An Act to restrict the processing of online personal data of individuals sixteen years of age or younger.

Be it enacted by the Legislature of the State of South Dakota:

Section 1. That a NEW SECTION be added to a NEW CHAPTER in title 26:

Terms used in this chapter mean:

(1) "Covered user," a user of a mobile application, online application, online service, or website in the state who is:

(a) Actually known by the operator of the application, service, or website to be sixteen years of age or younger; or

(b) A user of an application, service, or website targeted to individuals sixteen years of age or younger;

(2) "Operator," a person who operates a mobile application, online application, online service, or website on the internet, and:

(a) Collects or maintains, either directly or through another person, personal data from or about a user of the application, service, or website;

(b) Integrates with another application, service, or website and directly collects personal data from a user of that application, service, or website;

(c) Allows another person to collect personal data directly from a user of the application, service, or website; or

(d) Allows a user of the application, service, or website to publicly disclose the user's personal data;

(3) "Personal data," any information that identifies or could reasonably be linked with a specific individual, including an individual's:

(a) First and last name;

(b) Home or other physical address;

(c) Email address;

(d) Telephone number

(e) Social Security number; and

(f) Information generated from the measurement or technological processing of the individual's biological, physical, or physiological characteristics; and

(4) "Processing," the access, analysis, creation, collection, de-identification, deletion derivation, destruction, disclosure, disposal, generation, licensing, modification, monetization, organization, recording, retention, sale, sharing, storage, structuring, transmission, or use of personal data, or any other operation or set of operations performed on personal data.

Section 2. That a NEW SECTION be added to a NEW CHAPTER in title 26:

Except as provided for in section 3 of this Act, an operator may not process, or allow a third party to process, the personal data of a covered user collected through the use of a mobile application, online application, online service, or website, unless:

(1) The covered user is twelve years of age or younger and the processing is permitted under 15 U.S.C. § 6502 (January 6, 2025) and its implementing regulations;

(2) The covered user is at least thirteen years of age but under the age of sixteen and consent for the processing is obtained from the covered user's parent or legal guardian; or

(3) The processing is strictly necessary for an activity set forth in section 3 of this Act.

Section 3. That a NEW SECTION be added to a NEW CHAPTER in title 26:

The processing of personal data of a covered user is permissible if the processing is strictly necessary to:

(1) Provide or maintain a specific product or service requested by the covered user;

(2) Conduct the operator's internal business operations, if the operations do not include any activities related to marketing, targeted advertising, or providing products or services to a third party, or prompting covered users to use the mobile application, online application, online service, or website when it is not in use;

(3) Identify and repair a technical error that impairs existing or intended functionality;

(4) Protect against malicious, fraudulent, or illegal activity;

(5) Investigate, establish, exercise, prepare for, or defend a legal claim;

(6) Comply with federal, state, or local laws, rules, or regulations;

(7) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, local, or other governmental authority; or

(8) Detect, respond to, or prevent a security incident or threat.

Section 4. That a NEW SECTION be added to a NEW CHAPTER in title 26:

Within fourteen days of determining a user is a covered user, an operator shall:

(1) Destroy, or delete all personal data of the covered user, unless processing the personal data is permitted under section 2 of this Act; and

(2) Notify any third party to whom the personal data was disclosed, and any third party the operator allowed to process the personal data, that the user is a covered user.

Section 5. That a NEW SECTION be added to a NEW CHAPTER in title 26:

Whenever it appears to the attorney general, either upon complaint or otherwise, that any person, within or outside the state, has violated the provisions of this chapter, the attorney general may:

(1) Bring a civil action in the name and on behalf of the state to enjoin and restrain the continuation of the violation; or

(2) Impose a civil penalty against the person in an amount not exceeding five thousand dollars for each violation. The attorney general shall forward any civil penalty collected under this section to the state treasurer, for deposit in the general fund.

The attorney general shall provide written notice of any alleged violation of this chapter to the operator at least sixty days before initiating any action pursuant to this section. If the operator fails to cure the violation within sixty days of receipt of the notice, the attorney general may bring an action pursuant to this section.

The provisions of this chapter are enforceable solely by the attorney general. Nothing in this chapter may be construed to create a private right of action.