MI SB0659

Establishes the "Personal Data Privacy Act" creating comprehensive consumer privacy rights including access, correction, deletion, data portability, and opt-out rights for personal data processing by businesses meeting threshold requirements (100,000+ consumers or 25,000+ consumers with data sales revenue).

Requires controllers to obtain explicit consumer consent before processing sensitive data (biometric, health, reproductive/sexual health, precise geolocation, racial/ethnic origin, religious beliefs), with heightened restrictions prohibiting sale of sensitive data and targeting of consumers under 18.

Mandates privacy notices disclosing data collection categories, processing purposes, consumer rights, retention periods, and third-party data sales; establishes 45-day response deadlines for consumer requests with appeal procedures.

Requires data brokers to register annually with the attorney general beginning February 1, 2026, and prohibits geofencing within 1,750 feet of mental health or reproductive/sexual health facilities to track consumer health data.

Grants exclusive enforcement authority to the attorney general with civil penalties up to $7,500 per violation, creates consumer privacy fund and data broker registry fund, and establishes 18-month cure period for initial violations; act effective 1 year after enactment.