Online Privacy Act, Sec. 106 ("Individual autonomy")

Summary

Prohibits covered entities from collecting, processing, maintaining, or disclosing personal information for behavioral personalization without affirmative express consent.

Requires covered entities to obtain express affirmative consent before providing behaviorally personalized products or services, and annually thereafter.

Mandates providing non-personalized versions of products or services if consent is denied, or core aspects if full functionality without personalization is infeasible.

Allows denial of products or services if no core aspect can function without personalization and consent is not given.

Permits processing personal information for usability improvements using aggregated data, provided the output is uniform and independent of individual characteristics.

Excludes optimizations aimed primarily at increasing user engagement time from the definition of "usability."

Exempts small businesses from these requirements.

Prohibits a covered entity from using personal data for behavioral personalization without express consent.

SEC. 106. RIGHT TO INDIVIDUAL AUTONOMY.

(a) In General.—A covered entity shall not collect, process, maintain, or disclose an individual’s personal information to—

(1) create, improve upon, or maintain;

(2) process with; or

(3) otherwise link an individual with;

an algorithm, model, or other means designed for behavioral personalization, without the affirmative express consent of that individual.

Requires obtaining consent before providing behaviorally personalized services, and annually thereafter; mandates non-personalized alternatives if denied.

(b) Consent.—A covered entity must obtain express affirmative consent from an individual before it may provide a behaviorally personalized version of a product or service, and not less than every calendar year thereafter. Where consent is denied, a covered entity must provide the product or service without behavioral personalization.

Allows denial of service if behavioral personalization is essential and consent is not given.

(c) Exceptions To Providing Product Or Service.—

(1) Where the offering of a substantially similar product or service without behavioral personalization is infeasible, a covered entity shall provide, to the greatest extent feasible, a core aspect or part of the product or service that can be offered without behavioral personalization.

(2) Where no core aspect or part of the product or service can function in a substantially similar function without behavioral personalization, a covered entity may deny providing an individual use of such product or service if such individual does not consent to behavioral personalization as required in subsection (a).

Allows processing personal information for usability if aggregated and uniformly applied across users.

(d) Exception To Behavioral Processing.—Notwithstanding subsections (a) and (b), a covered entity may process personal information to create or operate behavioral personalization algorithms, models, or other mechanisms for the purpose of increasing the usability of the product or service provided by a covered entity that—

(1) are built using aggregated personal information that is representative of all the personal information the covered entity maintains; and

(2) have an output that is both uniform across the individuals that use the product or service and independent of a specific individual’s inherent or behavioral characteristics.

Excludes small businesses from the section.

(e) Usability.—The term “usability” as used in subsection (d) does not include optimizations or other alterations to the product or service that are made with the primary purpose of increasing the amount of time an individual engages with or uses the product or service, unless such increase benefits the individual.

(f) Small Businesses Excluded.—This section does not apply to a small business.