87-1302.

Terms, defined.

For purposes of the Age-Appropriate Online Design Code Act:

(1) Actual knowledge includes all information and inferences known to the covered online service relating to the age of the individual, including, but not limited to, self-identified age, and any age the covered online service has attributed or associated with the individual for any purpose, including marketing, advertising, or product development. If a covered online service's classification of an individual for purposes of marketing or advertising is inconsistent with the individual's self-identified age, a covered online service shall disregard self-identified age for purposes of the act;

(2) Child means an individual younger than thirteen years of age;

(3) Covered design feature means any feature or component of a covered online service that will encourage or increase the frequency, time spent, or activity of a user on the covered online service and includes:

(a) Infinite scroll;

(b) Rewards or incentives for frequency of visits or time spent on the covered online service;

(c) Notifications or push alerts;

(d) In-game purchases; or

(e) Appearance-altering filters;

(4) Covered minor means a user that a covered online service knows to be a minor;

(5)(a) Covered online service means a sole proprietorship, a limited liability company, a corporation, an association, or any other legal entity that owns, operates, controls, or provides an online service that:

(i) Conducts business in this state;

(ii) Alone, or jointly with its affiliates, subsidiaries, or parent companies, determines the purposes and means of the processing of consumers' personal data;

(iii) Has annual gross revenue in excess of twenty-five million dollars, adjusted every odd-numbered year to reflect changes in the Consumer Price Index for All Urban Consumers published by the Federal Bureau of Labor Statistics for the two-year period preceding the adjustment date. The amount shall be rounded to the next highest one-thousand-dollar amount;

(iv) Annually buys, receives, sells, or shares the personal data of fifty thousand or more consumers, households, or devices, alone or in combination with its affiliates, subsidiaries, or parent companies; and

(v) Derives at least fifty percent of its annual revenue from the sale or sharing of consumers' personal data.

(b) A covered online service includes:

(i) An entity that controls or is controlled by a business that meets the definition of covered online service if the entity and business share a name, service mark, or trademark that would cause a reasonable consumer to understand that the entity and business are commonly owned; and

(ii) For a covered online service that is a joint venture or partnership, any person with an ownership interest of forty percent or more in such venture or partnership.

(c) A covered online service does not include an online service with actual knowledge that fewer than two percent of its users are minors, provided that, in making such assessment, an online service shall not be required to collect personal data of users, and if an online service collects personal data of users for such purpose, it shall not use such personal data for other purposes and shall delete such personal data after using it to make the assessment;

(6) Dark pattern means a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decisionmaking, or choice. Dark pattern includes any practice determined to be a dark pattern by the Federal Trade Commission as of January 1, 2024;

(7) Knows to be a child or knows to be a minor means actual knowledge that the user is a child or minor, as applicable;

(8) Minor means an individual younger than eighteen years of age;

(9) Online service means any service, product, or feature that is accessible to the public via the Internet, including a website or application. An online service does not include any of the following:

(a) A telecommunications service as defined in 47 U.S.C. 153;

(b) A broadband Internet access service as defined in 47 C.F.R. 8.1(b); or

(c) The sale, delivery, or use of a physical device;

(10) Parent has the same meaning as in the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., and the Federal Trade Commission rules implementing such act;

(11) Personal data means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household. Personal data does not include publicly available data;

(12) Personalized recommendation system means a fully or partially automated system used to suggest, promote, or rank content, including other users, hashtags, or posts, based on the personal data of users;

(13) Precise geolocation information means any data that identifies within a radius of one thousand seven hundred fifty feet a covered minor's present or past location or the present or past location of a device that links or is linkable to a covered minor or any data that is derived from a device that is used or intended to be used to locate a covered minor within a radius of one thousand seven hundred fifty feet by means of technology that includes a global positioning system that provides latitude and longitude coordinates. Precise geolocation information does not include the content of communications or any data generated or connected to advanced utility metering infrastructure systems or equipment for use by a utility;

(14) Process means to perform an operation or set of operations by manual or automated means on personal data. Process includes collecting, using, storing, disclosing, sharing, analyzing, deleting, or modifying personal data;

(15) Profile means any form of automated processing of personal data to evaluate, analyze, or predict certain aspects relating to a covered minor, including a covered minor's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

(16) Publicly available data means data (a) that is lawfully made available from federal, state, or local government records, (b) that a business has a reasonable basis to believe is lawfully made available to the general public by the individual or from widely distributed media, or (c) that is made available by a person to whom the individual has disclosed the data if the individual has not restricted the data to a specific audience. Publicly available data does not mean biometric data collected by a covered online service about a covered minor without the covered minor's knowledge;

(17) Targeted advertising means displaying advertisements to an individual when the advertisement is selected based on personal data obtained or inferred from that individual's activities over time and across nonaffiliated websites or online applications to predict the individual's preferences or interest. Targeted advertising does not include:

(a) Advertisements based on activities within a covered online service's own Internet websites or online applications;

(b) Advertisements based on the context of an individual's current search query, visit to an Internet website, or use of an online application;

(c) Advertisements directed to an individual in response to the individual's request for information or feedback; or

(d) Processing personal data solely to measure or report advertising frequency, performance, or reach; and

(18) User means, with respect to a covered online service, an individual who registers an account or creates a profile on the covered online service.