IA SF143

Raises the age threshold for "child" in consumer data protection law from 13 to 18 years old

Expands "sensitive data" to include "health data," defined as information about an individual's past, current, or future physical or mental health status

Requires controllers to notify consumers in plain language about profiling that produces legal or similarly significant effects (affecting access to financial services, housing, insurance, education, criminal justice, employment, or health care), and allows consumers to opt out

Creates exemption for public health authority data when consumer consent has been obtained, and limits public health information exemptions to data that is de-identified, aggregated, and processed in batches of at least 100 consumers

Applies retroactively to January 1, 2025