SENATE BILL 192

57th legislature - STATE OF NEW MEXICO - second session, 2026

INTRODUCED BY

Joseph Cervantes

AN ACT

RELATING TO BUSINESS; ENACTING THE DATA BROKER PRIVACY ACT; CREATING THE DATA BROKER PRIVACY FUND; PROVIDING PENALTIES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

     SECTION 1. [NEW MATERIAL] SHORT TITLE.--This act may be cited as the "Data Broker Privacy Act".

     SECTION 2. [NEW MATERIAL] DEFINITIONS.--As used in the Data Broker Privacy Act:

          A. "consumer" means a natural person who is a resident of New Mexico and who purchases, leases or otherwise contracts for products, goods or services within New Mexico that are primarily used for personal, family or household purposes;

          B. "dark patterns" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making or choice;

          C. "data broker" means a person that knowingly collects and sells to third parties the personal information of a consumer with whom the person does not have a direct relationship; provided that "data broker" does not mean:

                (1) a person to the extent that it is covered by the federal Fair Credit Reporting Act; or

                (2) a person to the extent that it is covered by the federal Gramm-Leach-Bliley Act and implementing regulations;

          D. "department" means the economic development department; and

          E. "personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer or household.

     SECTION 3. [NEW MATERIAL] DATA BROKER REGISTRATION--REQUIREMENTS.--

          A. A data broker shall register with the department pursuant to the requirements of this section.

          B. A data broker shall pay a registration fee in an amount determined by the department, not to exceed the reasonable costs of establishing and maintaining the website provided for in Section 4 of the Data Broker Privacy Act and the reasonable costs of establishing, maintaining and providing access to the accessible deletion mechanism as provided in Section 6 of the Data Broker Privacy Act. Registration fees shall be deposited in the data broker privacy fund.

          C. A data broker shall provide the following information when registering with the department:

                (1) the data broker's name and primary physical, email and internet website addresses;

                (2) whether the data broker collects the personal information of minors;

                (3) whether the data broker collects precise geolocation data of consumers;

                (4) whether the data broker collects reproductive health care data of consumers;

                (5) whether the data broker has undergone an audit as provided in Subsection G of Section 6 of the Data Broker Privacy Act, and, if so, the most recent year that the data broker has submitted a report resulting from the audit and any related materials to the department;

                (6) a link to a page on the data broker's website that:

                     (a) details how a consumer may exercise privacy rights by: 1) deleting personal information; 2) correcting inaccurate personal information; 3) learning what personal information is being collected and how to access that personal information; 4) learning what personal information is being sold or shared and to whom; 5) learning how to opt out of the sale or sharing of personal information; and 6) learning how to limit the use and disclosure of sensitive personal information; and

                     (b) does not make use of any dark patterns;

                (7) whether and to what extent the data broker or any of the data broker's subsidiaries is regulated by:

                     (a) the federal Fair Credit Reporting Act; or 

                     (b) the federal Gramm-Leach-Bliley Act and implementing regulations; and

                (8) any additional information or explanation that the data broker chooses to provide concerning the data broker's data collection practices.

     SECTION 4. [NEW MATERIAL] WEBSITE.--The department shall create a page on the department's website where the registration information provided by data brokers as provided in Subsection C of Section 3 of the Data Broker Privacy Act and the accessible deletion mechanism as provided in Section 6 of that act shall be accessible to the public.

     SECTION 5. [NEW MATERIAL] DATA BROKERS--REQUIRED ACTIONS.--

          A. On or before July 1 of each year, a data broker shall:

                (1) compile the number of deletion requests submitted pursuant to Section 6 of the Data Broker Privacy Act that the data broker received and complied with in whole or in part or denied during the previous calendar year;

                (2) compile the median and mean numbers of days within which the data broker substantively responded to requests submitted pursuant to Section 6 of the Data Broker Privacy Act during the previous calendar year; and

                (3) disclose the metrics compiled pursuant to Paragraphs (1) and (2) of this subsection within the data broker's privacy policy posted on the data broker's website and accessible from a link included in the data broker's privacy policy.

          B. In the disclosure pursuant to Paragraph (3) of Subsection A of this section, a data broker shall disclose the number of requests that the data broker denied in whole or in part because the request:

                (1) was not verifiable;

                (2) was not made by a consumer;

                (3) called for information exempt from deletion; or

                (4) was denied on other grounds.

     SECTION 6. [NEW MATERIAL] DELETION OF PERSONAL INFORMATION.--

          A. The department shall establish an accessible deletion mechanism that:

                (1) implements and maintains reasonable security procedures and practices, including administrative, physical and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used and to protect consumers' personal information from unauthorized use, disclosure, access, destruction or modification;

                (2) allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor;

                (3) allows a consumer to selectively exclude specific data brokers from a request made pursuant to Paragraph (2) of this subsection; and

                (4) allows a consumer to make a request to alter a previous request made pursuant to this subsection after at least forty-five days have passed since the consumer last made a request pursuant to this subsection.

          B. The accessible deletion mechanism established pursuant to Subsection A of this section shall:

                (1) allow a consumer to request the deletion of all personal information related to that consumer through a single deletion request;

                (2) permit a consumer to securely submit information in one or more privacy-protecting ways, as determined by the department, to aid in a deletion request;

                (3) allow a data broker registered with the department to determine whether an individual has submitted a verifiable consumer request to delete the personal information related to that consumer as provided in Paragraph (1) of this subsection and shall not allow the disclosure of any additional personal information when the data broker accesses the accessible deletion mechanism unless otherwise specified in the Data Broker Privacy Act;

                (4) allow a consumer to make a request provided in Paragraph (1) of this subsection using an internet service operated by the department;

                (5) not charge a consumer to make a request provided in Paragraph (1) of this subsection;

                (6) allow a consumer to make a request provided in Paragraph (1) of this subsection in any language spoken by any consumer for whom personal information has been collected by data brokers;

                (7) be readily accessible and usable by consumers with disabilities;

                (8) support the ability of a consumer's authorized agent to aid in the deletion request;

                (9) allow the consumer or the consumer's authorized agent to verify the status of the consumer's deletion request; and

                (10) provide a description of:

                     (a) the deletion permitted by this section, including the actions required by this subsection and Subsection C of this section; 

                     (b) the process for submitting a deletion request pursuant to this section; and

                     (c) examples of the types of information that may be deleted.

          C. Unless a consumer's request was denied pursuant to Subsection B of Section 5 of the Data Broker Privacy Act, a data broker shall within forty-five days after receiving a consumer's request made pursuant to this section:

                (1) access the accessible deletion mechanism established pursuant to Subsection A of this section, process all deletion requests made pursuant to this section and delete all personal information related to a consumer making the request consistent with the requirements of this section; and

                (2) direct all service providers or contractors associated with the data broker to delete all personal information in the service providers' and contractors' possession that is related to the consumers making the requests provided in Subsection A of this section.

          D. Personal information shall not be used or disclosed for any other purpose, including marketing purposes.

          E. After a consumer has submitted a deletion request and a data broker has deleted the consumer's data pursuant to this section, the data broker shall delete all personal information of the consumer at least once every forty-five days pursuant to this section unless the consumer requests otherwise.

          F. After a consumer has submitted a deletion request and a data broker has deleted the consumer's data pursuant to this section, the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise.

          G. Beginning January 1, 2028 and every three years thereafter, a data broker shall undergo an audit by an independent third party to determine compliance with this section. For an audit completed pursuant to this subsection, the data broker shall submit a report resulting from the audit and any related materials to the department within five business days of a written request from the department. A data broker shall maintain the report and materials as provided in this subsection for at least six years.

          H. The department may charge an access fee to a data broker when the data broker accesses the accessible deletion mechanism pursuant to Subsection C of this section, which fee shall not exceed the reasonable costs of providing that access. A fee collected by the department pursuant to this subsection shall be deposited in the data broker privacy fund.

     SECTION 7. [NEW MATERIAL] FAILURE TO REGISTER--FAILURE TO DELETE INFORMATION--PENALTIES.--A data broker that fails to register or fails to delete personal information as required by Section 3 or 6 of the Data Broker Privacy Act is liable for administrative fines and costs in an administrative action brought by the department as follows:

          A. an administrative fine of two hundred dollars ($200) for each day that the data broker fails to register or fails to delete personal information as required by that act;

          B. an amount equal to the fees that were due during the period when the data broker failed to register; and

          C. expenses incurred by the department in the investigation of a data broker's failure to register or failure to delete personal information.

     SECTION 8. [NEW MATERIAL] ADMINISTRATIVE RULES.--

          A. Except as provided in Subsection B of this section, the department may promulgate rules pursuant to the Administrative Procedures Act to implement and administer the Data Broker Privacy Act.

          B. A rule promulgated by the department to establish fees authorized by the Data Broker Privacy Act shall be exempt from the Administrative Procedures Act.

     SECTION 9. [NEW MATERIAL] DATA BROKER PRIVACY FUND.--The "data broker privacy fund" is created as a nonreverting fund in the state treasury. The fund consists of appropriations, gifts, grants, donations and fines and expenses received pursuant to the Data Broker Privacy Act for the purposes of the provisions of that act. The department shall administer the fund. Money in the fund is subject to appropriation by the legislature. Disbursements from the fund shall be made by warrant of the secretary of finance and administration pursuant to vouchers signed by the secretary of economic development or the secretary's authorized representative.

     SECTION 10. EFFECTIVE DATE.--The effective date of the provisions of this act is July 1, 2026.

- 11 -