1. United States
2. N.J.
3. Letter

(ii) is provided in response to a specific request from a covered entity, or a service provider on behalf of a covered entity, that meets the requirements of subparagraph (B). (B) REQUEST REQUIREMENTS.—The requirements of this subparagraph with respect to a request are the following: (i) The request is provided to the individual in a clear and conspicuous standalone disclosure. (ii) The request includes a description of each act or practice for which the consent of the individual is sought and— (I) clearly distinguishes between an act or practice that is necessary, proportionate, and limited to fulfill a request of the individual and an act or practice that is for another purpose; (II) clearly states the specific categories of covered data that the covered entity shall collect, process, retain, or transfer under each such act or practice; and (III) is written in easy-to-understand language and includes a prominent heading that would enable a reasonable individual to identify and understand each such act or practice. (iii) The request clearly explains the applicable rights of the individual related to consent. (iv) The request is made in a manner reasonably accessible to and usable by individuals living with disabilities. (v) The request is made available to the individual in the language in which the covered entity provides a product or service for which authorization is sought. (vi) The option to refuse consent is at least as prominent as the option to provide consent, and the option to refuse consent takes no more than 1 additional step as compared to the number of steps necessary to provide consent. (vii) With respect to affirmative express consent sought for the collection, processing, retention, or transfer of biometric information or genetic information, the request includes the length of time the covered entity or service provider intends to retain the biometric information or genetic information or, if it is not possible to identify the length of time, the criteria used to determine the length of time the covered entity or service provider intends to retain the biometric information or genetic information. (C) EXPRESS CONSENT REQUIRED.—Affirmative express consent to an act or practice may not be inferred from the inaction of an individual or the continued use by an individual of a service or product provided by an entity. (D) WITHDRAWAL OF AFFIRMATIVE EXPRESS CONSENT.— (i) IN GENERAL.—A covered entity shall provide an individual with a means to withdraw affirmative express consent previously provided by the individual. (ii) REQUIREMENTS.—The means to withdraw affirmative express consent described in clause (i) shall be— (I) clear and conspicuous; and (II) as easy for a reasonable individual to use as the mechanism by which the individual provided affirmative express consent. (E) CHILDREN AND TEENS.—If a covered entity has knowledge that— (i) an individual is a child, only a parent of the child may provide affirmative express consent on behalf of the child; or (ii) an individual is a teen, a parent or the teen may provide affirmative express consent on behalf of the teen. (2) BIOMETRIC INFORMATION.— (A) IN GENERAL.—The term “biometric information” means any covered data that allows or confirms the unique identification or verification of an individual and is generated from the measurement or processing of unique biological, physical, or physiological characteristics, including— (i) fingerprints; (ii) voice prints; (iii) iris or retina imagery scans; (iv) facial or hand mapping, geometry, or templates; and (v) gait. (B) EXCLUSION.—The term “biometric information” does not include— (i) a digital or physical photograph; (ii) an audio or video recording; or (iii) data derived from a digital or physical photograph or an audio or video recording that cannot be used to identify or authenticate a specific individual. (3) CHILD.—The term “child” means an individual under the age of 13. (4) CLEAR AND CONSPICUOUS.—The term “clear and conspicuous” means, with respect to a disclosure, that the disclosure is difficult to miss and easily understandable by ordinary consumers. (5) COARSE GEOLOCATION INFORMATION.—The term “coarse geolocation information” means information that reveals the present physical location of an individual or device identified by a unique persistent identifier at the ZIP Code attribution level (except, if a geographic area attributed to a ZIP Code is equal to or less than the area of a circle with a radius of 1,850 feet or less, at a level greater than a geographic area equal to the area of a circle with a radius of 1,850 feet). (6) COLLECT.—The term “collect” means, with respect to covered data, to buy, rent, gather, obtain, receive, access, or otherwise acquire the covered data by any means. (7) COMMISSION.—The term “Commission” means the Federal Trade Commission. (8) COMMON BRANDING.—The term “common branding” means a name, service mark, or trademark that is shared by 2 or more entities. (9) CONNECTED DEVICE.—The term “connected device” means a device that is capable of connecting to the internet. (10) CONTEXTUAL ADVERTISING.—The term “contextual advertising” means displaying or presenting an advertisement that— (A) does not vary based on the identity of the individual recipient; and (B) is based solely on— (i) the content of a webpage or online service; (ii) a specific request of the individual for information or feedback; or (iii) coarse geolocation information. (11) CONTROL.—The term “control” means, with respect to an entity— (A) ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of the entity; (B) control over the election of a majority of the directors of the entity (or of individuals exercising similar functions); or (C) the power to exercise a controlling influence over the management of the entity. (12) COVERED DATA.— (A) IN GENERAL.—The term “covered data” means information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies or is linked or reasonably linkable to 1 or more individuals. (B) EXCLUSIONS.—The term “covered data” does not include— (i) de-identified data; (ii) employee information; (iii) publicly available information; (iv) inferences made exclusively from multiple independent sources of publicly available information, if such inferences— (I) do not reveal information about an individual that meets the definition of the term “sensitive covered data” with respect to the individual; and (II) are not combined with covered data; (v) information in the collection of a library, archive, or museum, if— (I) the collection is— (aa) open to the public or routinely made available to researchers who are not affiliated with the library, archive, or museum; and (bb) composed of lawfully acquired materials with respect to which all licensing conditions are met; and (II) the library, archive, or museum has— (aa) a public service mission; and (bb) trained staff or volunteers to provide professional services normally associated with libraries, archives, or museums; or (vi) on-device data.