H.B. 345 - Ohio Personal Privacy Act

• Establishes comprehensive consumer privacy protections requiring businesses collecting personal data from Ohio residents to provide privacy notices, allow access to personal data, and enable consumers to request corrections and deletions.

• Applies to businesses with annual Ohio revenues exceeding $25 million, those controlling personal data of 100,000+ consumers, or deriving over 50% of revenue from selling personal data of 25,000+ consumers.

• Grants consumers rights to access personal data, correct inaccuracies, request deletion, and opt out of personal data sales and targeted advertising; exempts certain sectors including financial institutions, HIPAA-covered entities, and government agencies.

• Provides Attorney General exclusive enforcement authority with $250,000 in fiscal year 2025 funding; civil penalties up to $5,000 per violation and consumer awards of $100-$750 per violation (up to $2,250 if willful/knowing violations).

• Prohibits private right of action; preempts all local data privacy regulations; establishes affirmative defense for businesses maintaining privacy programs conforming to National Institute of Standards and Technology privacy framework standards.