General Disclosure: If a business (as defined by the bill) collects any type of personal information, this should be disclosed in a clear privacy policy available on the website of the business.

Specific Requests: Should a consumer desire to know what data is being collected, the company is required to provide such information—specifically about the individual. Some of the requests that can be made include:

The categories of personal information collected.

Specific data collected about the individual.

Methods used to collect the data.

A business’s purpose for collecting the information.

Third parties to which personal information may be shared.

Deletion: If the consumer desires, personal information (with exceptions) will be deleted by the business.

Same Service: Regardless of a consumer’s request and preferences about how their personal information is handled, businesses are required to provide “equal service and pricing even if the consumer exercises their privacy rights under the Act.”