Section 56:8-166.6 - [Effective 1/15/2025] Controller, consumer, privacy notice, personal data; disclosure, salea. A controller shall provide to a consumer a reasonably accessible, clear, and meaningful privacy notice that shall include, but may not be limited to: (1) the categories of the personal data that the controller processes;(2) the purpose for processing personal data;(3) the categories of all third parties to which the controller may disclose a consumer's personal data;(4) the categories of personal data that the controller shares with third parties, if any;(5) how consumers may exercise their consumer rights, including the controller's contact information and how a consumer may appeal a controller's decision with regard to the consumer's request;(6) the process by which the controller notifies consumers of material changes to the notification required to be made available pursuant to this subsection, along with the effective date of the notice; and(7) an active electronic mail address or other online mechanism that the consumer may use to contact the controller.b. If a controller sells personal data to third parties or processes personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer, the controller shall clearly and conspicuously disclose such sale or processing, as well as the manner in which a consumer may exercise the right to opt out of such sale or processing.c. A controller shall not:(1) require a consumer to create a new account in order to exercise a right, but may require a consumer to use an existing account to submit a verified request; or(2) based solely on the exercise of a right and unrelated to feasibility or the value of a service, increase the cost of, or decrease the availability of, the product or service.Added by L. 2023 , c. 266, s. 3, eff. 1/15/2025.