HB 5989 Summary

• Establishes consumer privacy rights including the ability to know what personal data is collected, whether it is sold, access collected data, request deletion or correction, and opt out of sales and targeted advertising.

• Applies to persons conducting business in Michigan who control or process personal data of at least 100,000 consumers annually, or 25,000 consumers if deriving over 50% of revenue from personal data sales.

• Requires controllers to limit data collection to necessary purposes, obtain consent before processing sensitive data or children's data, maintain data security practices, and provide clear privacy notices disclosing data practices and consumer rights.

• Mandates controllers conduct data protection assessments for targeted advertising, personal data sales, profiling with significant risks, sensitive data processing, and other high-risk activities.

• Grants Michigan Attorney General exclusive enforcement authority with power to investigate violations, issue 30-day cure notices before enforcement action, and seek injunctions and civil fines up to $7,500 per violation; establishes consumer privacy fund to receive collected fines and support enforcement.