30-14-2802. (Effective October 1, 2024) Definitions. As used in this part, unless the context clearly indicates otherwise, the following definitions apply:

(1) "Affiliate" means a legal entity that shares common branding with another legal entity or controls, is controlled by, or is under common control with another legal entity.

(2) "Authenticate" means to use reasonable methods to determine that a request to exercise any of the rights afforded under 30-14-2808(1)(a) through (1)(e) is being made by, or on behalf of, the consumer who is entitled to exercise these consumer rights with respect to the personal data at issue.

(3) (a) "Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that are used to identify a specific individual.

(b) The term does not include:

(i) a digital or physical photograph;

(ii) an audio or video recording; or

(iii) any data generated from a digital or physical photograph or an audio or video recording, unless that data is generated to identify a specific individual.

(4) "Child" means an individual under 13 years of age.

(5) (a) "Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer. The term may include a written statement, a statement by electronic means, or any other unambiguous affirmative action.

(b) The term does not include:

(i) acceptance of a general or broad term of use or similar document that contains descriptions of personal data processing along with other unrelated information;

(ii) hovering over, muting, pausing, or closing a given piece of content; or

(iii) an agreement obtained using dark patterns.

(6) (a) "Consumer" means an individual who is a resident of this state.

(b) The term does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the controller occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit, or government agency.

(7) "Control" or "controlled" means:

(a) ownership of or the power to vote more than 50% of the outstanding shares of any class of voting security of a company;

(b) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or

(c) the power to exercise controlling influence over the management of a company.

(8) "Controller" means an individual who or legal entity that, alone or jointly with others, determines the purpose and means of processing personal data.

(9) "Dark pattern" means a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision-making, or choice.

(10) "Decisions that produce legal or similarly significant effects concerning the consumer" means decisions made by the controller that result in the provision or denial by the controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or access to necessities such as food and water.

(11) "De-identified data" means data that cannot be used to reasonably infer information about or otherwise be linked to an identified or identifiable individual or a device linked to the individual if the controller that possesses the data:

(a) takes reasonable measures to ensure that the data cannot be associated with an individual;

(b) publicly commits to process the data in a de-identified fashion only and to not attempt to re-identify the data; and

(c) contractually obligates any recipients of the data to satisfy the criteria set forth in subsections (11)(a) and (11)(b).

(12) "Identified or identifiable individual" means an individual who can be readily identified, directly or indirectly.

(13) "Institution of higher education" means any individual who or school, board, association, limited liability company, or corporation that is licensed or accredited to offer one or more programs of higher learning leading to one or more degrees.

(14) "Nonprofit organization" means any organization that is exempt from taxation under section 501(c)(3), 501(c)(4), 501(c)(6) or 501(c)(12) of the Internal Revenue Code of 1986 or any subsequent corresponding internal revenue code of the United States as amended from time to time.

(15) (a) "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable individual.

(b) The term does not include de-identified data or publicly available information.

(16) (a) "Precise geolocation data" means information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet.

(b) The term does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

(17) "Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

(18) "Processor" means an individual who or legal entity that processes personal data on behalf of a controller.

(19) "Profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

(20) "Protected health information" has the same meaning as provided in the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996.

(21) "Pseudonymous data" means personal data that cannot be attributed to a specific individual without the use of additional information, provided the additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable individual.

(22) "Publicly available information" means information that:

(a) is lawfully made available through federal, state, or municipal government records or widely distributed media; or

(b) a controller has a reasonable basis to believe a consumer has lawfully made available to the public.

(23) (a) "Sale of personal data" means the exchange of personal data for monetary or other valuable consideration by the controller to a third party.

(b) The term does not include:

(i) the disclosure of personal data to a processor that processes the personal data on behalf of the controller;

(ii) the disclosure of personal data to a third party for the purposes of providing a product or service requested by the consumer;

(iii) the disclosure or transfer of personal data to an affiliate of the controller;

(iv) the disclosure of personal data in which the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party;

(v) the disclosure of personal data that the consumer:

(A) intentionally made available to the public via a channel of mass media; and

(B) did not restrict to a specific audience; or

(vi) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.

(24) "Sensitive data" means personal data that includes:

(a) data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about a person's sex life, sexual orientation, or citizenship or immigration status;

(b) the processing of genetic or biometric data for the purpose of uniquely identifying an individual;

(c) personal data collected from a known child; or

(d) precise geolocation data.

(25) (a) "Targeted advertising" means displaying advertisements to a consumer in which the advertisement is selected based on personal data obtained or inferred from that consumer's activities over time and across nonaffiliated internet websites or online applications to predict the consumer's preferences or interests.

(b) The term does not include:

(i) advertisements based on activities within a controller's own internet websites or online applications;

(ii) advertisements based on the context of a consumer's current search query or visit to an internet website or online application;

(iii) advertisements directed to a consumer in response to the consumer's request for information or feedback; or

(iv) processing personal data solely to measure or report advertising frequency, performance, or reach.

(26) "Third party" means an individual or legal entity, such as a public authority, agency, or body, other than the consumer, controller, or processor or an affiliate of the controller or processor.

(27) "Trade secret" has the same meaning as provided in 30-14-402.