SB3603

SB3603 mandates that controllers disclose and allow opt-outs for processing personal data for targeted advertising.

SB3603 amends the Consumer Fraud and Deceptive Business Practices Act to require controllers to disclose and provide a method for consumers to opt out of the processing of personal data for targeted advertising. Controllers must include a clear and conspicuous method for opting out in their privacy notices. This method may include an Internet hyperlink labeled "Your Opt-Out Rights" or "Your Privacy Rights." If a controller processes personal data for targeted advertising of a known child, the parent or legal guardian may opt the child out. The Act takes effect January 1, 2028.