H.F. 1367 Summary

• Applies to businesses with annual gross revenues exceeding $25,000,000, or that annually buy/sell personal information of 50,000+ individuals, or derive 50%+ of revenue from selling personal information.

• Grants consumers rights to access their personal information within 45 days, opt out of personal information sales, and request deletion of personal information with limited exceptions.

• Requires businesses to provide notice at or before data collection detailing what personal information is collected, sources, collection purposes, and categories of service providers or third parties who receive the data.

• Prohibits businesses from discriminating against consumers for exercising privacy rights, with exceptions for price differences reasonably related to the value of data sold.

• Creates private right of action allowing consumers to recover $100-$750 per violation or actual damages (whichever is greater), plus attorney fees and costs; authorizes Attorney General enforcement; effective June 30, 2024.