On February 8, 2024, Senate Bill 473 to enact the Georgia Consumer Privacy Protection Act; to protect the privacy of consumer personal data in this state; to provide definitions; to provide for related matters; to repeal conflicting laws; and for other purposes was introduced to the Georgia Senate.  

Scope of the bill

The bill would apply to persons who conduct business in Georgia by producing products or services targeted to consumers in Georgia with revenue that exceeds $25 million in addition to:  

• controlling or processing the personal information of at least 25,000 consumers and deriving more than 50% of gross revenue from the sale of personal information; or  

• during a calendar year, controlling or processing the personal information of at least 175,000 consumers.  

Data subject rights

Consumers are granted several rights under the bill including the ability to: 

• correct inaccuracies in the consumer's personal information considering the nature of the information and purposes of the processing; 

• request the deletion of personal information; 

• obtain a copy of personal information that the consumer previously provided in a portable and readily usable format; and  

• opt-out of a data controller's processing of personal information for purposes of selling the consumer's personal information, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. 

Obligations under the bill 

Under the bill, data controllers would have the obligation to:  

• limit the collection of personal information to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer; 

• except as otherwise provided throughout the bill, not process personal information for purposes beyond what is reasonably necessary to and compatible with the disclosed purposes for which the personal information is processed without the consumer's consent;  

• establish, implement, and maintain reasonable administrative, technical, and physical data security practices; and 

• not process information in violation of state and federal laws. 

Data controllers are also obligated to establish and provide a privacy notice which includes:

• categories of personal information processed;

• the purposes for processing personal information;

• how consumers can exercise their rights; and 

• if applicable, the categories of personal data sold to third parties and details for how the consumer may opt out of the sale of personal data.

Additionally, data controllers must conduct and document a data protection assessment which would be required for activities that involve the processing of personal data, including:  

• targeted advertising; 

• the sale of personal information; 

• processing of sensitive data;

• processing activities that present a heightened risk of harm to consumers; or

• profiling where the profiling presents a reasonably foreseeable risk of: 

  • unfair or deceptive treatment of, or unlawful disparate impact on, consumers;

  • financial, physical, or reputational injury to consumers; 

  • physical or other intrusion upon the solitude or seclusion or the private affairs or concerns of consumers where the intrusion would be offensive to a reasonable person; or 

  • other substantial injuries to consumers. 

The bill provides 60 days to cure alleged violations before the Attorney General of Georgia (AG) initiates an action. Also, a court may impose a civil penalty of up to $7,500 for each violation and, in the event of willful or knowing violations, award treble damages. 

You can read the bill and track its progress here.

Update: February 20, 2024

Bill referred to Senate Science and Technology Committee

On February 9, 2024, the bill was read and referred to the Senate Science and Technology Committee. 

You can read the bill and track its progress here. 

Update: February 23, 2024

Bill read for a second time

On February 21, 2024, the bill was reported favorably by the Senate Science and Technology Committee and thereafter read, on February 22, 2024, for the second time. 

You can read the bill and track its progress here. 

Update: February 29, 2024

Bill read for a third time and passed by the Senate

On February 27, 2024, the bill was read for a third time and passed with amendments by the Senate Science and Technology Committee. If enacted, the bill will become effective on July 1, 2026. 

You can read the bill and track its progress here. 

Update: March 1, 2024

Bill introduced to the House

On February 29, 2024, the bill was read for the first time in the Georgia House of Representatives. 

You can read the bill and track its progress here. 

Update: March 12, 2024

Bill read for a second time in the House

On March 4, 2024, the bill was read for the second time in the House. 

You can read the bill and track its progress here.

Update: March 22, 2024

House votes favorably on substitute bill

On March 20, 2024, the Technology and Infrastructure Innovation in the House of Representatives voted favorably on a substitute bill. The bill will be presented to the full house floor for consideration. 

You can read the bill and track its progress here.