SB3517 Summary: Privacy Rights Act

• Creates comprehensive consumer privacy law establishing rights to delete personal information, correct inaccuracies, access collected data, opt out of sales/sharing, and limit use of sensitive personal information without retaliation by businesses.

• Requires businesses meeting size thresholds ($25M+ annual revenue, selling 100,000+ consumers' data, or deriving 50%+ revenue from data sales) to provide clear notice of data collection, implement reasonable security, and comply with consumer requests within 45 days.

• Establishes Privacy Protection Agency with 5-member board to enforce Act through administrative actions with fines up to $2,500 per violation or $7,500 for intentional violations or those affecting minors; creates Consumer Privacy Fund for enforcement costs and privacy grants.

• Provides private right of action for statutory damages ($100-$750 per consumer per incident) when personal information breaches result from failure to maintain reasonable security, with 30-day cure notice requirement before litigation.

• Requires Attorney General to adopt rules by July 1, 2025 regarding opt-out mechanisms, sensitive personal information handling, age verification for minors, and standards for deidentification; enforcement begins July 1, 2025 or 6 months after rules published.