If you own a device, then the data it generates is your property.
Most Americans reasonably assume that when they purchase a product, the information generated by their use of that product is theirs to control unless they explicitly authorized otherwise. This Consumer Data Control and Privacy Rights Act would establish this principle in law by requiring opt-in consent before personal data may be sold or shared, prohibiting companies from hiding such permissions inside lengthy terms-of-service agreements, and ensuring that consumers retain meaningful control over information generated through their use of their products and services. This legislation is a straightforward, common-sense update to consumer protection law that preserves product functionality while preventing unethical and non-consensual sharing and selling of personal data.
The rapid growth of internet-connected products has created a major gap in consumer protection law. Today, many products that Americans purchase and own, including cars, televisions, appliances, phones, and other connected devices, collect detailed personal information about their users and monetize that information without meaningful consent. As one glaring example, car manufacturers continue to sell driving data to insurance companies, which is then used to justify raising premiums, without consumers understanding that such data collection and sharing was occurring.
The Consumer Data Control and Privacy Rights Act
Section 1. Legislative Findings
The Legislature finds that:
(a) Modern consumer products and services routinely collect, generate, store, process, and transmit detailed information regarding the activities, behaviors, locations, preferences, communications, and personal characteristics of consumers.
(b) Consumers reasonably expect that personal data generated through their use of a product or service will remain under their control and will not be sold, disclosed, or monetized without their affirmative consent.
(c) The unauthorized commercialization of personal data can result in economic harm, discrimination, manipulation, loss of privacy, and other substantial injuries to consumers.
(d) Existing market practices frequently use lengthy, complex, or deceptive contractual agreements which fail to provide meaningful consumer understanding or consent.
(e) Consumers should possess meaningful control over the personal data generated through their use of products and services.
Section 2. Definitions
“Consumer” means any natural person who purchases, owns, leases, licenses, uses, or is the primary subject of personal data collected by a covered product or service.
“Covered product or service” means any product, device, software, platform, application, vehicle, appliance, or service capable of collecting, generating, storing, transmitting, processing, or disclosing personal data.
“Personal data” means information that identifies, relates to, describes, concerns, or can reasonably be linked to a consumer, including but not limited to:
- location data
- driving behavior data
- biometric data
- browsing history
- viewing history
- device telemetry
- purchase history
- usage patterns
- behavioral profiles
- communications metadata
- inferred characteristics or preferences
“Third party” means any person or entity other than the consumer or the entity directly providing the product or service requested by the consumer.
“Sale” means transferring, disclosing, licensing, sharing, renting, exchanging, providing access to, or otherwise making personal data available to another person or entity in exchange for money, services, consideration, or any other thing of value.
“Affirmative opt-in consent” means a clear, specific, informed, and voluntary agreement by a consumer to a particular use or disclosure of personal data. Consent shall not be inferred from silence, inactivity, continued use of a product, acceptance of general terms of service, pre-checked boxes, or deceptive interface design.
Section 3. Consumer Control of Personal Data
Personal data generated through a consumer’s use of a covered product or service shall remain subject to the control of that consumer.
No person or entity shall sell, disclose, transfer, license, share, monetize, or otherwise provide personal data to any third party unless the consumer has first provided affirmative opt-in consent specific to that disclosure.
Consent to one disclosure shall not constitute consent to future disclosures.
Consent may be revoked by the consumer at any time.
Section 4. Authorized Internal Processing
A provider of a covered product or service may collect and process personal data only to the extent reasonably necessary to:
(a) provide a product or service expressly requested by the consumer;
(b) maintain, repair, secure, diagnose, or update such product or service;
(c) fulfill warranty obligations;
(d) prevent fraud, abuse, security incidents, or unlawful activity;
(e) comply with legal obligations imposed by law.
Personal data processed pursuant to this Section shall not be sold, disclosed, transferred, licensed, shared, monetized, or otherwise made available to any third party absent affirmative opt-in consent as required by Section 3.
The burden of demonstrating that a particular use of personal data was reasonably necessary under this Section shall rest upon the entity collecting or processing such data.
Section 5. Consumer Rights
Every consumer shall have the right to:
(a) know what personal data is being collected
(b) know the purpose for which such data is collected
(c) access all personal data collected concerning that consumer
(d) obtain a copy of such data in a machine-readable format
(e) correct inaccurate personal data
(f) delete personal data, except where retention is specifically required by law
(g) disable all nonessential data collection
(h) revoke consent previously granted under this Act.
Section 6. Prohibition on Coercive Data Practices
No provider of a covered product or service shall deny, materially impair, degrade, disable, or restrict the core functionality of a purchased product or subscribed service solely because a consumer refuses consent for the sale, disclosure, transfer, licensing, sharing, or monetization of personal data.
Any consent obtained through coercion, deception, manipulation, dark-pattern interface design, or the withholding of core product functionality shall be void.
Section 7. Non-Waiver of Rights
The rights and protections established by this Act may not be waived, limited, disclaimed, or circumvented through:
- terms of service;
- privacy policies;
- end-user license agreements;
- click-through agreements;
- arbitration clauses;
- contracts of adhesion;
- or any other standardized consumer contract.
Any contractual provision that purports to waive or limit rights granted by this Act shall be void and unenforceable.
Section 8. Enforcement and Remedies
Any violation of this Act shall constitute an unfair and deceptive trade practice.
Any person or entity found to have unlawfully sold, disclosed, transferred, licensed, shared, monetized, or otherwise exploited personal data shall be liable for:
(a) disgorgement of all revenue, profits, and other consideration obtained directly or indirectly from the violation
(b) civil penalties equal to not less than three times the amount of such revenue, profits, or consideration
(c) actual damages suffered by affected consumers
(d) injunctive relief
(e) reasonable attorney’s fees and costs
Where the amount of revenue, profit, or consideration cannot be reasonably determined, courts may award statutory damages of not less than $10,000 per affected consumer per violation.
A prevailing consumer shall not be required to demonstrate economic injury where a violation of this Act has been established.
Section 9. Private Right of Action
Any consumer whose rights under this Act have been violated may bring a civil action in a court of competent jurisdiction.
Class actions shall be permitted for violations affecting multiple consumers.
Section 10. Effective Date
This Act shall take effect one year after enactment.