A controller must give consumers a clear way to opt out of targeted advertising or sale of personal data, and must follow valid opt-out signals.
(a) A parent or legal guardian of a known child or a guardian or conservator of a consumer may act on the known child’s or the consumer’s behalf to opt out of the processing of the known child’s or the consumer’s personal data for one or more of the purposes specified in Section 8-44-5. (b) A controller must allow a consumer to opt out by providing a clear and conspicuous link on the controller’s Internet website to an Internet web page that enables a consumer directly to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising or sale of the consumer’s personal data, or provides up-to-date contact information for a consumer to submit the opt-out request. (c)(1) If a consumer’s decision to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of personal data, through an opt-out preference signal sent in accordance with this section conflicts with the consumer’s existing controller-specific privacy setting or voluntary participation in a controller’s bona fide loyalty, rewards, premium features, discounts, or club card program, the controller shall comply with the consumer’s opt-out preference signal but may notify the consumer of the conflict and provide the choice to confirm controller-specific privacy settings or participation in such a program. (2) If a controller responds to consumer opt-out requests received in accordance with this section by informing the consumer of a charge for the use of any product or service, the controller shall present the terms of any financial incentive offered pursuant to this section for the retention, use, sale, or sharing of the consumer’s personal data.