S 932 — Digital Choice Act

           (ii) cloud storage;

or            (iii) document viewing, sharing, or collaboration services.

    (9) "User" means an individual located in the State who accesses or uses a social media service.

      Section 37-31-20.  If a consumer requests a copy of the consumer's personal data pursuant to Section 37-31-70, then a social media service shall provide the personal data, including the user's social graph, in a format that:

    (1) is portable, to the extent technically feasible;

    (2) is readily usable, to the extent practicable;

and     (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means.

      Section 37-31-30.  (A) A social media company shall implement a transparent, third-party-accessible interoperability interface or interfaces to allow users to choose to:

       (1) share a common set of the user's personal data between the social media services designated by the user;

and        (2) enable third parties to access content created by the user and to be notified when new or updated content is available, with the user's permission.

    (B) A social media company shall reasonably secure all personal data obtained through an interoperability interface.

    (C) To achieve interoperability under subsection (A), a social media company shall:

       (1) utilize an open protocol;

       (2) facilitate and maintain interoperability and synchronous data sharing with other social media services through an interoperability interface, based on reasonable terms that do not discriminate between social media services;

       (3) establish reasonable and proportionate thresholds related to the frequency, nature, and volume of requests, beyond which the social media company may assess a reasonable fee for such access;

       (4) offer to other social media companies a functionally equivalent version of any internal interfaces created by the social media company for the social media company's own social media services;

and        (5) disclose to other social media companies complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.

    (D) A social media company or third party shall safeguard the privacy and security of a user's personal data obtained from other social media services through the interoperability interface in accordance with the social media company's or third party's privacy notice and administrative, technical, and physical data security practices.

    (E) A social media company or third party may not share or receive a user's personal data through the interoperability interface except with the user's consent.

    (F) A social media company shall adopt an accessible, prominent, and persistent method for users to give consent for data sharing with other social media services or third parties through the interoperability interface.

    (G) A social media company is not required to:

       (1) provide access to:

           (a) inferences, analyses, or derived data that the social media company has generated internally about a user;

or            (b) proprietary algorithms, ranking systems, or other internal operating mechanisms;

or        (2) transmit personal data that:

           (a) is stored or structured in a proprietary format;

and            (b) meets both of the following criteria:

               (i) no open, industry-standard format is reasonably available;

and                (ii) transmitting the data would disclose information described in item (1) of this subsection.

    (H) This chapter does not apply to an entity that is:

       (1) owned, controlled, operated, or maintained by a religious organization;

and        (2) exempt from property taxation under state law.

      Section 37-31-40.  (A) The department may identify open protocols that the department has determined, after an assessment, meet the requirements of Section 37-31-40.

    (B) If a social media company uses an open protocol that the department identifies under subsection (4), then the social media company shall be entitled to a rebuttable presumption of providing access on reasonable terms that do not discriminate between social media   services.

      Section 37-31-50.  (A) The department shall administer and enforce this chapter.

    (B) The Attorney General, upon request, shall give legal advice to, and act as counsel for, the department in the exercise of the department's responsibilities under this chapter.

    (C)(1) In addition to the department's enforcement powers under Chapter 6 or any other provisions of this title:

           (a) the department director may impose an administrative fine of up to two thousand five hundred dollars for each violation of this chapter;

and            (b) the department may bring an action in court to enforce a provision of this chapter.

       (2) In a court action by the department to enforce a provision of this chapter, the court may:

           (a) declare that the act or practice violates a provision of this chapter;

           (b) enjoin actions that violate this chapter;

           (c) order disgorgement of any money received in violation of this chapter;

           (d) order payment of disgorged money to an injured purchaser or consumer;

           (e) impose a civil penalty of up to two thousand five hundred dollars for each violation of this chapter;

           (f) award actual damages to an injured purchaser or consumer;

and            (g) award any other relief that the court deems reasonable and necessary.

       (3) If a court grants judgment or injunctive relief to the department, then the court shall award the department:

           (a) reasonable attorney's fees;

           (b) court costs;

and            (c) investigative fees.

       (4)(a) A person who violates an administrative or court order issued for a violation of this chapter is subject to a civil penalty of not more than five thousand dollars for each violation.

           (b) A civil penalty authorized under this section may be imposed in any civil action brought by the department, or by the Attorney General on behalf of the department.

      Section 37-31-60.  (A) A consumer has the right to:

       (1) confirm whether a controller is processing the consumer's personal data;

and        (2) access the consumer's personal data.

    (B) A consumer has the right to delete the consumer's personal data that the consumer provided to the controller.

    (C) A consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a format that:

       (1) to the extent feasible, is portable;

       (2) to the extent practicable, is readily usable;

and        (3) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

    (D) A consumer has the right to request that a controller correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data.

    (E) A consumer has the right to opt out of the processing of the consumer's personal data for purposes of:

       (1) targeted advertising;

or        (2) the sale of personal data.

  SECTION 2.  This act takes effect upon approval by the Governor.

----XX---- This web page was last updated on February 18, 2026 at 01:30 PM