(1) A consumer is entitled to exercise the consumer rights authorized by this section at any time by submitting a request to a controller which specifies the consumer rights that the consumer wishes to exercise. With respect to the processing of personal data belonging to a known child, a parent or legal guardian of the child may exercise these rights on behalf of the child.
(2) A controller shall comply with an authenticated consumer request to exercise any of the following rights:(a) To confirm whether a controller is processing the consumer’s personal data and to access the personal data.
(b) To correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data.
(c) To delete any or all personal data provided by or obtained about the consumer.
(d) To obtain a copy of the consumer’s personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format.
(e) To opt out of the processing of the personal data for purposes of:1. Targeted advertising;
2. The sale of personal data; or
3. Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer.
(f) To opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data.
(g) To opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature.
(3) A device that has a voice recognition feature, a facial recognition feature, a video recording feature, an audio recording feature, or any other electronic, visual, thermal, or olfactory feature that collects data may not use those features for the purpose of surveillance by the controller, processor, or affiliate of a controller or processor when such features are not in active use by the consumer, unless otherwise expressly authorized by the consumer.
