SB213 Summary

• Requires data brokers to post conspicuous notices on websites identifying themselves as data brokers and containing Secretary of State-provided language.

• Mandates data brokers register with the Secretary of State by January 1, 2025, with a $300 registration fee and annual renewal fees, and requires registration certificates to include legal name, contact information, data categories, security breach history, and child data practices.

• Requires data brokers to develop and maintain comprehensive information security programs with administrative, technical, and physical safeguards appropriate to their size and data volume, including employee training, access controls, encryption, monitoring, and incident documentation.

• Imposes civil penalties of $100 per day for violations of notification or registration requirements (maximum $10,000 per 12-month period) and treats data security violations as violations of the Deceptive Trade Practices Act.

• Becomes effective October 1, 2024; applies to data collected, transferred, or processed on or after January 1, 2025; exempts de-identified data, employee data, publicly available information, financial institutions, and consumer reporting agencies.