Online businesses would limit data use and honor privacy requests

Covered online businesses would limit how they collect, use, and share personal information. The rules would cover for-profit online businesses serving people living in or visiting New Mexico. Businesses processing data for 15,000 or fewer people annually would be excluded if they do not broker that data—exchange it for money or other value under the bill's definition. Ordinary data could support requested services and expected non-advertising messages. Advertising and data brokerage would require clear opt-in permission without manipulative designs. Other sensitive-data uses would require opt-in permission unless collection is strictly needed for a requested service, and then only while needed. Sensitive-data consent would expire within one year and could be withdrawn at any time. A parent or guardian would sign for a known minor. Data meeting listed federal privacy laws would count as complying with most requirements. Separate federal rules could satisfy the security duty. Government information and purely physical products would be outside the act's reach. The proposal names July 1, 2026 as the effective date for all provisions. The recorded actions do not establish enactment.

Covered businesses would signal tracking and could not use location boundaries to identify people seeking health care or immigration services. Covered businesses would have to clearly signal use of precise location data or monitoring of online activity. They also could not use or share data to deny equal access to goods or services based on listed traits, including race, disability, and pregnancy. The tracking ban would cover a virtual boundary no more than 2,000 feet from a site's edge, used to identify or track people seeking those services. Businesses could not manipulate online choices to push people into sharing unexpected extra data or giving up privacy protections. Exceptions would preserve specified legal, law enforcement, safety, security, and fraud-related uses. Seeking health care lawful in New Mexico would not count as an emergency. Transfers during a business sale or similar transaction would require advance notice and a reasonable chance to withdraw consent and request deletion.

Covered online platforms would provide privacy controls and protective starting settings for users they know are under 18. A platform could know someone is under 18 through age information, clues it has linked to the user, or use of a feature directed to children. A privacy-protective feed could use chosen preferences, but not browsing history or inferred interests. Known minors would start with unknown contacts blocked unless they initiate contact, overnight notifications off, and feeds using only preferences they expressly provide. Users not known to be minors could disable notifications, choose between privacy-protective and profile-based feeds, and block or screen unknown contacts. Section 3 calls for the highest privacy settings, clear privacy notices, reporting tools, and reasonable data security, with a separate settings rule for users not known to be minors. Businesses could not profile people by default unless needed for the requested service and limited to the parts they actively and knowingly use. Known minors' default settings would disable notifications from 10 p.m. to 6 a.m. Mountain Standard Time.

People could access their information and ask covered businesses to stop using it, correct it, or delete it. People could see their data and learn where it came from, who receives it, why it is used, and how long it is kept. The federal-data compliance exceptions would also apply to these requirements. Request forms would be free and use the language the business uses with the person. Moving data to another covered business would depend on technical feasibility. Deleting or canceling an account would count as a data-deletion request. Information needed to meet legal obligations could be kept. Businesses would take reasonable steps to notify data recipients involved in transactions during the preceding year. Those recipients would also have to delete the data. Businesses could not punish people with higher prices, denied service, or worse service for exercising their rights. Contracts could not waive these rights, and data recipients would need written agreements to follow the act. Businesses would respond to verified rights requests within 45 days. They would delete data within 30 days of a deletion request; notified recipients would have 30 days after receiving notice.

Courts could order covered businesses to stop violations and impose penalties. Consumers and public prosecutors could bring claims under the proposal's rules. Consumers claiming their rights were denied could seek damages and court orders. New Mexico's attorney general or a district attorney could sue over reasonably suspected violations or to prevent violations. The penalty ceilings would apply per affected person for each violation. In consumer cases, courts would weigh the harm, intent, past violations, and efforts to reduce damage when setting penalties. A violation would support a finding of harm, but the business could challenge that finding.