HB 498 — Senate Substitute: Georgia Consumer Privacy Protection Act

• Enacts the "Georgia Consumer Privacy Protection Act," effective July 1, 2026, applying to businesses with over $25 million in revenue that either control/process personal information of at least 175,000 consumers annually or control/process data of at least 25,000 consumers while deriving more than 50% of gross revenue from selling personal information
• Grants Georgia consumers the right to access, correct, delete, and obtain portable copies of their personal data, as well as the right to opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects
• Requires controllers to obtain consent before processing sensitive data (including racial/ethnic origin, religious beliefs, health diagnoses, sexual orientation, biometric data, precise geolocation, and data from known children under 13) and to provide clear privacy notices disclosing data categories, processing purposes, and third-party sales
• Exempts financial institutions subject to Gramm-Leach-Bliley, HIPAA-covered entities, licensed insurers, nonprofit organizations, state and local governments, higher education institutions not selling data, and data governed by federal laws such as FERPA, the Fair Credit Reporting Act, and the Driver's Privacy Protection Act
• Grants the Attorney General exclusive enforcement authority with a mandatory 60-day cure period before action, civil penalties of up to $7,500 per violation (with treble damages for willful violations), no private right of action, and an affirmative defense for entities maintaining a written privacy program conforming to the NIST privacy framework