Committee continues walkthrough of consumer data privacy bill, debates definitions for consent, targeted ads and sensitive health data

The Morehouse Committee on Commerce & Economic Development on April 24, 2026 continued a detailed walkthrough of draft F‑71, a proposed consumer data privacy law, as staff and legislators worked through definitions that committee members said will determine how the bill operates in practice.

Rick Seidl of the Office of Legislative Council led the session and read definitions that committee members flagged as consequential, including 'affiliate,' 'control,' 'authenticate' and 'consent.' Seidl summarized authentication as "reasonable means to determine that a request to exercise any of the rights afforded" by the bill is made by or on behalf of a consumer, and said opt‑out provisions are not authentication fees.

Committee members pressed on the meaning of "specific" consent and how the draft treats dark patterns and general terms of use. Seidl read the draft language: "Consent means a clear, affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to allow the processing of personal data." Legislators asked whether the term 'specific' should be constrained by where and how consent is obtained and whether additional drafting is needed to avoid overbroad or vague standards.

The committee spent substantial time on advertising definitions. Seidl described "contextual advertising" as ads served based on immediate context—such as the consumer's presence in a geographic area of at least a 10‑mile radius or online activity from an area estimated to include 5,000 users—and said that contextual signals may not be used to profile consumers. He contrasted that with "targeted advertising," which the draft defines as ads selected in whole or part based on persistent identifiers tied to a consumer or device. A committee member asked whether an ad served to a user on public Wi‑Fi (for example, at a coffee shop) would be considered targeted; Seidl said it depends on whether device identifiers or other persistent identifiers are used.

Seidl also reviewed categories of sensitive data in the draft. The list includes government‑issued identifiers, race/ethnicity, citizenship or immigration status, religion, mental or physical health conditions, reproductive and gender‑affirming health data, sexual orientation and victim status. The draft treats consumer health data as sensitive and, in examples, specifically includes gender‑affirming and reproductive health information.

On genetic data, Seidl said the definition mirrors language from a prior genetic privacy bill and acknowledged a potential overlap with that separate bill aimed at direct‑to‑consumer testing companies; he said staff would check for conflicts. He read and contrasted the bill's 'pseudonymous' and 'de‑identified' wording, noting the draft follows federal de‑identification approaches but that the two terms are legally distinct and may need clearer drafting.

Committee members raised practical questions about authentication for opt‑out requests and unique persistent identifiers. Seidl said the draft excludes identifiers that exist solely to give effect to a consumer's opt‑out request or authentication, but members asked how that would work in practice when a consumer must be authenticated to exercise a right.

No formal votes or motions were taken during the session. The chair announced the committee will begin taking testimony on the bill next Tuesday and asked staff to prepare a side‑by‑side comparison of draft versions ahead of the hearing.

The committee adjourned after scheduling the next meeting and noting additional questions to be addressed in forthcoming testimony.