If you own a device, then the data it collects and/or generates is your property, and you should have the legal right to exercise full control over where it goes, if anywhere.
For any product with smart features, a user should be able to completely disable some or all outbound data, and operate the device in “airplane mode”. There is no reason why a car, TV, or refrigerator needs to transmit any data out to a server if the user doesn’t want it to.
The rapid growth of internet-connected products has created a major gap in consumer protection law. Today, many products that Americans purchase and own, including cars, televisions, appliances, phones, and other connected devices, collect detailed personal information about their users and monetize that information without meaningful consent. As one glaring example, car manufacturers continue to sell driving data to insurance companies, which is then used to justify raising premiums, without consumers understanding that such data collection and sharing was occurring.
Most Americans reasonably assume that when they purchase a product, the information generated by their use of that product is theirs to control unless they explicitly authorized otherwise. The Consumer Data Control and Privacy Rights Act would establish this principle in law by requiring opt-in consent before any personal data may be sold or shared. It would also prohibit companies from hiding such permissions inside lengthy terms-of-service agreements. This legislation is a straightforward, common-sense consumer protection law which preserves product functionality while preventing the unethical and non-consensual sharing and selling of people’s personal data.
The Consumer Data Control and Privacy Rights Act
Section 1. Legislative Findings
The Legislature finds that:
(a) Modern consumer products and services routinely collect, generate, store, process, and transmit detailed information regarding the activities, behaviors, locations, preferences, communications, and personal characteristics of consumers.
(b) Consumers reasonably expect that personal data generated through their use of a product or service will remain under their control and will not be collected, sold, disclosed, or monetized without their affirmative consent.
(c) The unauthorized collection and commercialization of personal data can result in economic harm, discrimination, manipulation, loss of privacy, and other substantial injuries to consumers.
(d) Existing market practices frequently use lengthy, complex, or deceptive contractual agreements which fail to provide meaningful consumer understanding or consent.
(e) Consumers should possess meaningful control over the personal data collected and generated through their use of products and services.
Section 2. Definitions
“Consumer” means any natural person who purchases, owns, leases, licenses, uses, or is the primary subject of personal data collected by a covered product or service.
“Covered product or service” means any product, device, software, platform, application, vehicle, appliance, or service capable of collecting, generating, storing, transmitting, processing, or disclosing personal data.
“Personal data” means information that identifies, relates to, describes, concerns, or can reasonably be linked to a consumer, including but not limited to:
- location data
- driving behavior data
- biometric data
- browsing history
- viewing history
- device telemetry
- purchase history
- usage patterns
- behavioral profiles
- communications metadata
- inferred characteristics or preferences
“Third party” means any person or entity other than the consumer or the entity directly providing the product or service requested by the consumer.
“Sale” means transferring, disclosing, licensing, sharing, renting, exchanging, providing access to, or otherwise making personal data available to another person or entity in exchange for money, services, consideration, or any other thing of value.
“Affirmative opt-in consent” means a clear, specific, informed, and voluntary agreement by a consumer to a particular use or disclosure of specific personal data. Consent shall not be inferred from silence, inactivity, continued use of a product, acceptance of general terms of service, pre-checked boxes, or deceptive interface design.
Section 3. Consumer Control of Personal Data
Personal data generated through a consumer’s use of a covered product or service shall remain subject to the control of that consumer.
No person or entity shall collect personal data unless the consumer has first provided affirmative opt-in consent specific to that disclosure.
No person shall sell, disclose, transfer, license, share, monetize, or otherwise provide personal data to any third party unless the consumer has first provided affirmative opt-in consent specific to that disclosure.
Consent to one disclosure shall not constitute consent to future disclosures.
Consent may be revoked by the consumer at any time.
Manufacturers are prohibited from grouping multiple types and use cases of personal data together, as this can be used to strong-arm customers into allowing access to one type of personal data in order to get the benefits of allowing access to another. For example, access to a user’s voice cannot be grouped with access to what’s being displayed on the screen.
Section 4. Authorized Internal Processing
A provider of a covered product or service may collect and process personal data only to the extent reasonably necessary to:
(a) provide a product or service expressly requested by the consumer;
(b) maintain, repair, secure, diagnose, or update such product or service at the user’s opt-in request;
(c) fulfill warranty obligations at the user’s opt-in request;
(d) prevent fraud, abuse, or security incidents;
(e) comply with legal obligations imposed by law.
The burden of demonstrating that a particular use of personal data was reasonably necessary under this Section shall rest upon the entity collecting or processing such data.
Section 5. Consumer Rights
Every consumer shall have the right to:
(a) know what personal data is being collected
(b) know the purpose for which such data is collected
(c) access all personal data collected concerning that consumer
(d) obtain a copy of such data in a machine-readable format
(e) correct inaccurate personal data
(f) delete personal data, except where retention is specifically required by law
(g) disable all nonessential data collection
(h) revoke consent previously granted under this Act.
Section 6. Prohibition on Coercive Data Practices
No provider of a covered product or service shall deny, materially impair, degrade, disable, or restrict the core functionality of a purchased product or subscribed service solely because a consumer refuses consent for the sale, disclosure, transfer, licensing, sharing, or monetization of personal data.
Any consent obtained through coercion, deception, manipulation, dark-pattern interface design, or the withholding of core product functionality shall be void.
Section 7. Non-Waiver of Rights
The rights and protections established by this Act may not be waived, limited, disclaimed, or circumvented through:
- terms of service;
- privacy policies;
- end-user license agreements;
- click-through agreements;
- arbitration clauses;
- contracts of adhesion;
- or any other standardized consumer contract.
Any contractual provision that purports to waive or limit rights granted by this Act shall be void and unenforceable.
Section 8. Enforcement and Remedies
Any violation of this Act shall constitute an unfair and deceptive trade practice.
Any person or entity found to have unlawfully sold, disclosed, transferred, licensed, shared, monetized, or otherwise exploited personal data shall be liable for:
(a) disgorgement of all revenue, profits, and other consideration obtained directly or indirectly from the violation
(b) civil penalties equal to not less than three times the amount of such revenue, profits, or consideration
(c) actual damages suffered by affected consumers
(d) injunctive relief
(e) reasonable attorney’s fees and costs
Where the amount of revenue, profit, or consideration cannot be reasonably determined, courts may award statutory damages of not less than $10,000 per affected consumer per violation.
A prevailing consumer shall not be required to demonstrate economic injury where a violation of this Act has been established.
Section 9. Private Right of Action
Any consumer whose rights under this Act have been violated may bring a civil action in a court of competent jurisdiction.
Class actions shall be permitted for violations affecting multiple consumers.
Section 10. Effective Date
This Act shall take effect one year after enactment.