username or avatar;331 (B) On all media shared by another consumer;332 (C) On every direct message or direct message thread; and333 (D) In a first-level settings menu labeled 'Blocked Users.'334 (4) The features listed in subparagraphs (A), (B), and (C) of paragraph (3) of this335 subsection shall provide a minor with the ability to:336 (A) Block the other consumer, which shall trigger all of the settings in paragraphs (1)337 and (2) of this subsection; or338 (B) Go to the settings feature to select more granular block s ettings for the other339 consumer.340 (i) A covered entity offering an algorithmic feed to a minor that uses the minor's personal341 data to select, recommend, or prioritize media in the feed shal l provide a prominent and342 accessible interface that enables the minor to:343 (1) Explicitly communicate preferences about the types of media to be recommended and344 to be blocked in the output of the relevant algorithmic recommendation system;345 (2) Access, review, and make changes to any personal data the covered entity uses to346 determine the output of the relevant algorithmic recommendation system; and347 (3) Ensure that the relevant algorithmic recommendation system is informed by these348 preferences.349 (j) A covered entity offering an algorithmic feed to a minor that uses the minor's personal350 data to select, recommend, or prioritize media in the feed shall provide the minor with the351 S. B. 495 - 14 - 26 LC 64 0032 choice of an algorithmic feed that only selects media from sources the minor affirmatively352 chose to follow or otherwise include in the feed.353 (k)(1) A covered entity shall provide a prominent and accessible tool to allow:354 (A) A minor to request that the covered entity delete any account profiles, media, and355 personal data provided by, or obtained about, the minor, includ ing personal data the356 minor provided to the covered entity, personal data the controller obtained from another357 source, and derived data; and358 (B) The parent or legal guardian of a minor to make such a req uest on the minor's359 behalf.360 (2) A request made pursuant to this subsection shall be honore d no later than 15 days361 after a covered entity receives the request.362 10-1-975.363 A covered entity shall prominently and clearly provide on its website or mobile application:364 (1) The covered entity's privacy information, terms of service, policies, and community365 standards;366 (2) The purpose of the feed and the algorithmic recommendation system used to367 determine the feed for each algorithmic feed in use by the covered entity;368 (3) For each algorithmic recommendation system in use by the covered entity:369 (A) The purpose of the system;370 (B) A description of any personal data of minors that is used as an input or to inform371 an input;372 (C) The source of the personal data;373 (D) The purpose of using the personal data; and374 (E) How each personal data input is measured and determined, if it is derived data and375 is weighed relative to the other inputs reported in this paragraph, and if it is categorized376 S. B. 495 - 15 - 26 LC 64 0032 into one of four quartile groups according to the input's relat ive importance in377 contributing to the system's output; and378 (4) For every other feature of the product or service that uses the personal data of minors,379 descriptions of:380 (A) The purpose of the feature;381 (B) The personal data collected by the feature;382 (C) The personal data used by the feature;383 (D) How the personal data are used by the feature;384 (E) Any personal data transferred to or shared with a processo r or third party by the385 feature, the identity of the processor or third party, and the purpose of the transfer or386 sharing; and387 (F) How long personal data are retained.388 10-1-976.389 (a) During the process of conducting age assurance, covered entities and processors shall:390 (1) Only collect personal data of a consumer that is strictly necessary for determining a391 consumer's age status;392 (2) Immediately upon determining that a consumer is a minor, delete any personal data393 collected of such consumer for age assurance, except the determination of the consumer's394 age status;395 (3) Not use any personal data of a consumer collected for age assurance for any other396 purpose;397 (4) Not combine personal data of a consumer collected for age assurance, except the398 determination of the consumer's age status, with any other personal data of the consumer;399 (5) Not disclose personal data of a consumer collected for age assurance to a third party400 that is not a processor; and401 (6) Implement a review process to allow consumers to appeal age status determinations.402 S. B. 495 - 16 - 26 LC 64 0032 (b) A covered entity or processor that complies with all of th e provisions of this article403 shall not be liable for any inaccuracies in a consumer's age status.404 (c) Subject to subsection (d) of this Code section, the Attorney General shall adopt rules405 and regulations:406 (1) Identifying commercially reasonable and technically feasib le methods for covered407 entities and processors to determine if a consumer is a minor;408 (2) Describing the appropriate review process for consumers ap pealing age status409 determinations;410 (3) Describing transparency measures that would increase consu mer trust in411 age-assurance methods; and412 (4) Providing any additional privacy protections for personal data collected for age413 assurance.414 (d) The Attorney General shall periodically review and update such rules and regulations415 as necessary to keep pace with emerging technology.416 (e) In adopting such rules and regulations, the Attorney General shall:417 (1) Prioritize consumer privacy and accessibility;418 (2) Consider the size, financial resources, and technical capabilities of covered entities419 and processors;420 (3) Consider the costs and effectiveness of available age-assurance methods;421 (4) Consider the impact of age-assurance methods on consumers' safety, utility, and422 experience;423 (5) Consider the efficacy of requiring covered entities and processors to use previously424 collected data to determine the age status of some or all consu mers or adopting425 interoperable age assurance methods; and426 (6) Provide consumers with multiple options for age assurance.427 S. B. 495 - 17 - 26 LC 64 0032 10-1-977.428 (a) A violation of this article shall constitute an unfair or deceptive act or practice in the429 conduct of consumer transactions under Part 2 of Article 15 of this chapter, the 'Fair430 Business Practices Act of 1975,' and the enforcement against any such violation shall be431 by public enforcement by the Attorney General and shall be enforceable through private432 action.433 (b) Whenever it may appear to the Attorney General that any covered entity is using or has434 used any method, act, or practice declared by this article to b e unlawful and that435 proceedings would be in the public interest, the Attorney Gener al may bring action in a436 court of competent jurisdiction. Upon a showing by the Attorney General that a covered437 entity has violated this article, the court may enter or grant any or all of the relief provided438 for in Code Section 10-1-397.439 (c) Any person who suffers injury or damages as a result of a violation of this article may440 bring an action individually against the person or persons engaged in such violation under441 the rules of civil procedure to seek equitable injunctive relie f and to recover his or her442 general and exemplary damages sustained as a consequence thereo f in any court having443 jurisdiction over the defendant. Such relief may include:444 (1) Restitution to any person or persons adversely affected by a defendant's actions in445 violation of this article;446 (2) Punitive damages in an amount equal to $50,000.00 or three times the combined total447 of damages, costs, and fees, whichever is greater;448 (3) Expenses of litigation, including reasonable attorney's fees; and449 (4) Other relief as the court deems just and equitable.450 (d) A covered entity that has violated a provision of this article shall be liable for damages451 of $5,000 per violation, as adjusted annually to reflect an increase in the Consumer Price452 Index, or actual damages, whichever is greater;453 S. B. 495 - 18 - 26 LC 64 0032 (e) Except as otherwise provided, this article is cumulative w ith other laws and is not454 exclusive.455 10-1-978.456 (a) Nothing in this article shall be interpreted or construed to:457 (1) Impose liability in a manner that is inconsistent with 47 U.S.C. Section 230;458 (2) Impose liability in a manner that is inconsistent with the First Amendment to the459 United States Constitution;460 (3) Force any consumer to undergo age assurance as a condition of accessing the online461 services, products, or features of a covered entity;462 (4) Prevent any consumer from accessing any consumer generated media; or463 (5) Preempt or otherwise affect any right, claim, remedy, pres umption, or defense464 available at law or in equity, including but not limited to ant idiscrimination, consumer465 protection, labor, and civil rights laws.466 10-1-979.467 This article shall not apply to:468 (1) Any federal, state, tribal, or local government entity in the ordinary course of its469 operation;470 (2) Protected health information that a covered entity or its affiliate processes in471 accordance with the federal Health Insurance Portability and Ac countability Act472 (HIPAA) of 1996, P.L. 104-191, or documents that a covered entity or its affiliate creates473 for the purpose of complying with HIPAA;474 (3) Information used only for public health activities and purposes described in 45 C.F.R.475 Section 164.512;476 (4) Information that identifies a consumer with:477 S. B. 495 - 19 - 26 LC 64 0032 (A) Activities that are subject to the federal policy for the protection of human subjects478 as set forth in 45 C.F.R. Part 46;479 (B) Research on human subjects undertaken in accordance with good clinical practice480 guidelines issued by the International Council for Harmonisatio n of Technical481 Requirements for Pharmaceuticals for Human Use;482 (C) Activities that are subject to the protections provided in 21 C.F.R. Part 50 and483 21 C.F.R. Part 56; or484 (D) Research conducted in accordance with the requirements set f o r t h i n485 subparagraphs (A) through (C) of this paragraph or otherwise in accordance with state486 or federal law;487 (5) Any entity whose primary purpose is journalism and has a majority of its workforce488 consisting of persons engaging in journalism; or489 (6) Any financial institution subject to Title V of the federal Gramm-Leach-Bliley Act,490 P.L. 106-102, and regulations adopted to implement that act.491 10-1-980.492 A covered entity shall not discriminate or retaliate against any consumer, including denying493 products or services, charging different prices or rates for products or services, or providing494 lower quality products or services to the consumer, for receivi ng any of the protections495 contained in this chapter, for exercising any of the rights con tained in this article, for496 refusing to change privacy and safety settings, or for refusing to agree to the collection or497 processing of personal data or to the use of any design feature."498 SECTION 2.499 It is the intent of the General Assembly that nothing in this a rticle may be construed to500 infringe on the existing rights and freedoms of minors or be construed to discriminate against501 S. B. 495 - 20 - 26 LC 64 0032 minors based on race, ethnicity, sex, disability, sexual orient ation, gender identity, gender502 expression, religion, or national origin.503 SECTION 3.504 This Act shall become effective upon its approval by the Governor or upon its becoming law505 without such approval for purposes of promulgating rules and regulations and shall become506 effective on January 1, 2027, for all other purposes.507 SECTION 4.508 All laws and parts of laws in conflict with this Act are repealed.509 S. B. 495 - 21 -