![](data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTQ4Ny41cHQiIGhlaWdodD0iMTkyNXB0IiB2aWV3Qm94PSIwIDAgMTQ4Ny41IDE5MjUiIHZlcnNpb249IjEuMiI+CjxnIGlkPSJzdXJmYWNlMTMiPgo8L2c+Cjwvc3ZnPgo=)
(B) Alone or in combination, annually buys or
receives, sells or shares for commercial purposes,
alone or in combination, the personal information of
at least 50,000 consumers, households or devices.
(C) Derives at least 50% of annual revenues from
selling consumers' personal information.
(2) An entity that controls a sole proprietorship,
partnership, limited liability company, corporation,
association or other legal entity under paragraph (1) and
shares common branding with the sole proprietorship,
partnership, limited liability company, corporation,
association or other legal entity.
"Covered entity." As defined in 45 CFR 160.103.
"Dark pattern." A user interface designed or manipulated
with the substantial effect of subverting or impairing user
autonomy, decision making or choice, including a practice the
Federal Trade Commission refers to as a dark pattern.
"Decisions that produce legal or similarly significant
effects concerning the consumer." Decisions made by a
controller that result in the provision or denial by the
controller of financial or lending services, housing, insurance,
education enrollment or opportunity, criminal justice,
employment opportunities, health care services or access to
essential goods or services.
"De-identified data." Data that cannot reasonably be used to
infer information about, or otherwise be linked to, an
identified or identifiable individual or a device linked to the
individual, if the controller that possesses the data complies
with the following criteria:
(1) Takes reasonable measures to ensure that the data
A02979 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30