S.B. 1009 - Privacy Bill Summary

• Expands the definition of "personal information" in data breach notification law to include nine specified data elements such as social security numbers, financial account numbers, health insurance policy numbers, biometric data, and private authentication keys.

• Prohibits the sale or sharing of geolocation information collected through mobile devices or location-based applications without explicit prior opt-in consent from the user.

• Prohibits the sale or sharing of internet browser information (including web browsing history, application usage history, and IP addresses) without explicit prior opt-in consent from the internet service subscriber.

• Requires law enforcement to obtain a search warrant before accessing electronic communications in non-emergency situations and permits delayed notification to subscribers up to 90 days or until the criminal discovery deadline.

• Creates a new criminal offense for intentionally creating or disclosing deepfake images or videos that depict a real person in the nude or engaged in sexual conduct without consent.